The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.

Huge Hack of Equifax exposes ~140 million US customers' info

2456722

Posts

  • TetraNitroCubaneTetraNitroCubane Not Angry... Just VERY Disappointed...Registered User regular
    edited September 2017
    I'm all for credit-freezes and credit monitoring and such, but isn't that a rather meager solution to this issue?

    I mean, beyond opening new lines of credit, with the information obtained in this breach, someone could easily just call up anyone's bank and take control of their existing account without much fuss.

    SSNs can't exactly be reissued, and now for 44% of the US population, their SSN is compromised.

    TetraNitroCubane on
  • ArbitraryDescriptorArbitraryDescriptor Registered User regular
    edited September 2017
    jothki wrote: »
    I assume that credit cards are set up in such a way that you're only contractually liable for payments actually given to you, with any transactions between the bank and a third party having nothing whatsoever to do with your contract with the bank other than creating bookkeeping errors on their end.

    I once spoke, unprofessionally, with a lawyer fighting with a CC company who was somehow trying to make his client pay for XYZ charges. It seemed to have just come down to their being unable to prove the client actually purchased them. (Got their card cloned on vacation, apparently)

    I'm curious if the ubiquity of identifty theft will slowly place in the minds of jurors and judges, the idea that a signed form containing all your personal information is no longer any sort of proof of identity or consent; even without a more secure alternative. And if the case law underpinning the fraudulent CC scenario might then begin to creep into the wider world of finance.

    ArbitraryDescriptor on
  • ArbitraryDescriptorArbitraryDescriptor Registered User regular
    edited September 2017
    SSNs can't exactly be reissued

    Why not though? It's just a plaintext number in a database. Maintain the individual's history so relevant parties can review your lifetime stats, but the guy who stole yesterday's code isn't going to get anywhere with it. Request a new SSN, present people who use your SSN with Form 72B, Change of SSN, enjoy your new SSN.

    ArbitraryDescriptor on
  • TetraNitroCubaneTetraNitroCubane Not Angry... Just VERY Disappointed...Registered User regular
    You can get a new SSN, but it will be linked to the old SSN, and the old SSN won't be retired.
    When we assign a different Social Security number, we do not destroy the original number. We cross-refer the new number with the original number to make sure the person receives credit for all earnings under both numbers.

    So the old SSN will still be active, making reissuing pointless for security purposes.

  • AthenorAthenor Battle Hardened Optimist The Skies of HiigaraRegistered User regular
    SSNs can't exactly be reissued

    Why not though? It's just a plaintext number in a database. Maintain the individual's history so relevant parties can review your lifetime stats, but the guy who stole yesterday's code isn't going to get anywhere with it. Request a new SSN, present people who use your SSN with Form 72B, Change of SSN, enjoy your new SSN.

    Too many people and places have treated it as a unique number over the years. It is the closest thing we have to a universal system identification number. Reissuing does happen, as do errors and the like. But until people find another way to uniquely identify someone, we are kind of stuck.

    He/Him | "We who believe in freedom cannot rest." - Dr. Johnetta Cole, 7/22/2024
  • ArbitraryDescriptorArbitraryDescriptor Registered User regular
    You can get a new SSN, but it will be linked to the old SSN, and the old SSN won't be retired.
    When we assign a different Social Security number, we do not destroy the original number. We cross-refer the new number with the original number to make sure the person receives credit for all earnings under both numbers.

    So the old SSN will still be active, making reissuing pointless for security purposes.

    That is literally for Social Security though. Businesses aren't required to accept anything but the latest. That they use them to identify us at all is probably entirely up to them.

  • AiouaAioua Ora Occidens Ora OptimaRegistered User regular
    honestly a SSN being a unique ID isn't that terrible

    it's that for decades people have used it as both ID and password which is uh

    no that's not how that works

    but here we are

    life's a game that you're bound to lose / like using a hammer to pound in screws
    fuck up once and you break your thumb / if you're happy at all then you're god damn dumb
    that's right we're on a fucked up cruise / God is dead but at least we have booze
    bad things happen, no one knows why / the sun burns out and everyone dies
  • TomantaTomanta Registered User regular
    It's hard enough fixing problems if someone has your SSN wrong, I'd hate to think how much of a hassle it would be to change it.

