19 ms·
The Equifax breach may be the worst leak of personal info ever
- donatj 9y agoIs there no way to find out if I am affected without enrolling in their ID protection?
- mrrsm 9y agoThis link [0] tells you if they think you are affected (you probably are) and then asks if you want to sign up for protection which you don't have to do. [0] https://trustedidpremier.com/eligibility/eligibility.html https://trustedidpremier.com/eligibility/eligibility.html
- shanev 9y agoWarning: You waive your right to sue Equifax if you sign up for protection using this site.
- ceejayoz 9y agoMaybe. The TOS requires arbitration for disputes over the credit monitoring solution, but I don't read it as affecting suits over the breach itself. That said, IANAL.
- emodendroket 9y agoIt doesn't seem that way to me. > As used in this arbitration provision, the term "Claim" or "Claims" means any claim, dispute, or controversy between You and Us relating in any way to Your relationship with Equifax, including but not limited to any Claim arising from or relating to this Agreement, the Products or this Site, or any information You receive from Us, whether based on contract, statute, common law, regulation, ordinance, tort, or any other legal or equitable theory, regardless of what remedy is sought. This arbitration obligation extends to claims You may assert against Equifax’s parents, subsidiaries, affiliates, successors, assigns, employees, and agents. The term "Claim" shall have the broadest possible construction, except that it does not include any claim, dispute or controversy in which You contend that EIS violated the FCRA. Any claim, dispute, or controversy in which You contend that EIS violated the FCRA is not subject to this provision and shall not be resolved by arbitration.
- tanderson92 9y agoThat is not the right Terms and Conditions. See this: https://trustedidpremier.com/static/terms https://trustedidpremier.com/static/terms Note the retroactive nature of the terms. Open question: does this indemnify the parent company? (A CNN story says it may not, but is not definite: money.cnn.com/2017/09/08/technology/equifax-monitoring-services/index.html)
- emodendroket 9y agoWhoops. I stand corrected.
- ideonexus 9y agoThis is crucial. I am concerned that #4 of the Terms of Use for this site does state that you give up your right to sue Equifax or join a class action lawsuit: http://www.equifax.com/terms/ http://www.equifax.com/terms/ I clicked on the "Enroll" button before reading this (after giving my last name and six-digit social), and it told me to come back in a week to enroll. Now I'm wondering, did I just give up my rights?
- kevin_thibedeau 9y agoIf the hackers have any sense of humor they'll sign everyone up on their behalf.
- scrumper 9y agoWhere's it say that? I read carefully, not carefully enough perhaps, but I just went back and I see no such mention. My enrollment date isn't until mid Sept anyway so is this something that comes up later?
- mikestew 9y agoNo, you don't. Please point out where you think it says that. I mean, let's think this through. You're not the only one that can read a contract and figure out this "scam". You think a NYT reporter can't do the same? And are you assuming Equifax thinks no one will figure it out? Because catching them pulling a stunt like that would probably make the front page. Regardless, I may not be a lawyer, but the agreement doesn't say that.
- drfuchs 9y agoWhy should I trust trustedidpremier dot com? Their whois info is a PO box, which isn't encouraging. And asking for the last 6 digits of my SS# is super-suspicious [Added:] because the remaining (first 3) digits, called the "area number", are generally discoverable, because they are more or less determined by the zip code of where you were born (if you're older than 6).
- ceejayoz 9y agoEquifax.com links to EquifaxSecurity2017.com, which links to TrustedIDPremier.com, but yeah, it looks like a phishing scam. OpenDNS even flagged it as such this morning. Why they didn't go with a subdomain of Equifax.com is beyond me.
- athenot 9y agoThat in itself is indicative of how they really don't understand security.
- knightofmars 9y ago<tin-hat>How do I know you're not working with "mrrsm" to steal my info?</tin-hat>
- ceejayoz 9y agoYou can follow the chain from Equifax.com, at least. Phishers are going to have a field day with this, though.
- wlesieutre 9y agoIncompetence?
