5 ms·

Oddly, on their website equifax.com , they offer a solution to see if your identity is stolen by using a website created today called equifaxsecurity2017.com ,

by andirk 9y ago

Oddly, on their website equifax.com , they offer a solution to see if your identity is stolen by using a website created today called equifaxsecurity2017.com , which then offers the solution to 'enroll' which sends you to a website created a week ago called trustedidpremier.com . At which point you are to enter your identity information. Um.

Thriptic 9y ago
Unverified cert too -_-
- rocqua 9y ago
  The plain domain yields a 404. Cert for me seems to be signed by amazon. https://trustedidpremier.com/ https://trustedidpremier.com/
  - Thriptic 9y ago
    What I mean to say is it's not validated* They should have hosted this on a domain associated with the company and validated the cert with the business
jack8daniels2 9y ago
And trustedidpremier.com was registered a week ago. https://whois.domaintools.com/trustedidpremier.com https://whois.domaintools.com/trustedidpremier.com
- bodz 9y ago
  TrustedID is an identity protection company that's been around for awhile (many companies use them as the contracted company to do credit monitoring after a breach). TrustedID is actually owned by Equifax (who were just hacked.. irony), and so my guess is that "TrustedID Premiere" is a newly created offering from Equifax/TrustedID to deal specifically with this major breach.
- ibejoeb 9y ago
  Well, yes, this was in response to this incident. While they're just making a public statement now, we know from their own press release that the breach occurred in May. Regardless, it's certainly prudent to be wary of these sites since they're pretty indistinguishable from phishing sites.
  - dx034 9y ago
    According to them it occured through July. That means it probably took them a month to figure out exactly what happened and how to disclose it.
3JPLW 9y ago
Why must the consumer enroll in this? Why is it not automatic? They already pull all the strings with regard to keeping the consumer from taking out and keeping track of legitimate loans. Why must we go out of our way to prevent them from certifying and tracking illegitimate ones?
- ztjio 9y ago
  Most likely because Equifax is not providing the service and the actual provider will need to engage with each customer directly, despite the service being free.
mattbeckman 9y ago
I also noted that it asked for the last 6 digits of your social. Could be they need more digits to avoid duplicates, but I've never heard anyone ask for 6 digits. Usually it's just the 4. Honestly, they should have used a subdomain off of Equifax.com.
- Johnny555 9y ago
  The bad thing about that is the first 3 digits are the location digits, so someone that has the last 6 digits can easily guess your full SSN if they know where you were born (or where you lived when you got your SSN). https://en.wikipedia.org/wiki/List_of_Social_Security_Area_Numbers https://en.wikipedia.org/wiki/List_of_Social_Security_Area_N...
  - uiri 9y ago
    This only works for social security numbers issued before June 25 2011. See https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html Of course, this is cold comfort for adults today whose SSNs were issued around the time of their birth.
    - Keeeeeeeks 9y ago
      So, everyone above the age of 16 that wasn't a naturalized citizen/resident? I feel like most of them would have credit scores.
digikata 9y ago
I've now been enrolled in one or more "identity monitoring" services going back at least five years offered in recompense for various breaches.... at some point it becomes ridiculous.
- ztjio 9y ago
  Same. Starting with the PlayStation hack a few years ago. If it makes you feel any better, I get notified by that service every time I do anything that accesses my credit at all, usually within minutes, so, I guess it works as designed.
toufka 9y ago
And not only do I have to give them personal information to check, I have to use google's sign-reading I'm-not-a-robot captcha - feeding a little of my intellectual capability to their self-driving car companies. They keep taking...
guelo 9y ago
By enrolling in the free "Identity Theft Protection" you waive your right to "PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR OTHER REPRESENTATIVE ACTION" https://trustedidpremier.com/static/terms https://trustedidpremier.com/static/terms It is a scam to get people to sign away their rights to sue the bastards.
- dalanmiller 9y ago
  Shit. I already submitted and should've read the fine print. I need to un-enroll.
  - Multicomp 9y ago
    If you look at the site ToS you can send an opt out to arbitration by mail to them within 30 days, at least for the Equifax general ToS
- hysan 9y ago
  Can anyone with a legal background or have connections to news outlets validate this? I read through the terms and this really does seem to be the case. However, I am certainly not in a position to decide this. It would alleviate my concerns if a trusted source could publicly report on how the impacted (pretty much everyone in the US) should respond to leak.
- ghughes 9y ago
  IANAL, but I'm not sure that you are correct. The agreement refers to claims "arising from or relating to the subject matter of this Agreement or the Products", and the title of the agreement is "TrustedID Premier Terms of Use". Doesn't that mean you're waiving your right to sue TrustedID, Inc. in a class action for grievances related to the TrustedID monitoring product, not your right to sue Equifax for the data breach?
- rdiddly 9y ago
  Aha, that explains why the site works so hard to gather your info and then suddenly loses interest in doing anything much else! Shit I hope I don't miss out on like $3.37 of class-action BOUNTY!