    I wonder if it would be possible to do a unique ID number tied to some forn of two factor authentication whenever it was used. Certainly not possible for 100% of the population right now, but thinking about it would be a good exercise.

  • ArbitraryDescriptorArbitraryDescriptor Registered User regular
    Aioua wrote: »
    honestly a SSN being a unique ID isn't that terrible

    it's that for decades people have used it as both ID and password which is uh

    no that's not how that works

    but here we are

    That's potentially brilliant? SSA gives you an ID. Just issue a damned Social Security Password and there you go.

    By which I mean, then expand their IT infrastructure to function as a global authentication server. So, some hurdles there, but mostly just $$$ and elbow grease.

  • bowenbowen Sup? Registered User regular
    It's almost going to be a requirement because of this latest breach though.

    not a doctor, not a lawyer, examples I use may not be fully researched so don't take out of context plz, don't @ me
  • GONG-00GONG-00 Registered User regular
    The US has trouble enough adopting EMV chip cards (irregardless of their effectiveness at stopping fraud). The wait for businesses and the government to agree on and adopt some form of two factor authentication to prove one's identity will be a long one.

    “Those who cannot remember the past are condemned to repeat it.”
    Law and Order ≠ Justice
    xu257gunns6e.png
  • SleepSleep Registered User regular
    I have the best defence against credit fraud... my credit is garbage

  • ShadowfireShadowfire Vermont, in the middle of nowhereRegistered User regular
    Aioua wrote: »
    honestly a SSN being a unique ID isn't that terrible

    it's that for decades people have used it as both ID and password which is uh

    no that's not how that works

    but here we are

    That's potentially brilliant? SSA gives you an ID. Just issue a damned Social Security Password and there you go.

    By which I mean, then expand their IT infrastructure to function as a global authentication server. So, some hurdles there, but mostly just $$$ and elbow grease.

    So not happening.

  • tbloxhamtbloxham Registered User regular
    GONG-00 wrote: »
    The US has trouble enough adopting EMV chip cards (irregardless of their effectiveness at stopping fraud). The wait for businesses and the government to agree on and adopt some form of two factor authentication to prove one's identity will be a long one.

    You don't need it. Just make the banks liable for the crime and they will figure it out by the end of the month.

    "That is cool" - Abraham Lincoln
  • SmokeStacksSmokeStacks Registered User regular
    Sleep wrote: »
    I have the best defence against credit fraud... my credit is garbage

    This just means that when someone takes out a loan with your identity through one of those "we operate from an Indian reservation so we're not subject to federal laws" lenders it'll have an interest rate in the stratosphere.

    I wonder if this will lead to an upturn in people who take out skeevy loans or purchase items on credit, then claim it was identity fraud since their information is now out in the wild.

  • chrisnlchrisnl Registered User regular
    Man I know I'm probably impacted by this hack, but there is no way I am giving my last name and last six digits of my SSN to a website. That is just not happening. I guess I'll just assume I've been impacted and try to keep an eye on things.

    steam_sig.png
  • AthenorAthenor Battle Hardened Optimist The Skies of HiigaraRegistered User regular
    You are more likely to see a national gun owner's database (utilizing Firearm Owners ID) before you see a national system identification number. The FOID could be used to confiscate your weapons. The government issued SIN will allow the government to track your every move.

    ... After all, big corps already have Global Unique Identifiers (GUID) for you - likely multiple cross-indexed. Now think of the outrage of giving the government that ability.

    He/Him | "We who believe in freedom cannot rest." - Dr. Johnetta Cole, 7/22/2024
  • CalicaCalica Registered User regular
    jothki wrote: »
    I assume that credit cards are set up in such a way that you're only contractually liable for payments actually given to you, with any transactions between the bank and a third party having nothing whatsoever to do with your contract with the bank other than creating bookkeeping errors on their end.

