10 ms·

Another commenter, who now deleted the comment, said: "There's a 44% chance you were affected, but a 100% chance you waive your right to be in a class action l

Another commenter, who now deleted the comment, said: "There's a 44% chance you were affected, but a 100% chance you waive your right to be in a class action lawsuit if you enroll in their ID protection." I thought it was a good comment, but I wonder if it matters. How much would you get? I have been a member of these class action lawsuits before, and I get, like, $3 for my troubles at the end of the day, so I never claim the prize because it's another database where my SSN would be stored and stolen from. I think the best is to freeze your credit report and deal with the troubles of having to unfreeze it when you need a loan. If there are expert people from the Fin Svc industry here, is the above correct? Is freeze pretty much the only reasonable action now to protect ourselves?

pavel_lishin 9y ago
To date, having been a participant in three - that I was notified of by email - I've netted about twenty bucks. But I'm also not sure what the benefit of enrolling in their ID protection scheme is, given that the whole reason they're offering it is because they already gave it out to some rando on the internet. It's rather like paying the schoolyard bully to stop taking your lunch money.
- tonyztan 9y ago
  I've received $20.43 from the Perkins v. LinkedIn class action settlement. Personally, it's not about the money, but rather about trying to hold companies accountable for their actions. (http://www.addconnectionssettlement.com/ http://www.addconnectionssettlement.com/)
  - YCode 9y ago
    Exactly. People complain about how the lawyers who managed the case (sometimes for years!) take most of the payout, but so long as the company's risk/reward math is tipped towards the safety of their customers I have no issue with not seeing much of the settlement.
    - stult 9y ago
      >the lawyers who managed the case (sometimes for years!) take most of the payout This meme is part of the problem. The lawyers take maybe a third of the settlement, after bearing most of the costs of litigation themselves, which they would still bear if they lost. It's high risk/high reward. Lowering the reward just means no lawyer will take the case.
      - maxerickson 9y ago
        Quibbling over "most" is beside the point. There is a real issue where the incentives for the lawyers don't line up well with the interests of the class. The lawyers likely do pretty well if they settle a huge case for tens of millions and the main thing that happens for the class is they can't file a lawsuit anymore. The financial penalty for the company is better than nothing, but it often isn't all that much and often doesn't do the class any real good either.
    - jwommack 9y ago
      Part of the reason that is an issue is that they're settling for much smaller amounts because the cut they get is big. So you have some massive data breach cases settled for things like $10 million. That's not even punitive at that point for companies like Target. In practice it seems it basically just winds up being a big payout for whoever actually filed.
  - pavel_lishin 9y ago
    > Personally, it's not about the money, but rather about trying to hold companies accountable for their actions. I'm not entirely certain that a class action settlement is a sufficient deterrent; do the payouts typically hurt the company enough to not take some given risk again?
  - banned1 9y ago
    But didn't you have to provide your SSN to them? That would seem like a huge risk to give your SSN to some paralegal somewhere or some Wordpress plugin and MySQL unsecured database right?
busterarm 9y ago
Saying it's a 44% chance you're affected is really skewing things away from how severe they really are. At least 22% of Americans are under 18. There are actually 167 million Americans who own one or more credit cards, so this actually affects 86% of all US credit card holders. Not to shamelessly promote, but as soon as this broke yesterday I brought this to the attention of my firm and we filed I believe this morning. http://www.prnewswire.com/news-releases/classactioncom-files-lawsuit-on-behalf-of-millions-of-equifax-data-breach-victims-300516335.html?tc=eml_cleartime http://www.prnewswire.com/news-releases/classactioncom-files...
- msumpter 9y ago
  Glad filings are being made already, I wonder if it will be possible for someone to also seek relief/guidance for individuals checking to see if they were breached on trustedidpremier.com and may be inadvertently waiving their rights to class action suits and instead being forced into individual arbitration. Based on the fact their privacy policy and terms of service were just updated on Sep 6, this seems pretty blatant. Browserwrapped agreements haven't held up in most cases, but having the arbitration clause at the very beginning seems to be point of the entire thing. Pushing a notice 41 days after a breach (just in time for the 45 day requirement in most states) and directing individuals to check if they are impacted all while tricking them into waiving rights. Seems deceptive to me.
- deleted 9y ago
  [deleted]
- vxNsr 9y ago
  Could you guys push for free credit freezes and unfreezes going forward instead of some sorta ridiculously small monetary comp. It should be free at all bureaus, with Equifax picking up the bill for unfreezing and freezing at the other two.
  - busterarm 9y ago
    I'm just a developer in marketing, but I can suggest it.
toomanyrichies 9y ago
> the best is to freeze your credit report A question that came up among my coworkers and I was: given the nature of the data that was accessed, don't the thieves already have all the info needed to unfreeze your credit?
- dmoy 9y ago
  Yea I really want clarification on this before I fork over $30 to the mafia families, I mean credit agencies, to lock my credit score.
- bcarrell 9y ago
  When you freeze, they give you a PIN to unlock it. You can't unfreeze with just your hacked data alone. Of course, the PIN is probably in the next column over, so...
  - ceejayoz 9y ago
    They've almost certainly got a "forgot my PIN" flow, too. Otherwise a forgotten PIN would mean a lifetime loss of access to credit. What do you want to bet it uses stuff like your SSN to verify?
    - lightbyte 9y ago
      For Equifax, you are exactly right [1]. If you lose your pin you just ask for a new one and provide some basic form of id. [1] https://help.equifax.com/s/article/ka137000000DS9XAAW/What-do-I-do-if-I-lose-my-security-freeze-PIN https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...
      - ceejayoz 9y ago
        Yeesh. > Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms. Given that the hack included name, SSN, date of birth, and address, a fake copy of one of these should be incredibly easy to generate. edit: Driver's license numbers were also leaked in some cases. Fun.
AutomationTool 9y ago
This is a space where I think the id theft protection industry misses. A large chunk of the space revolves around the 3 bureaus, but there's a lot more to it than that. A credit freeze is only effective if the entity using your information actually checks your credit/talks to the bureaus. Tax fraud, healthcare fraud, shady car dealerships that don't care about your credit, buying a house where the seller 'holds the papers', etc, are all attack vectors that can be used with this sort of information.
mannykannot 9y ago
It matters a great deal, because the company is saying, in effect, "We will help you mitigate the consequences of our failure, but only if you indemnify us against being held accountable."
emodendroket 9y ago
The point of a class action suit isn't really the individual gain; it's the pain it's supposed to make the corporation feel. Providing a free trial of their stupid credit monitoring service probably doesn't do that.
kevin_thibedeau 9y ago
I'd be happy to get nothing if they were enjoined from storing any data on me with a hefty penalty for non-compliance.
l1ambda 9y ago
Huh? I've been a part of many class action suits and received many hundreds of dollars. Better than just giving up.
dabockster 9y ago
> you waive your right to be in a class action lawsuit if you enroll in their ID protection Good luck to them trying to get that to hold in a court of law. Remember that it's ultimately a judge's decision on whether or not legalize like that has any real power.
nstha02nsaoent 9y ago
I've been a member of many class action law suits. Often the payout is literally pennies, maybe dollars. But I have been a member of one class that received several thousand dollars from one suit. So it can happen, it's just rare.

