Slashdot Mirror
Equifax Says 2.5 Million More Americans May Be Affected By Hack (reuters.com)
According to Reuters, Equifax said about 2.5 million additional U.S. consumers may have been impacted by a cyber attack at the company last month. Last month, the company disclosed that personal details of up to 143 million U.S. consumers were accessed by hackers between mid-May and July.
As for what led to the breach, Ars Technica reports it was "a series of costly delays and crucial errors." From the report: Chief among the failures: an Equifax e-mail directing administrators to patch a critical vulnerability in the open source Apache Struts Web application framework went unheeded, despite a two-day deadline to comply. Equifax also waited a week to scan its network for apps that remained vulnerable. Even then, the delayed scan failed to detect that the code-execution flaw still resided in a section of the sprawling Equifax site that allows consumers to dispute information they believe is incorrect. Equifax said last month that the still-unidentified attackers gained an initial hold in the network by exploiting the critical Apache Struts vulnerability.
As for what led to the breach, Ars Technica reports it was "a series of costly delays and crucial errors." From the report: Chief among the failures: an Equifax e-mail directing administrators to patch a critical vulnerability in the open source Apache Struts Web application framework went unheeded, despite a two-day deadline to comply. Equifax also waited a week to scan its network for apps that remained vulnerable. Even then, the delayed scan failed to detect that the code-execution flaw still resided in a section of the sprawling Equifax site that allows consumers to dispute information they believe is incorrect. Equifax said last month that the still-unidentified attackers gained an initial hold in the network by exploiting the critical Apache Struts vulnerability.
Tibetan monks here on sabbatical? Dogs? The flea's on said dogs?
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
and say Everybody
Professor Farnsworth: "Good News Everyone! Equifax Says 2.5 Million More Americans May Be Affected By Hack"
Leela: But that's worse than what it was before!!!
Professor Farnsworth: "Huh, wuh?"
Your personal information is being shared by your creditors/bank with equifax. That is the only way they collect information.
Write your creditors and say you no longer consent to your information being sent to equifax due to their ongoing security issues. There are two other reporting agencies they can use, tell them you only want information shared with experian and transunion until further notice. Even if they say no, say you will hold them legally responsible for information shared with equifax after equifax has been shown to be an immediate and clear security risk.
It is pretty much the only way to hurt equifax. Gets companies to stop using them. Convince companies that no matter how strong their own privacy policies are, they don't work if they are not transitive to everyone they share your information with.
Heck, make this idea popular enough that credit card companies start listing "wont share your information with equifax." as a selling point and it will hurt them bad and make everyone take security more seriously.
http://notanumber.net/
But an we toss all the Cxx'x into prison for a few years, strip them of their assets, and make Equifax an example? They fucked up the rest of my life, one would hope the rest of their lives would be fucked as well.
They are the VW of credit agencies.
Table-ized A.I.
an Equifax e-mail directing administrators to patch a critical vulnerability in the open source Apache Struts Web application framework went unheeded
Yeah, right. Makes it sound like "equifax", eg some MBA, tried to get "admins" to patch it, but they refused.
Almost certainly what happened was the "Equifax email" was from an IT guy, and some admin manager said "NO, we can't do it right now."
I wonder what department the email was from, and to. And what conversation was had outside of an email stream. "Too costly", "Too busy", "No time", "Can't afford it".
Now that all hell has broken loose, I'm sure everyone's trying to claim "I wanted to do it!". Lies!
so nothing after that is surprising. Plus, they had a hiring freeze for males so again, no mistakes are surprising.
Some clarification was required. 43 people in Delaware were not impacted. Thank you Ironically, the payouts made to management who are resigning, will on a per victim basis probably be greater than any of the victims will receive via any legal action taken.
1. You've already entered into a contract with your bank and creditors (aka "the fine print"). Typically the fine print allows them to change the terms of the contract under certain conditions but it does not allow you to change the terms of the contract. You can't just willy, nilly change a contract you don't like (unless it was stated in the original contract).
2. Unless your letter is notarized and requires a signature on delivery, it's pretty much worthless as well. They have no way of verifying the letter is actually from you (hence the notary) and you have no proof that they received it.
If an ordinary citizen did something this bad, we'd either get the death penalty or life in the gulag torture camps (living death). So this company needs to get the death penalty. Remember, corporations are people too!
Revoke Equifax's charter, shut them down, seize their assets for the public coffers. The American people deserve to see the management of Equifax standing in an unemployment line.
says it all..
open sores
Maybe some had more data to share than others, but I wouldn't bet on anyone's personal data escaping unscathed. It would take an act of Congress to protect citizens from the fallout of this breach, but I doubt the current "business friendly" environment will do much to protect the average American.
Time is what keeps everything from happening all at once.
Don't feel that [nero-online.org] do, or indded what
Yeah, dropping this press release just after a major national event that is consuming all the news cycles so it gets lost in the noise. How can the PR person who allowed this to get pushed out during such a situation look at themselves in the mirror and not think they are scum?
... everybody gets hacked, so it's not like all the information wasn't out there already. Business as usual.
At this moment these are just rounding numbers. It is easier to say everybody was hacked. Then look at who was not.
What I still find appalling is that the people that where hacked are "just" a few million people, but the real stink is how they dropped stock. It is like that douchebag with the inhalers. Screwing over a few million people for money is not an issue, but take some money from the rich and you are dead.
I am not saying that they should not be prosecuted for that but the company should be offline till the investigations end at least. The only thing that should be available online is a static webpage telling that they are offline.
Just as a precaution, the same should be done to their competitors till they show they are secure.
But that would mean they can't make money and we can't have peoples lives interfere with that, now can we?
Don't fight for your country, if your country does not fight for you.
FTC should now direct that ALL these types of organizations shall LOCK ALL CREDIT REPORTING unless requested to be opened by the OWNER of the accounts.
Not just forgetting to patch but also allowing entrance via default admin/admin login/password, perhaps allowing attackers to discover other credentials and attack vectors to exploit elsewhere.
Twinstiq, game news
There are 326 million American citizens. Of those about 74.2 million are children (under age 18), and only about 127 million are employed full-time.
This means that 326-(74.2 + 127) = 124 million are not employed full time. Equifax is more likely to have a file on a working adult, especially given how credit checks are part of modern employment screening, than a non-working adult. The breach is large enough that it covers every working adult in the US and then a very good chunk of the non-working ones.
It is everyone. Everyone. There isn't a person whose identity isn't compromised here. If you work, the odds of being in this hacked list are more likely than not.
So, credit just died, and nobody realized it. Wow. It is going to suck when that starts to hit home. This is the Craftsman-goes-to-China-gives-secret-sauce-to-everyone moment for the credit industry.
-Engr Student
Has anyone bothered to ask why there are only 3 major credit bureaus?
So a quick google search shows there are about 250 million adults in the U.S.
Subtract those that are older and haven't applied for credit in a very long time.
Subtract the college students that have never applied for credit using a credit bureau.
Subtract the tinfoil hat crowd.
Subtract those in prison.
It seems to me that every American actively participating in this nations credit system has been hacked. The way the number is reported, it seems like it was a partial database breach. But subtracting out those not currently participating in the credit system seems awfully close to the number reported.