    I once spoke, unprofessionally, with a lawyer fighting with a CC company who was somehow trying to make his client pay for XYZ charges. It seemed to have just come down to their being unable to prove the client actually purchased them. (Got their card cloned on vacation, apparently)

    I'm curious if the ubiquity of identifty theft will slowly place in the minds of jurors and judges, the idea that a signed form containing all your personal information is no longer any sort of proof of identity or consent; even without a more secure alternative. And if the case law underpinning the fraudulent CC scenario might then begin to creep into the wider world of finance.

    My bank refunded some $2500 in fraudulent charges to me this summer. They weren't happy about it, but they did it without dragging their feet or anything. Just from that I assumed banks were already liable. Or is it different when your credit card isn't issued through your bank?

    The irony is that most of the fraud happened while I was on vacation in France. I'd told my bank I'd be out of the country so my card wouldn't get flagged overseas, and all the bogus charges were stateside. You'd think that would work both ways.

    Anyway, a credit freeze is looking like a really attractive option right now.

  • GvzbgulGvzbgul Registered User regular
    edited September 2017
    That TrustedID site is owned by Equifax and there's some stuff in the ToU about waiving your right to be a part of a class action lawsuit if you use it.

    https://techcrunch.com/2017/09/07/equifax-data-breach-help-site-leaves-consumers-with-more-questions-than-answers/
    The company established a website to allow consumers to see if their data was stolen. But it’s broken and sets the user up for TrustedID, a credit monitoring service owned by, wait for it, Equifax.

    Equifax says that this site will “indicate whether your personal information may have been impacted by this incident.” That is false as of this post’s publication. The company also says it will provide the checker with an “option” to enroll in TrustedID Premier. That’s also false. When a user inputs their data into the system, a message appears that the user can be enrolled in TrustedID Premier at a later date. Mine was 9/11/2017.

    This is completely irresponsible by Equifax.

    The site’s terms of service seem to state that by agreeing to use this service, the user is waving their rights to bring a class action lawsuit against Equifax.

    The actual ToS if you want to look over them: https://trustedidpremier.com/static/terms

    Gvzbgul on
  • LabelLabel Registered User regular
    chrisnl wrote: »
    Man I know I'm probably impacted by this hack, but there is no way I am giving my last name and last six digits of my SSN to a website. That is just not happening. I guess I'll just assume I've been impacted and try to keep an eye on things.

    The NPR article about this has a phone number at the bottom.
    http://www.npr.org/sections/thetwo-way/2017/09/07/549296359/hackers-accessed-the-personal-data-of-143-million-people-equifax-says
    Equifax, for its part, says it has been in touch with law enforcement and that it has set up a website for consumers to determine whether they have been affected by the breach announced Thursday. It has also set up a call center at 866-447-7559 for the same purpose.

    Personally, I'm thinking more information might come out over time, so I'm not rushing in on this myself.

  • This content has been removed.

  • ShadowhopeShadowhope Baa. Registered User regular

    Ars Technica analysis of the breach.
    Besides the severity and scope of the pilfered data, the Equifax breach also stands out for the way the company has handled the breach once it was discovered. For one thing, it took the Atlanta-based company more than five weeks to disclose the data loss. Even worse, according to Bloomberg News, three Equifax executives were permitted to sell more than $1.8 million worth of stock in the days following the July 29 discovery of the breach. While Equifax officials told the news service the employees hadn't been informed of the breach at the time of the sale, the transaction at a minimum gives the wrong appearance and suggests incident responders didn't move fast enough to contain damage in the days after a potentially catastrophic hack came into focus.

    What's more, the website www.equifaxsecurity2017.com/, which Equifax created to notify people of the breach, is highly problematic for a variety of reasons. It runs on a stock installation WordPress, a content management system that doesn't provide the enterprise-grade security required for a site that asks people to provide their last name and all but three digits of their Social Security number. The TLS certificate doesn't perform proper revocation checks. Worse still, the domain name isn't registered to Equifax and its format looks like precisely the kind of thing a criminal operation might use to steal people's details. It's no surprise that Cisco-owned Open DNS was blocking access to the site and warning it was a suspected phishing threat.

    Meanwhile, in the hours immediately following the breach disclosure, the main Equifax website was displaying debug codes, which for security reasons, is something that should never happen on any production server, especially one that is a server or two away from so much sensitive data. A mistake this serious does little to instill confidence company engineers have hardened the site against future devastating attacks.