pavel_lishin 9y ago

To date, having been a participant in three - that I was notified of by email - I've netted about twenty bucks. But I'm also not sure what the benefit of enrolling in their ID protection scheme is, given that the whole reason they're offering it is because they already gave it out to some rando on the internet. It's rather like paying the schoolyard bully to stop taking your lunch money.

tonyztan 9y ago
I've received $20.43 from the Perkins v. LinkedIn class action settlement. Personally, it's not about the money, but rather about trying to hold companies accountable for their actions. (http://www.addconnectionssettlement.com/ http://www.addconnectionssettlement.com/)
- YCode 9y ago
  Exactly. People complain about how the lawyers who managed the case (sometimes for years!) take most of the payout, but so long as the company's risk/reward math is tipped towards the safety of their customers I have no issue with not seeing much of the settlement.
  - stult 9y ago
    >the lawyers who managed the case (sometimes for years!) take most of the payout This meme is part of the problem. The lawyers take maybe a third of the settlement, after bearing most of the costs of litigation themselves, which they would still bear if they lost. It's high risk/high reward. Lowering the reward just means no lawyer will take the case.
    - maxerickson 9y ago
      Quibbling over "most" is beside the point. There is a real issue where the incentives for the lawyers don't line up well with the interests of the class. The lawyers likely do pretty well if they settle a huge case for tens of millions and the main thing that happens for the class is they can't file a lawsuit anymore. The financial penalty for the company is better than nothing, but it often isn't all that much and often doesn't do the class any real good either.
  - jwommack 9y ago
    Part of the reason that is an issue is that they're settling for much smaller amounts because the cut they get is big. So you have some massive data breach cases settled for things like $10 million. That's not even punitive at that point for companies like Target. In practice it seems it basically just winds up being a big payout for whoever actually filed.
- pavel_lishin 9y ago
  > Personally, it's not about the money, but rather about trying to hold companies accountable for their actions. I'm not entirely certain that a class action settlement is a sufficient deterrent; do the payouts typically hurt the company enough to not take some given risk again?
- banned1 9y ago
  But didn't you have to provide your SSN to them? That would seem like a huge risk to give your SSN to some paralegal somewhere or some Wordpress plugin and MySQL unsecured database right?

