Slashdot Mirror
Equifax Increases Number of Britons Affected By Data Breach To 700,000 (telegraph.co.uk)
phalse phace writes: You know those 400,000 Britons that were exposed in Equifax's data breach? Well, it turns out the number is actually closer to 700,000. The Telegraph reports: "Equifax has just admitted that almost double the number of UK customers had their information stolen in a major data breach earlier this year than it originally thought, and that millions more could have had their details compromised. The company originally estimated that the number of people affected in the UK was 'fewer than 400,000.' But on Tuesday night it emerged that cyber criminals had targeted 15.2 million records in the UK. It said 693,665 people could have had their data exposed, including email addresses, passwords, driving license numbers, phone numbers. The stolen data included partial credit card details of less than 15,000 customers."
Then we can be sure heads will roll, literally, in the Equifax C-suite.
I love imperial math units.
No need to mete out the bad news. We know it was everyone.
That's shocking!
This is good news! The fact that this affected people outside the US means that maybe a government without a mouth full of corporate dicks will actually do something about it.
When you get caught with something ( in this case data ) you're not even supposed to have . . . . . . .
I like how they try to downplay it by pretending it was only X or Y. Completely avoiding the whole question of why they have it in the first place. :|
Why don't you tell everyone that your business model sucks - people are the product. At least Equifax has caused a review of IDENTITY. Just finished setting up a utility at a new home - guy wanted my SSN just to hook up some "service" - a point at which I normally balk; but then EQUIFAX comes to mind. Why not broadcast my SSN? Equifax has. I gave the guy the SSN frequently associated with a name similar to what I gave him. Passed a "credit check". Really, honestly, might not be 'me' - so thanx, Equifax.
Actually, it would be a lot more effective if the people who had their details exposed were the heads of major financial companies. These are the people who choose to share our details with companies like Equifax and perhaps if they have their own personal details exposed they may be a lot more careful with whom they share our data in the future.
I don't know why they don't just admit that *everyone's* information is compromised and just be done with it.
And then all credit bureaus should be forcibly shut down their databases burned. They are completely unneccessary and it's not even clear they provide a benefit to the lenders that use (and pay) them.
If it works in theory, try something else in practice.
He usually has some wise words.
---- The above post was generated by the Turing Institute. Maybe.
We are the product. Full stop.
They don't give a shit about us.
Only 700k? There's like 65 million Brits. Come one Equifax, you can do better than that.
Perhaps it would be simpler to just start a list of everyone not affected by this data breach? It might sound like it would still be a long list, but after another year of revelations I think it will top out to a few dozen, maybe 50, people at most.
Equifax: The gift that keeps giving!
I certainly hope there's going to be some repercussions. Government legislated minimum security standards and regular audits for companies perhaps? Class action from those affected?
Have the responsible ex-officers of EFAX been vigilanteed by aggrieved debtors & kneecaped ... yet ?
Day 1 -
Reporter: You are hacked, dude
Equifax: Hacked? Us? You're Joking
Day 2 -
Equifax: Alright we got hacked. 1/3rd of our gazillion userbase accounts got hacked.
Day 3 -
Equifax: Alright we were wrong. Half our gazillion userbase accounts got hacked.
Day 4-
[Company XYZ screws up big time that makes it to the front page of NYT (fake news)]
Equifax: Alright *cough* all *cough* our gazillion accounts were hacked on Day 1.
I think that the single best piece of advice to give anyone who has a record held by Equifax is to assume that every single shred of information the company held on you has been compromised.
The UK's data regulator, the Information Commissioner's Office, must immediately demand that Equifax provide them with proof that every single UK citizen on whom Equifax has held data has been contacted and has acknowledged that contact.
Why so extreme? Because if one thing is apparent from this appalling incident it is that Equifax simply don't know what they are doing when it comes to safeguarding the data of their users. It is borderline offensive that a company can go public with a statement to admit that they have just detected a hack which took place months previously, only to then turn round within a matter of days and claim to know exactly what was accessed, what was stolen.
The bottom line is that if an attacker was good enough to get into their systems and wander around for days, weeks or months without being detected, then it stands to reason that they were also good enough to make sure that logs of their activities were disabled and/or wiped. The mere fact that Equifax were hacked in the first place should tell us everything that we need to know about placing reliance on their IT Security or IT Forensic skills. [ And no, hiring in an outside specialist consultancy to help may not be good enough. When the data is gone, it's gone - a good attacker will have left few traces].
There is another major problem with the Equifax approach. Publicly, they claim that "several hundred thousand" UK citizens may have been hit by their breach. Given the size of this number, it means that any individual contacted by Equifax will have to assume that "they are one of the unlucky ones". But this leaves us with two problems. Firstly, how do we know that Equifax aren't lying now and just contacting everyone? Are they making deliberately misleading statements to try and placate their regulators? Secondly - and potentially much more significantly - how do you know if you are an "Equifax customer" in the first place? They don't mean customer, do they? They mean data subject: i.e., victim. If you have a credit card or applied for a loan or purchased a car or an expensive product on any form of hire purchase or store credit agreement, then you are potentially an Equifax customer. But when you bought your three-piece suite or that new car, did the store or dealership explicitly tell you that their credit-checking services were provided by Equifax? I doubt it.
I think the British people need to be demanding that Equifax are:-
1. Given a *massive* fine by the Information Commissioner's Office.
2. Made to pay compensation to every UK citizen held in their records.
3. Forced to provide lifelong free credit protection services, including alerting them when people run credit checks against them or attempt to access their records.
3. Forced to disclose, completely, in 100% detail, every last scrap of data held by Equifax against every UK citizen. If necessary, to offer to explain to the person what has been taken and how it could be used, to educate their victims and help them defend against identity theft and fraud.
4. Have their license for operating in the UK revoked, immediately, and be prevented from operating in the UK or taking or collecting data from UK subjects.
Only something as clear and powerful as this will send a message to companies like Equifax that they are putting people at tremendous risk. These companies see themselves as untouchable, see their business model as all up-sides. They get their data for free as part of 2-way deals, and then sell it on for a profit.
These people are parasites.
From Equifax' website:
Equifax is ISO/IEC 27001:2013 certified by a reputable independent third party.
It is difficult to imagine now that ISO/IEC 27001 (information security management) means anything.
Who is this "reputable independent third party"?
If you have ever participated in the 20th or 21st Century banking or credit system, Equifax has given away your personally identifiable information.
Welcome to the Panopticon. Used to be a prison, now it's your home.
I read the headline
Equifax Increases Number of Britons Affected By Data Breach To 700,000
to mean not enough Britons were affected by the data breach, so Equifax leaked more to bring the total up to a more respectable 700,000.