    It was bad enough that Equifax operated a website that criminals could exploit to leak so much sensitive data. That, combined with the sheer volume and sensitivity of the data spilled, was enough to make this among the worst data breaches ever. The haphazard response all but guarantees it.

    Civics is not a consumer product that you can ignore because you don’t like the options presented.
  • AthenorAthenor Battle Hardened Optimist The Skies of HiigaraRegistered User regular
    So... case study in the making, then.

    Jesus.

    He/Him | "We who believe in freedom cannot rest." - Dr. Johnetta Cole, 7/22/2024
  • Captain InertiaCaptain Inertia Central OhioRegistered User regular
    For what it's worth, my firm (one of their largest customers) is hammering them about how shoddy that site is working on forcing them to beef up the security and establish a protocol for immediately identifying and shutting down spoof sites.

    l7ygmd1dd4p1.jpeg
    3b2y43dozpk3.jpeg
  • PolaritiePolaritie Sleepy Registered User regular
    So lets see... 44% of the population completely exposed. Minus minors... why would I bother checking? The odds are easily over 50% my information was in the breached set.

    And good job giving crooks three months to use it without telling me!

    Steam: Polaritie
    3DS: 0473-8507-2652
    Switch: SW-5185-4991-5118
    PSN: AbEntropy
  • AthenorAthenor Battle Hardened Optimist The Skies of HiigaraRegistered User regular
    For what it's worth, my firm (one of their largest customers) is hammering them about how shoddy that site is working on forcing them to beef up the security and establish a protocol for immediately identifying and shutting down spoof sites.

    What really gets my goat with this crap is how heavily we have to enforce PCI, navigating a labyrinth of regulations that are half security theater and half actual good measures, to the point where the credit card companies can just say "nope, you missed this, you can no longer get money from any of your customers!" and we are constantly scrambling to interpret and update our systems.

    ... and then one of the companies I'd assume is part of defining the PCI regs pulls this shit.

    He/Him | "We who believe in freedom cannot rest." - Dr. Johnetta Cole, 7/22/2024
  • Captain InertiaCaptain Inertia Central OhioRegistered User regular
    Athenor wrote: »
    So... case study in the making, then.

    Jesus.

    Yes, the vast majority of their colleagues, including their accounts management team, found about it the same time/way we all did. They are sending these people out on conference calls with huge, angry banks with no more knowledge than what's contained in this thread.

    l7ygmd1dd4p1.jpeg
    3b2y43dozpk3.jpeg
  • MadicanMadican No face Registered User regular
    Gork wrote: »
    Thank god I work for the federal government and already had all my shit stolen from OPM. They got us an identity protection service as compensation.

    Hah. That was a couple years ago wasn't it? Only state here but was part of the same breach so I've had the protection ever since. Useful at times, but not exactly heartening to see how bad security is for our personal info.

    Equifax needs to be made accountable for this breach. An example made that if you hold people's information, who sure as hell didn't choose to give it to them, then if they can't protect it they get the hammer.

  • daveNYCdaveNYC Why universe hate Waspinator? Registered User regular
    WordPress?
    Polaritie wrote: »
    So lets see... 44% of the population completely exposed. Minus minors... why would I bother checking? The odds are easily over 50% my information was in the breached set.

    And good job giving crooks three months to use it without telling me!

    44% exposed, but the percentage impacted is going to be a good chunk higher once you figure in families and couples.

    Shut up, Mr. Burton! You were not brought upon this world to get it!
  • SniperGuySniperGuy SniperGuyGaming Registered User regular
    Gvzbgul wrote: »
    That TrustedID site is owned by Equifax and there's some stuff in the ToU about waiving your right to be a part of a class action lawsuit if you use it.

    https://techcrunch.com/2017/09/07/equifax-data-breach-help-site-leaves-consumers-with-more-questions-than-answers/
    The company established a website to allow consumers to see if their data was stolen. But it’s broken and sets the user up for TrustedID, a credit monitoring service owned by, wait for it, Equifax.