- banned1 9y agoI registered. I figured my data is already exposed, so this is not incremental. I got a date in mid September, so I will see what to do next then. I figure I am already exposed anyway, and the protection will be needed. Now, I wonder if it's best to DIY on the credit freeze thing. The only thing is that it appears that a freeze needs to be redone every few months.
- phjesusthatguy3 9y agoIs that something equifax set up in response to this breach? Like an idiot, I punched in my info and it said "yep, you're probably affected" but did I just give my information to equifax or some scammer who's going to use that to scam me?
- ceejayoz 9y agoIt's legit (you can follow the chain from the announcement on Equifax.com) but horrible practice. Should've been a subdomain - they're just training folks to fall for phishing scams this way.
- delinka 9y agoThat link didn't actually answer in the affirmative for me. It just dumped me into the enrollment workflow. It followed that with a message that my enrollment date would be next week and that I would receive no further reminders but I have to return on that day to complete enrollment. For my spouse, your link answered that they weren't affected.
- deleted 9y ago[deleted]
- pierrevanmart 9y agoStill nothing on Have I Been Pwned [0] yet, if the leak contains your email address, it should be updated soon. [0] https://haveibeenpwned.com/ https://haveibeenpwned.com/
- brandur 9y agoI don't think Have I been Pwned will be of much use unless Troy's able to get a dump of the leaked information from somewhere.
- chillydawg 9y agoIt'll pop up for sale at some point and then become more easily available. He'll get it eventually, he usually does.
- exhilaration 9y agoThe OPM data never showed up for sale. It depends on whether a state actor was behind it.
- astura 9y agoOf course not, that only contains public data breaches. Not only that but Equifax doesn't keep usernames and emails, it's names, addresses, credit cards, etc.
- duxup 9y agoOn Equifax's site you can check to see if you are "potentially" impacted without enrolling in their service.
- 0x00000000 9y agoI've been saying for a long time. Companies that store sensitive information should be required to insure it. Want my SSN for some inane reason? 5 million^H^H^H^H^H^H^H^H^H 500k dollar insurance policy on each one. Seem excessive? Better buckle down on security or better yet not store extremely sensitive and damaging information for arbitrary reasons. There is literally zero reason or consequences for any company to care about security right now.
- banned1 9y agoMaybe it's better to enact legislation to stop using the SSN the way it's used today.
- chrisabrams 9y agoI think you and OP both hit valid points that should happen, but never will under government. However, on the blockchain...well that might just happen, but it won't be a government running the identity system.
- pavel_lishin 9y agoWhat about on the cloud? Or on the world wide web? Or the information superhighway? Are those buzzwords too outdated?
- emodendroket 9y agoWow, sounds like a real paradigm shift.
- BoiledCabbage 9y agoYes and lets lose the ability to trace any and all criminal activity. Underground crime will love that - bring on the golden years!
- pavel_lishin 9y ago
- banned1 9y agoAnother commenter, who now deleted the comment, said: "There's a 44% chance you were affected, but a 100% chance you waive your right to be in a class action lawsuit if you enroll in their ID protection." I thought it was a good comment, but I wonder if it matters. How much would you get? I have been a member of these class action lawsuits before, and I get, like, $3 for my troubles at the end of the day, so I never claim the prize because it's another database where my SSN would be stored and stolen from. I think the best is to freeze your credit report and deal with the troubles of having to unfreeze it when you need a loan. If there are expert people from the Fin Svc industry here, is the above correct? Is freeze pretty much the only reasonable action now to protect ourselves?
- pavel_lishin 9y agoTo date, having been a participant in three - that I was notified of by email - I've netted about twenty bucks. But I'm also not sure what the benefit of enrolling in their ID protection scheme is, given that the whole reason they're offering it is because they already gave it out to some rando on the internet. It's rather like paying the schoolyard bully to stop taking your lunch money.
- tonyztan 9y agoI've received $20.43 from the Perkins v. LinkedIn class action settlement. Personally, it's not about the money, but rather about trying to hold companies accountable for their actions. (http://www.addconnectionssettlement.com/ http://www.addconnectionssettlement.com/)
- YCode 9y agoExactly. People complain about how the lawyers who managed the case (sometimes for years!) take most of the payout, but so long as the company's risk/reward math is tipped towards the safety of their customers I have no issue with not seeing much of the settlement.
