Slashdot Mirror
Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed (bloomberg.com)
Bloomberg is reporting that Equifax, the credit reporting company that recently reported a cybersecurity incident impacting roughly 143 million U.S. consumers, learned about a breach of its computer systems in March -- almost five months before the date it has publicly disclosed. The company said the March breach was unrelated to the recent hack involving millions of U.S. consumers, but one of the people familiar with the situation said the breaches involve the same intruders. From the report: Equifax hired the security firm Mandiant on both occasions and may have believed it had the initial breach under control, only to have to bring the investigators back when it detected suspicious activity again on July 29, two of the people said. Equifax's hiring of Mandiant the first time was unrelated to the July 29 incident, the company spokesperson said. The revelation of a March breach will complicate the company's efforts to explain a series of unusual stock sales by Equifax executives. If it's shown that those executives did so with the knowledge that either or both breaches could damage the company, they could be vulnerable to charges of insider trading. The U.S. Justice Department has opened a criminal investigation into the stock sales, according to people familiar with the probe.
In early March, they said, Equifax began notifying a small number of outsiders and banking customers that it had suffered a breach and was bringing in a security firm to help investigate. The company's outside counsel, Atlanta-based law firm King & Spalding, first engaged Mandiant at about that time. While it's not clear how long the Mandiant and Equifax security teams conducted that probe, one person said there are indications it began to wrap up in May. Equifax has yet to disclose that March breach to the public.
In early March, they said, Equifax began notifying a small number of outsiders and banking customers that it had suffered a breach and was bringing in a security firm to help investigate. The company's outside counsel, Atlanta-based law firm King & Spalding, first engaged Mandiant at about that time. While it's not clear how long the Mandiant and Equifax security teams conducted that probe, one person said there are indications it began to wrap up in May. Equifax has yet to disclose that March breach to the public.
Maybe this will make people stop being so dependent on debt. Then perhaps the price of things will go down since no one will finance them any longer. Then maybe we'll see the banksters starving in the gutter.
She spotted and stopped the first breach like a pro.
March breach -> Mandiant wrap up in May -> July breach -> August stock sales -> September public announcement
What is even more pertinent is who the hell hacked them and more to the point why? Stay tuned and get the pop corn ready slashdotters! The shit is about to hit the fan and most likely some people in Washington are going to be quacking loudly and swimming for cover.
This message was not sent from an iPhone because Peter Sellers really was a deviated prevert without a dime for the call
By an interesting coincidence, I ended finally applying for a credit card (after many years of debit card only) - and American Express wanted me to fill out a form that would have the US treasury make all of my tax records available to Equifax. I looked into it a bit more and apparently American Express has this rather heavy handed tactic of picking some of their customers more or less at random, suspending all their accounts, and then holding the accounts hostage until the customers agree to have the treasury release their tax forms to Equifax. In a perfect world, American Express would face some consequences for forcing their customers to give all kinds of detailed and unnecessary financial information to a firm as incompetent and malicious as Equifax.
You hire a security firm and at the same time you don't bother to update critical security issue with the software? Did they have an audit or did they just pay $$ for a PCI compliance sticker? How did the audit go - how come it not revealed issues with too much data being accessible from public subnet? just too many questions....
Personally I think public execution would be a better example for execs everywhere, but jail for life is an acceptable alternative.
It's time to make it illegal to use Social Security numbers for any purpose other than government usage. The release of SSNs is the real Equifax damage here. There is no need for colleges, banks or hospitals to be using it. Colleges, banks and hospitals managed to function before SSNs came into existence; they can do so again.
If the hack was perpetrated five months ago and kept quiet, there has been plenty of time for a great use of the data to be used in enormous amounts of fraud. I haven't heard of such, but may not have listened carefully enough. So, is there really a problem?
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Tried to do a credit freeze with Equifax on two occasions last week, and got a 500 Error from their server. Credit freezes on the other two of the big three, Experian and Transunion, went well.
I am seeing the development of a narrative where you end up taking the blame. Sort of like BP tried to do with TransOcean.
Lies after lies... they simply refuse to do the right thing. My prediction is that lenders will stop using Equifax reports to make lending decisions and there will be a law/legislation to allow customers to request creditors not to report their information to Equifax.... or to any bureau for that purpose.
If the US lived under capitalism, the corporation would be dissolved and its executives would be jailed.
Luckily, we live in a Mercantilist society, where only the oligarchs make the rules, and our "elections" are fixed.
-- Tigger warning: This post may contain tiggers! --
get what you deserve.
Our CIO has a psychology degree, and he is terrible. Security is an afterthought. Instead of designing things to be secure from the ground up (like UNIX), we play whack-a-mole (like Windows) when we find problems.
I almost wonder if the earlier dates is the reason why I started to getting a lot more marketing calls even through I'm on the do not call list.
Why do we need three of these companies anyway? More is not better.
Shut Equifax down. Liquidate assets, divide up cash to all 140+ million impacted people around the globe.
And use that as example of what happens when company has data breach. No new laws necessary.
The others will get the very clear message.
Case closed.
that earlier intrusion was probably just a soft test for what became the big score.
equifax should be as fucked-over as the rest of us.. but nope, they'll emerge relatively unscathed instead. your trump administration at work.
...I'll just state the obvious: no one ever voluntarily gave their info to Equifax.
As far as I know.
In 2009 I used an email address unique to equifax only, never used anywhere else (I use a different email address to register at each website, usually in the form of websitedomainname@mydomain) to register at their website for the annual free credit report.
In 2011, I start getting a bunch of spam at the equifax-specific address. Bad spam, as in it's very unlikely that the spammers obtained my address by just buying a mailing list from Equifax and more likely someone stole it from them.
In other words, they've had poor security for years and years.
A bunch of sniveling golden parachute cowards, miscreants, and incompetents! Jail them!!
If an enterprise company uses open source software, it has to commit resources internally to vet the source code to make sure that no vulnerabilities exist.
Does anyone really think that this ends with just Equifax? The other credit agencies have more than likely been breached at some point too. I would not bet against the probability that every US citizen has likely had some or all of their identity and financial information leaked, hacked, stolen or sold to other parties. We may all end up adding a credit watching/protection "service" to the list of our many, monthly paycheck leeches. First World Problems I guess...