    Equifax says that this site will “indicate whether your personal information may have been impacted by this incident.” That is false as of this post’s publication. The company also says it will provide the checker with an “option” to enroll in TrustedID Premier. That’s also false. When a user inputs their data into the system, a message appears that the user can be enrolled in TrustedID Premier at a later date. Mine was 9/11/2017.

    This is completely irresponsible by Equifax.

    The site’s terms of service seem to state that by agreeing to use this service, the user is waving their rights to bring a class action lawsuit against Equifax.

    The actual ToS if you want to look over them: https://trustedidpremier.com/static/terms

    This is especially frustrating because when I heard about it, I double checked to make sure their sketchy looking site was legit and wanted to know if I was included in the leak. Of course, I neglected to read the fine print and putting your name in doesn't actually tell you if you're compromised, it signs you up for the thing and then says to check back in a few days to see if you were part of the leak. I thought I was checking my status, not signing up for something, but signing up is a requirement to check your status apparently.

  • VishNubVishNub Registered User regular
    So, I clicked on that "Are you effected?" in the OP when this was posted yesterday and immediate red flagged the entire thing. Seems like it's probably legit, but also very sketchy. So I'm probably not doing that any time soon.

    Is there anything else I should do? I have monthly credit scores via B of A.

  • SleepSleep Registered User regular
    Fuckin word press?!

  • BronzeKoopaBronzeKoopa Registered User regular
    Aw hell I saw news of this late last night and put in my info to that website before realizing it's a bad idea. It did say I wasn't affected but wanted me to continue registering for the TrustedID thing so I just closed the tab.

  • AthenorAthenor Battle Hardened Optimist The Skies of HiigaraRegistered User regular
    The more I think about this, the more incredulous I get. I mean.. okay. You know you have to roll out some powerful servers to have ALL OF THE US hitting your site at once. Probably means some AWS/Google hosting shit for capacity. And naturally you don't want to leak the domain name early, lest you tip off people before you are ready to report. But.. wouldn't you, like, use the information and time you have to set up a dedicated response team and test things?

    He/Him | "We who believe in freedom cannot rest." - Dr. Johnetta Cole, 7/22/2024
  • FencingsaxFencingsax It is difficult to get a man to understand, when his salary depends upon his not understanding GNU Terry PratchettRegistered User regular
    Athenor wrote: »
    So... case study in the making, then.

    Jesus.

    Yes, the vast majority of their colleagues, including their accounts management team, found about it the same time/way we all did. They are sending these people out on conference calls with huge, angry banks with no more knowledge than what's contained in this thread.

    Wait, what the fuck?

  • rhylithrhylith Death Rabbits HoustonRegistered User regular
    SniperGuy wrote: »
    Gvzbgul wrote: »
    That TrustedID site is owned by Equifax and there's some stuff in the ToU about waiving your right to be a part of a class action lawsuit if you use it.

    https://techcrunch.com/2017/09/07/equifax-data-breach-help-site-leaves-consumers-with-more-questions-than-answers/
    The company established a website to allow consumers to see if their data was stolen. But it’s broken and sets the user up for TrustedID, a credit monitoring service owned by, wait for it, Equifax.

    Equifax says that this site will “indicate whether your personal information may have been impacted by this incident.” That is false as of this post’s publication. The company also says it will provide the checker with an “option” to enroll in TrustedID Premier. That’s also false. When a user inputs their data into the system, a message appears that the user can be enrolled in TrustedID Premier at a later date. Mine was 9/11/2017.

    This is completely irresponsible by Equifax.

    The site’s terms of service seem to state that by agreeing to use this service, the user is waving their rights to bring a class action lawsuit against Equifax.

    The actual ToS if you want to look over them: https://trustedidpremier.com/static/terms

    This is especially frustrating because when I heard about it, I double checked to make sure their sketchy looking site was legit and wanted to know if I was included in the leak. Of course, I neglected to read the fine print and putting your name in doesn't actually tell you if you're compromised, it signs you up for the thing and then says to check back in a few days to see if you were part of the leak. I thought I was checking my status, not signing up for something, but signing up is a requirement to check your status apparently.