- 9y ago
- swiley 9y agoEveryone knew these where more or less worthless to begin with, but the people doing things either have to use them or don't have anything better. I think at this point we should start authenticating anything that ends up on someone's credit report using strong cryptography. People who refuse to use it out of ignorance or disagreement don't have to, they just don't get background checks (which is kind of the way it works now.)
- deleted 9y ago[deleted]
- empath75 9y agoConsider the implications of this security breach if it's a state actor that did it. I'm going to throw out Russia as an example, but don't take that as me accusing them of doing it. Cross reference financial information on millions of americans with data breaches from yahoo and linked in, and the social graph data that's freely available from both and you have a serious national security problem. It would be easy to search for employees with serious financial problems at any institution you wanted to target with either blackmail or further intrusions.
- kangus 9y agoThis was my first initial thought. It will be interesting to find out who they think is responsible.
- emodendroket 9y agoHell, I'll take that over somebody opening up a bunch of credit in my name.
- eduren 9y agoConsider the consequences if it is the same/cooperating state actors behind the 2015 OPM breach. At that point there would be mountains of blackmail data.
- mythrwy 9y agoI'd guess you are right. Impacting the financial system is like cutting off oxygen to the military machine. And further domestic discontent is a side bonus.
- YCode 9y agoI'd like to think OPM employees are reading this headline and thinking "Yeah we'll see!" The entirety of federal government SF-86s being dumped to a foreign government has diplomatic and economic repercussions that will last for decades.
- KGIII 9y agoI got some credit monitoring and a form letter. My data was lost in the OPM hack. I came to post pretty much the same thing. Worst? For whom?
- goialoq 9y ago"Lost"? It was saved in globally distributed backup!
- KGIII 9y agoThat's a very positive outlook. Maybe it was just the governments way of initiating a distributed file sharing service? By strange coincidence, the missus was saying that she needed another drive to backup more photos. I told her she didn't need to, the NSA already has them archived. She did not see the humor.
- Balgair 9y agoTo clarify the OP's acronyms: OPM: Office of Personnel Management, where all the 'blackmail' files for cleared gov employees and contractors are stored, in addition to many other more mundane functions. https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... DoD: Department of Defense, but this also refers to contractors in places like Lockheed and other smaller contrating firms. SF-86: Standard Form #86, the form that must be completed to gain any kind of clearance with the gov. These clearance processes can run into the $20k+ range, though not usually, as they have to send agents out to talk to people to verify the applicant. https://en.wikipedia.org/wiki/Standard_Form_86 https://en.wikipedia.org/wiki/Standard_Form_86 https://news.clearancejobs.com/2017/05/31/serious-penalties-falsifying-sf-86/ https://news.clearancejobs.com/2017/05/31/serious-penalties-... The 2015 data breach of the OPM was a BIG deal in the security clearance world, as it seems all the blackmail files were stolen. The a large issue was that the OPM worked on an entirely separate internet that the gov built, as in they had totally different wires and cables and everything, very expensive. How this happened is yet to be released AFAIK. Also, many people were trusting the gov with their darkest secrets, so as to be un-blackmail-able by others. Now, the gov is not so trustworthy and this then throws a huge wrench into all of the processes, including retention of employees and recruitment of new ones.
- volkk 9y agoAs someone who has no time to deal with lawsuits or anything of that sort, what's the best course of action here? According to their website, it seems I'm affected?..
- emodendroket 9y agoThere is little you can do until someone has actually stolen your identity.
- knodi 9y agoThen its too late and you have a shit storm to deal with
- emodendroket 9y agoWell, yeah.
- frankydp 9y agoRequest a credit freeze on the three major reporting agencies. https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs#place https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...
- volkk 9y agoAre there any downsides to doing this? Aside from not being able to get credit when you need it ASAP
- luddit3 9y agoUsually costs money to freeze and unfreeze (might be free or reduced depending on state).