busterarm 9y ago

Saying it's a 44% chance you're affected is really skewing things away from how severe they really are. At least 22% of Americans are under 18. There are actually 167 million Americans who own one or more credit cards, so this actually affects 86% of all US credit card holders. Not to shamelessly promote, but as soon as this broke yesterday I brought this to the attention of my firm and we filed I believe this morning. http://www.prnewswire.com/news-releases/classactioncom-files-lawsuit-on-behalf-of-millions-of-equifax-data-breach-victims-300516335.html?tc=eml_cleartime http://www.prnewswire.com/news-releases/classactioncom-files...

msumpter 9y ago
Glad filings are being made already, I wonder if it will be possible for someone to also seek relief/guidance for individuals checking to see if they were breached on trustedidpremier.com and may be inadvertently waiving their rights to class action suits and instead being forced into individual arbitration. Based on the fact their privacy policy and terms of service were just updated on Sep 6, this seems pretty blatant. Browserwrapped agreements haven't held up in most cases, but having the arbitration clause at the very beginning seems to be point of the entire thing. Pushing a notice 41 days after a breach (just in time for the 45 day requirement in most states) and directing individuals to check if they are impacted all while tricking them into waiving rights. Seems deceptive to me.
deleted 9y ago
[deleted]
vxNsr 9y ago
Could you guys push for free credit freezes and unfreezes going forward instead of some sorta ridiculously small monetary comp. It should be free at all bureaus, with Equifax picking up the bill for unfreezing and freezing at the other two.
- busterarm 9y ago
  I'm just a developer in marketing, but I can suggest it.

toomanyrichies 9y ago

> the best is to freeze your credit report A question that came up among my coworkers and I was: given the nature of the data that was accessed, don't the thieves already have all the info needed to unfreeze your credit?

dmoy 9y ago
Yea I really want clarification on this before I fork over $30 to the mafia families, I mean credit agencies, to lock my credit score.
bcarrell 9y ago
When you freeze, they give you a PIN to unlock it. You can't unfreeze with just your hacked data alone. Of course, the PIN is probably in the next column over, so...
- ceejayoz 9y ago
  They've almost certainly got a "forgot my PIN" flow, too. Otherwise a forgotten PIN would mean a lifetime loss of access to credit. What do you want to bet it uses stuff like your SSN to verify?
  - lightbyte 9y ago
    For Equifax, you are exactly right [1]. If you lose your pin you just ask for a new one and provide some basic form of id. [1] https://help.equifax.com/s/article/ka137000000DS9XAAW/What-do-I-do-if-I-lose-my-security-freeze-PIN https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...
    - ceejayoz 9y ago
      Yeesh. > Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms. Given that the hack included name, SSN, date of birth, and address, a fake copy of one of these should be incredibly easy to generate. edit: Driver's license numbers were also leaked in some cases. Fun.

AutomationTool 9y ago

This is a space where I think the id theft protection industry misses. A large chunk of the space revolves around the 3 bureaus, but there's a lot more to it than that. A credit freeze is only effective if the entity using your information actually checks your credit/talks to the bureaus. Tax fraud, healthcare fraud, shady car dealerships that don't care about your credit, buying a house where the seller 'holds the papers', etc, are all attack vectors that can be used with this sort of information.

mannykannot 9y ago

It matters a great deal, because the company is saying, in effect, "We will help you mitigate the consequences of our failure, but only if you indemnify us against being held accountable."

emodendroket 9y ago

The point of a class action suit isn't really the individual gain; it's the pain it's supposed to make the corporation feel. Providing a free trial of their stupid credit monitoring service probably doesn't do that.

kevin_thibedeau 9y ago

I'd be happy to get nothing if they were enjoined from storing any data on me with a hefty penalty for non-compliance.

l1ambda 9y ago

Huh? I've been a part of many class action suits and received many hundreds of dollars. Better than just giving up.

dabockster 9y ago

> you waive your right to be in a class action lawsuit if you enroll in their ID protection Good luck to them trying to get that to hold in a court of law. Remember that it's ultimately a judge's decision on whether or not legalize like that has any real power.

nstha02nsaoent 9y ago

I've been a member of many class action law suits. Often the payout is literally pennies, maybe dollars. But I have been a member of one class that received several thousand dollars from one suit. So it can happen, it's just rare.