by andirk 9y ago

Thriptic 9y ago

Unverified cert too -_-

rocqua 9y ago
The plain domain yields a 404. Cert for me seems to be signed by amazon. https://trustedidpremier.com/ https://trustedidpremier.com/
- Thriptic 9y ago
  What I mean to say is it's not validated* They should have hosted this on a domain associated with the company and validated the cert with the business

jack8daniels2 9y ago

And trustedidpremier.com was registered a week ago. https://whois.domaintools.com/trustedidpremier.com https://whois.domaintools.com/trustedidpremier.com

bodz 9y ago
TrustedID is an identity protection company that's been around for awhile (many companies use them as the contracted company to do credit monitoring after a breach). TrustedID is actually owned by Equifax (who were just hacked.. irony), and so my guess is that "TrustedID Premiere" is a newly created offering from Equifax/TrustedID to deal specifically with this major breach.
ibejoeb 9y ago
Well, yes, this was in response to this incident. While they're just making a public statement now, we know from their own press release that the breach occurred in May. Regardless, it's certainly prudent to be wary of these sites since they're pretty indistinguishable from phishing sites.
- dx034 9y ago
  According to them it occured through July. That means it probably took them a month to figure out exactly what happened and how to disclose it.

3JPLW 9y ago

Why must the consumer enroll in this? Why is it not automatic? They already pull all the strings with regard to keeping the consumer from taking out and keeping track of legitimate loans. Why must we go out of our way to prevent them from certifying and tracking illegitimate ones?

ztjio 9y ago
Most likely because Equifax is not providing the service and the actual provider will need to engage with each customer directly, despite the service being free.

mattbeckman 9y ago

I also noted that it asked for the last 6 digits of your social. Could be they need more digits to avoid duplicates, but I've never heard anyone ask for 6 digits. Usually it's just the 4. Honestly, they should have used a subdomain off of Equifax.com.

Johnny555 9y ago
The bad thing about that is the first 3 digits are the location digits, so someone that has the last 6 digits can easily guess your full SSN if they know where you were born (or where you lived when you got your SSN). https://en.wikipedia.org/wiki/List_of_Social_Security_Area_Numbers https://en.wikipedia.org/wiki/List_of_Social_Security_Area_N...
- uiri 9y ago
  This only works for social security numbers issued before June 25 2011. See https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html Of course, this is cold comfort for adults today whose SSNs were issued around the time of their birth.
  - Keeeeeeeks 9y ago
    So, everyone above the age of 16 that wasn't a naturalized citizen/resident? I feel like most of them would have credit scores.

digikata 9y ago

I've now been enrolled in one or more "identity monitoring" services going back at least five years offered in recompense for various breaches.... at some point it becomes ridiculous.

ztjio 9y ago
Same. Starting with the PlayStation hack a few years ago. If it makes you feel any better, I get notified by that service every time I do anything that accesses my credit at all, usually within minutes, so, I guess it works as designed.

toufka 9y ago

And not only do I have to give them personal information to check, I have to use google's sign-reading I'm-not-a-robot captcha - feeding a little of my intellectual capability to their self-driving car companies. They keep taking...

guelo 9y ago

By enrolling in the free "Identity Theft Protection" you waive your right to "PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR OTHER REPRESENTATIVE ACTION" https://trustedidpremier.com/static/terms https://trustedidpremier.com/static/terms It is a scam to get people to sign away their rights to sue the bastards.

dalanmiller 9y ago
Shit. I already submitted and should've read the fine print. I need to un-enroll.
- Multicomp 9y ago
  If you look at the site ToS you can send an opt out to arbitration by mail to them within 30 days, at least for the Equifax general ToS
hysan 9y ago
Can anyone with a legal background or have connections to news outlets validate this? I read through the terms and this really does seem to be the case. However, I am certainly not in a position to decide this. It would alleviate my concerns if a trusted source could publicly report on how the impacted (pretty much everyone in the US) should respond to leak.
ghughes 9y ago
IANAL, but I'm not sure that you are correct. The agreement refers to claims "arising from or relating to the subject matter of this Agreement or the Products", and the title of the agreement is "TrustedID Premier Terms of Use". Doesn't that mean you're waiving your right to sue TrustedID, Inc. in a class action for grievances related to the TrustedID monitoring product, not your right to sue Equifax for the data breach?
rdiddly 9y ago
Aha, that explains why the site works so hard to gather your info and then suddenly loses interest in doing anything much else! Shit I hope I don't miss out on like $3.37 of class-action BOUNTY!