- dwyerm 9y agoMy experience was that any "Instant Qualification!!" fails instantly, and then you can't unlock it. After Equifax lost my data in the last (T-Mobile) breach, I locked all three providers. Each of the places charged me $10 for the privilege. I still claim that Equifax should have covered if not for all providers, at least themselves, instead of providing me with worthless credit monitoring. But that's a whole other rant. I was applying for a credit card. The bank then followed up with, "We killed this because we asked Equifax, and they said no. If you still want a card, you can apply a temporary unlock for us." The problem is, as is clear from all the other posts here, Equifax is terrible. You need to send your super-secret unlock pin via mail to somewhere and link it up with something and blah blah blah... It was more trouble than it was worth. I asked the bank if they would consider switching to another reporting agency because Equifax was demonstrably terrible, but they said that once they select an agency for a transaction, they're locked into it. So, I let that request die. I can try again some time, and there's a 1:3 chance that I'll get screwed all over again, and a 3:3 chance that I'll have to unlock something, and a 100% chance that I will get angry.
- mikeash 9y agoIf we're lucky, this will be the best leak of personal info ever. The primacy of the SSN in American society is idiotic. It's a "secret" that you have to hand out to dozens of different organizations. I've long thought that we should phase this out by committing to publish all SSNs (and the associated info, obviously, so it's not just a list of most 9-digit numbers...) which would force all these companies to stop treating it as confidential. The system is dumb and works poorly, but worked will enough that there was no impetus to fix it. Some people got affected by breaches, and it sucked for them, but it was always a small enough group that most people didn't care. Now that a majority of people's "secret" info is no longer confidential, maybe they'll realize they can't rely on it anymore. OK, the odds of this actually coming to pass are not great. But I can hope.
- emodendroket 9y agoYeah, I won't be holding my breath.
- charlesdm 9y agoHe's right though, even if not feasible to implement. A SSN is an ID number that needs to be kept secret. How dumb is that? How about using something like an ID card with attached chip that can be used to digitally sign things? Works great in Belgium.
- emodendroket 9y agoThere is no political will to do such a thing. Even the REAL ID stuff with licenses is pretty weak and taking an eternity to implement.
- LastMuel 9y agoHe's right though, with any luck, the SSNs of a slew of politicians will be included in the data leak and then we may just get the ball rolling on change. Hopefully, this is the one that gets us moving.
- chrisabrams 9y agoWhy are identifiers being treated as passwords? It's 2017 and my mind is boggled that we continue to use SSNs and thumbprints as passwords. These are more akin to usernames. Why is our most important information not protected by passwords, or better yet, 2 factor authentication? If I try to spend $1000 on my credit card at IKEA, my bank usually calls me to confirm the transaction. However, we don't have such a system when handling our most important information? Why is this allowed to happen? How many people have to be damaged before they stop watching Tom Brady throw touchdowns and get out there to make a difference?
- emodendroket 9y agoFixing it costs them more money than leaving it alone, is the reason.
- knz 9y ago> If I try to spend $1000 on my credit card at IKEA, my bank usually calls me to confirm the transaction. However, we don't have such a system when handling our most important information? Why is this allowed to happen? It's allowed to happen for the same reason the US uses credit cards without PIN numbers - a lack of desire to spend money on security/upgrades (it's easier to pass on the cost of fraud via the transaction fees), a weak regulatory structure for protecting consumers, a glacial rate of technology adoption in banking systems, and ignorance/unwillingness to evolve by customers/businesses/executives etc.
- skybrian 9y agoAt least we have cards with chips in them now, so there's some movement on this. Maybe gas stations will have them by 2020.
- gambiting 9y agoEven if they have newer terminals, they are still going to accept signature, so essentially there's zero security. The only way forward is to stop accepting the magnetic strip + signature altogether.
