Slashdot Mirror
Equifax Lobbied For Easier Regulation Before Data Breach (wsj.com)
WSJ reports: Equifax was lobbying lawmakers and federal agencies to ease up on regulation of credit-reporting companies in the months before its massive data breach. Equifax spent at least $500,000 on lobbying Congress and federal regulators in the first half of 2017, according to its congressional lobbying-disclosure reports. Among the issues on which it lobbied was limiting the legal liability of credit-reporting companies. That issue is the subject of a bill that a panel of the House Financial Services Committee, which oversees the industry, discussed the same day Equifax disclosed the cyberattack that exposed personal financial data of as many as 143 million Americans. Equifax has also lobbied Congress and regulatory agencies on issues around "data security and breach notification" and "cybersecurity threat information sharing," according to its lobbying disclosures. The amount Equifax spent in the first half of this year appears to be in line with previous spending. In 2016 and 2015, the company's reports show it spent $1.1 million and $1.02 million, respectively, on lobbying activities. While the company had broadly similar lobbying issues in those years, the liability matter was new in 2017.
They knew about the breach when they started lobbying for that. LONG before the poor schmucks were allowed to know about it.
-=This sig has nothing to do with my comment. Move along now=-
Equifax disclosed the cyberattack
Welcome to the age of "cyber war", where every crap system connected to the internet can hide under the umbrella of an "attack" rather than face the consequences of a complete disregard for properly designed information security.
If only they could have been freed from the yoke of these onerous, confusing regulations, this never would have happened!
---- The above post was generated by the Turing Institute. Maybe.
Your data wouldn't have been given to criminals if they had invested that $500K in security.
Anons need not reply. Questions end with a question mark.
Actually, the cost of doing business it is always cheaper for lawyers than just about anything else. Lawyers keep you out of Legal Danger (or at least are supposed to).
And until the Corporate board and the CxOs and the Shareholders are held accountable, nothing will actually change.
The only way to solve this problem is start charging the bigwigs at the top for criminal negligence of the corporate culture they foster. Followed by Corporate Death Penalty where the corporate charter is revoked. When shareholders are caught empty handed with nothing to show, they will DEMAND corporations uphold their due diligence and actually start protecting their data.
Lastly, I would suggest that the default nature of Credit is keeping it in a frozen state. It should take extraordinary effort to open credit account.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
I clearly remember the banks and Wall Street firms lobbying Bush and Congress not to implement any new regulations back in 2006. Their words were, more or less, any new regulations would kill their competitive nature on the world market. Trust us, we know what we're doing.
The following year we know what happened.
Now here we are again, with a very similar situation. Regulations are evil! Don't kill us with regulations, bro!
I can guarantee not a single executive at Equifax will go to jail or pay a fine. Further, every excuse imaginable will be given why requiring such breaches to be announced immediately should not be done.
In a few years, this will happen again and everyone will look around and ask, "How did this happen?"
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
You think maybe Equifax is exemplar of all the other credit reporting agencies? I think they might be. I think there needs to be some corporate nutsacks put on the congressional anvil, with liberal application of the judicial sledgehammer over this, to ALL of them. It's bad enough that jackass businesses like Facebook and Google and ISPs are invading our privacy, but companies like these credit reporting agencies MUST BE ABOVE REPROACH AT ALL TIMES OR THEY ARE WORSE THAN USELESS. It is totally, completely unacceptable that this happened at all and it has to STOP.
Its normally quite good for the public, though you couldn't convince them of that since they get their swill from big media.
Until at least late 2016, there was this hardcoded into their mobile app (http://www.apkmonk.com/app/com.equifax/):
UtilitiesHandler.java
static final String masterKey = "EqUiFaX2468";
Not quite "1...1!...2....2!..." but it's pretty darn close.
To be fair, I couldn't tell if it's actually ever used in the mobile app. It seems like the kind of intentionally stupid/obvious password-but-not-really-a-password string you'd leave hanging around in a file on the network if you were tuning your DLP. (The full Zip code of the company is 30309-2468 so the "plus 4" is probably where the ending came from.)
They said this data breach took place from May through July. How exactly does one miss terabytes, possibly petabytes of data being transferred to an IP address outside of your network for 3 months? I mean to me this sounds like either the hackers were god like in their ability to hide what they were doing, or the people whose job it was to prevent these things from happening, simply didn't give a shit.
The constant whine about regulations when as a country we pretty much allow our large corporations to get away with anything is rather tiresome.
If there were no regulations, this would never have happened, and we would all enjoy perfect internet security.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
You are taking their word for when the breach started? LOLOLO ahaha ahaqhaa !! Aren't you cute.