    I'm not a lawyer, but that arbitration clause says for "products purchased" so I think it should only apply if you actually complete enrollment in the credit protection service after seeing if you're impacted. From their instructions, simply checking to see if you're impacted is not actually enrolling in their service. From the site:
    Click on the below link, “Check Potential Impact,” and provide your last name and the last six digits of your Social Security number.
    Based on that information, you will receive a message indicating whether your personal information may have been impacted by this incident.
    Regardless of whether your information may have been impacted, we will provide you the option to enroll in TrustedID Premier. You will receive an enrollment date. You should return to this site and follow the “How do I enroll?” instructions below on or after that date to continue the enrollment and activation process. The enrollment period ends on Tuesday, November 21, 2017.

    I still wouldn't do it at this point knowing what we know now, and honestly it seems like we are stuck in binding arbitration with companies simply by knowing they exist these days, but you may still have a way to join the lawsuit.

  • ScooterScooter Registered User regular
    Even worse, according to Bloomberg News, three Equifax executives were permitted to sell more than $1.8 million worth of stock in the days following the July 29 discovery of the breach. While Equifax officials told the news service the employees hadn't been informed of the breach at the time of the sale, the transaction at a minimum gives the wrong appearance and suggests incident responders didn't move fast enough to contain damage in the days after a potentially catastrophic hack came into focus.

    I find this dubious. Maybe they were never "informed", but I find it very easy to believe someone could've quietly slipped word to the execs that something was about to go down.


    The most frustrating thing is it feels like security at this point and possibly the rest of my life is basically a pointless exercise. My information's been stolen so many times now, from places entirely outside of my control, that it feels like my personal efforts to protect my info has been a complete joke. I'm pretty sure the only thing protecting me from actual ID fraud at this point is that thieves may not ever manage to actually work their way through 140m identities.

  • TomantaTomanta Registered User regular
    Scooter wrote: »
    Even worse, according to Bloomberg News, three Equifax executives were permitted to sell more than $1.8 million worth of stock in the days following the July 29 discovery of the breach. While Equifax officials told the news service the employees hadn't been informed of the breach at the time of the sale, the transaction at a minimum gives the wrong appearance and suggests incident responders didn't move fast enough to contain damage in the days after a potentially catastrophic hack came into focus.

    I find this dubious. Maybe they were never "informed", but I find it very easy to believe someone could've quietly slipped word to the execs that something was about to go down.


    The most frustrating thing is it feels like security at this point and possibly the rest of my life is basically a pointless exercise. My information's been stolen so many times now, from places entirely outside of my control, that it feels like my personal efforts to protect my info has been a complete joke. I'm pretty sure the only thing protecting me from actual ID fraud at this point is that thieves may not ever manage to actually work their way through 140m identities.

    I'm pretty sure I've been getting a new credit card every year for the last few years now. I know for sure I have the last two, both around Christmas. I've had "lost password" and "strange login" notices from so many websites I've lost track of. It's practically impossible to keep up with all of it, so I just don't care. The main steps I've taken are not using my debit card if at all possible, and making sure my email password is never, ever used anywhere else (and two-factor authentication). Anything else is just dealing with things as they happen.

  • RhahRhah Registered User regular
    Tomanta wrote: »
    It's hard enough fixing problems if someone has your SSN wrong, I'd hate to think how much of a hassle it would be to change it.

    I wonder if it would be possible to do a unique ID number tied to some forn of two factor authentication whenever it was used. Certainly not possible for 100% of the population right now, but thinking about it would be a good exercise.

    This. I had someone fill out a form and I assume accidentally mistyped their SSN and it became mine. Then it became my burden to prove who I was. I mean WTF. Some other idiot's mistake caused me to waste time. That might be the easiest cyber-terrorism some cretin could do. So easy its probably why those dopes haven't thought of it yet.

  • bowenbowen Sup? Registered User regular
    So do we know what kind of attack it was yet?

    My money is on SQL injection, or, maybe a really shitty cookie/javascript code that allowed them to change data around with absolutely 0 server side checking after the initial login.

    not a doctor, not a lawyer, examples I use may not be fully researched so don't take out of context plz, don't @ me
Sign In or Register to comment.