- diyseguy 9y agoThis sort of reminds me of when Wells Fargo called me one day to tell me my card was compromised. I got on the phone with them only to find out it wasn't. Then they tried to hard upsell me on a pay by the month identity protection plan with a 6 month complimentary introductory period. It seems like it's sort of in Equifax's interest for a breach to happen and have 144 million people freak out and then buy their $20/month service
- kevin_thibedeau 9y agoI hope you changed banks after witnessing their sleazeball tactics first hand.
- imnotlost 9y agoOnly the absolutely dumbest Americans are Wells Fargo customers at this point. Or, maybe, they can't read the news.
- lr4444lr 9y agoFor day to day financial services maybe. But for fixed APR mortgages? They are still very competitive, and if you are a member of certain groups, like veterans, even better.
- leroy_masochist 9y agoI just used their "check if you've been compromised" tool on their crisis response site and they are using it not only as a notification service for potentially affected customers, but also as a lead generation tool for their TrustedID Premier service. We need a new word, "chutzpah" isn't strong enough in this case.
- jandrese 9y agoI think the word you are looking for is gall. As in sheer unmitigated gall.
- codazoda 9y agoI previously signed up for someone's free Identity Theft Protection service. After the free service was completed my account was charged around $9 per month until I noticed it and fixed it.
- plandis 9y agoDavid Webb is the CTO. He should get a year in prison for every day he decided not to announce his massive fuck up.
- spydum 9y agopretty sure the responsibility of announcing that sort of thing goes to chief risk officer, or legal -- not usually technology. though clearly they failed in some way (security training, sdlc process, m&a due-diligence, or whatever)
- kakarot 9y agoI don't own any credit cards and I do not use credit. Am I still at risk for having credit taken out in my name if I don't enroll in this "credit freeze" protection racket people keep mentioning?
- fragsworth 9y agoYes. If someone fraudulently enrolls for credit in your name, the organization that issued the credit comes after you to pay it back.
- jsymolon 9y agoYes. The issuing banks don't care if you get a low interest card or 25% per annum. I lived at my current address for 20+ years and still a bank issued a credit card for someone 3 states away .... I have a credit monitoring (not through Equifax, Transunion or the other one; 3rd party) due to a identity breach through Blue Cross a few years ago. The credit monitoring alerted me that the bank issued a credit card 3 states away. That 3-way call between the monitoring agency, myself and the issuing bank was interesting.
- kakarot 9y agoThank you. Since I don't participate in the credit market, have no affiliation with any bank and do not affiliate with any credit reporting agency, I see absolutely no reason that I should have to pay into this protection racket to cover their asses. I don't even know how to do this credit freeze thing and have no interest in learning for the next foreseeable couple of years, until I have money worth investing in something. And what about all of those who are homeless, have no internet/phone access, live in the wilderness, etc? What's to stop them from re-entering society in 10 years only to discover they have a massive amount of debt? There must be some way for me to exclude myself from this market, from the woefully inadequate security practices of our financial system, without paying a "protection". If there isn't, I would sooner spend thousands on a lawsuit than I would tuck my tail between my legs and pay up. I'd like to look into this 3rd party agency you mentioned, if you don't mind sharing the name.
- Accacin 9y agoI've been using a credit checker called Clearscore, who as far as I recall get their credit information from Equifax. Has this breach affected any of their customers outside of the US?
- askew 9y ago> As part of its investigation of this application vulnerability, Equifax also identified unauthorized access to limited personal information for certain UK and Canadian residents. Equifax will work with UK and Canadian regulators to determine appropriate next steps. Nothing on Equifax.co.uk
- bigtunacan 9y agoIs there a dump available for this yet so we can see just how massively F*ed we are now?
- mmjaa 9y agoI just want my own info. Like, I need to see it. Problem is: there is no simple way to see my own info in this leak. I either get a third-party involved, and thus make the leak worse, or I .. get everyone elses data and have a look at it, too.
- astura 9y agoYou can see all the data Equifax has on you at https://www.annualcreditreport.com/ https://www.annualcreditreport.com/
- mmjaa 9y agoYeah, then I'd have to use a service that has already failed me. I think this shouldn't be the case.
- astura 9y agoThis is not a separate service, this is just a unified request to the three bureaus for your credit report. It's run by the bureaus themselves and redirects you to their individual sites. You can choose just Equifax if you want. The other option is contacting Equifax directly by mail - https://www.equifax.com/personal/education/credit/report/how-to-get-your-free-credit-report https://www.equifax.com/personal/education/credit/report/how...
- wyc 9y agoThis is truly low: Equifax gives the affected victims a "special offer" to protect their identities. In the fine print is a waiver to any class-action lawsuit. https://twitter.com/wyatt_privilege/status/906120794593427456 https://twitter.com/wyatt_privilege/status/90612079459342745...
- dabockster 9y agoI doubt this would be upheld by a judge in the event that a class action were to be taken to court. Remember, any legalize like this is worthless unless a judge says it's valid.
- liberte82 9y agoDoesn't make them any less scum for trying it.
- nerdponx 9y agoFortunately binding arbitration clauses are considered unenforceable in some cases.
- hedora 9y agoI think $1000 is a lowball estimate for the per-person damage done by this breach. At $1000/head, they would be looking at $137B of liability with a market cap of $17B. Good. How hard is it to opt-out of whatever class action settlement is offered, and take this to small claims court? Anyone want to setup a website to automate the paperwork? I'd love to see a not-for-profit do this moving forward when things like this happen.
- carl_island 9y agoI love it when a publication using WordPress dings another site for using WordPress.
- Thriptic 9y agoFrankly what is necessary here is a version of medical malpractice for the IT industry. If you do something which is far outside what is considered industry best practice and it results in a penetration which harms users, you should be criminally liable in severe cases with strong punishments. People from these companies should also be black balled out of the industry.
- kortex 9y agoAnyone know roughly how useful this debug information is to would-be attackers? > com.ibm.websphere.servlet.error.ServletErrorReport: com.ibm.ws.jsp.JspCoreException: Unable to convert string 'uiadmin' to class javax.el.ValueExpression for attribute basename: java.lang.IllegalArgumentException: Property Editor not registered with the PropertyEditorManager > > Caused by: > com.ibm.ws.jsp.JspCoreException - Unable to convert string 'uiadmin' to class javax.el.ValueExpression for attribute basename: java.lang.IllegalArgumentException: Property Editor not registered with the PropertyEditorManager It looks to me like it's choking on some sort of deserialization, which could lead to execution of EL code. https://issues.jboss.org/browse/RF-13977?_sscc=t https://issues.jboss.org/browse/RF-13977?_sscc=t I'm not in netsec, but this looks pretty damning to me. The fact that I was able to go from "I have no idea how I'd begin to hit this" to "hey I wonder if I can hammer on this particular interface and see if I can get it to pop" makes me think this reaaally not something you should be revealing, above and beyond the usual "don't show debug information to the outside world". https://www.equifax.com/cs7/faces/jspx/login.jspx https://www.equifax.com/cs7/faces/jspx/login.jspx
- Chaebixi 9y agoI've been wondering for awhile: what would it take to implement a revocable identifier to replace SSNs? I've given up hope that companies can secure their data, but people have no options to take back control when their data is inevitably disclosed.
- gldalmaso 9y agoI'm curious, does the US government offer any way for you to change your SSN after its leaked?
- hmhrex 9y agoYes, but it can be time-consuming. https://faq.ssa.gov/link/portal/34011/34019/article/3789/can-i-change-my-social-security-number https://faq.ssa.gov/link/portal/34011/34019/article/3789/can...
- astura 9y agoYes but you have to prove real ongoing harm, not potential. They only give out new socials in extremely unusual circumstances.
- whipoodle 9y agoThere still doesn't seem to exist the political will do to anything real about this, or to hold accountable in any real way the companies that leak. These stories happen pretty much every week now, often more than one a week. I think companies will continue not caring, simply do a blog post after they get owned about how sorry they are and then proceed with business as usual, unless that changes. I don't think the issue is SSN, though it is absurd how we treat SSN as both an identifier and a secret at the same time. The problem is we don't really care when secret info gets leaked- even when it's actual secrets and not something sort-of-secret like SSNs.