34 ms·
Equifax Faces Multibillion-Dollar Lawsuit Over Hack
- mcbits 9y agoNot if everyone signs up for free credit monitoring as their settlement.
- wyldfire 9y agoGee, does that automatically settle the claim? I suppose it only would if there were some kind of agreement you make when you apply for the service. I take some mild comfort knowing that > 90% of US adults likely have been impacted (wild guess at US folks who have ever applied for credit -- or it's probably a good amount smaller number if the scope is ever-requested-a-credit-report).
- gph 9y agoNot that it changes your point, but I'd put the percent impacted a lot lower than 90%. There's a large underclass of people who don't even have a bank account let alone a credit account of any type. A lot of poor people still basically live by cash and EBT-card. I'd put it closer to 75% max.
- spinlock 9y agoDoes it matter if you've applied for credit? They track everyone. The important thing to remember is that you are not and have never been a _customer_ of Equifax. You are their product. The banks, car dealerships, etc... that pay them for credit reports _about_ you are their customers. You are their _product_. And, in my experience, they treat their product like shit when their product gets his identity stolen.
- mcbits 9y agoI'm not an Equifax customer and don't plan to become one by signing up for anything, so I haven't seen the terms, but I would fully expect to see some kind of indemnification in there.
- zmarty 9y agoYou are a "customer" if you want it or not.
- atom_enger 9y agoThe super fucked up part is that it automatically signs you up for their "Credit protection" if you use their site to see if you were impacted. Doesn't ask if you'd like to, just says "Thanks for signing up, your year starts now!"
- samstave 9y agodo the TOS require one to only go through mediation as a part of this, so by signing up you waive your right to sue?
- Twirrim 9y agoYup
- 3JPLW 9y agoYes, the TOS does require arbitration (including for actions that occurred before signing the TOS), but it's not clear if it applies to just the child company that is providing the credit monitoring service or if it applies to the actions of the parent company, too. I am not a lawyer. https://trustedidpremier.com/static/terms https://trustedidpremier.com/static/terms
- tanderson92 9y agoOne thing I'm trying to wrestle with is why they would make you agree to arbitration for actions prior to signing TOS if indeed it applies only to the child company. Your relationship with the child company begins when you sign the TOS, no?
- craigyk 9y agoI'm curious as to wether any lawyers here can chime in on how well this TOS would hold up in court. I know when I went to check I was never shown the TOS or even a checkbox that needed to be checked to confirm that I agreed to the ToS with a link to them. It feels like the ToS are what comes with the ID protection service and were meant to apply only to lawsuits that might arise from using the ID protection service, but IANAL.
- redm 9y agoI'm not excited about this class action; If they win, the individual payout will be almost nothing ($10?). The lawyers are the only ones who will really "make out" with 10's of millions in fees. There is also a disproportionate effect in that a small portion of the 143 million affected will have a large impact, i.e., "identity theft" while most will be unaffected. I think a fund setup to help those who are directly affected is a better idea. This could be done through government action where penalty proceeds are turned into a fund. In other worse, similar to the BP oil spill in the gulf where the fund helped those who lose income or suffered property damage.
- deegles 9y agoI think a fund is a good idea, but how do you verify that the people claiming from the fund are the people who were affected? :) Keeping my identity/online data safe just seems so hopeless that I don't think about it anymore.
- spinlock 9y agoIMO, the best outcome would be to put Equifax out of business. I have had my identity stolen and they were complicit in enabling the fraud against me. Once you tell them you're NPI has been compromised, they get incredibly passive aggressive against you and refuse to allow you to manage the situation (i.e. they won't let you unlock your credit to apply for a mortgage). In short, this breach of public "trust" is only the smoking gun that proves how horrible Equifax is. But, they have a long history of being a parasitic organization that will hopefully die soon.
- throwaway2048 9y agoI'm not so sure about that, the data they have just gets resold to some other party when they go bankrupt, possibly many other parties and shit gets worse.
- stdgy 9y agoIs there any legal way to stop sales like that? If it were shown that Equifax were negligent in protecting the data on their systems, could a court demand that they remove all of the data to mitigate further harm?
- eduren 9y ago>In the complaint filed in Portland, Ore., federal court, users alleged Equifax was negligent in failing to protect consumer data, choosing to save money instead of spending on technical safeguards that could have stopped the attack. Doesn't "users" imply that we had a choice in the matter? As if we're Equifax's customers? I feel more like we're victims in this case.
- YCode 9y agoOne thing I'm not sure about is how this breaks down as to people who paid Equifax or signed up for some service through them compared with people who involuntarily had their credit tracked through Equifax.
- vthallam 9y agoI was wondering about this too. Like, I never signed up for them, but apparently their site says I might have been affected. CreditKarma or other credit score companies apparently share user data to these agencies. Their announcement says social security, addresses and names have been stolen, this is really worse, this data is enough to do ton of things.
- harryh 9y agoCreditKarma doesn't give info to Equifax, it gets info from Equifax. The credit agencies (of which equifax is one of 3) get their info from credit card companies and other financial institutions. If you've ever signed up for a credit card or gotten a mortgage or car loan the information from that transaction was sent to the credit reporting agencies. That's how they get data to make their determination of how credit worthy you are.
- flatline 9y agoIf you've ever opened a bank account or a line of credit you signed something to the effect that you agreed to let your institution share your data with these agencies.
- mbesto 9y agoAnyone have a good source for an unbiased (i.e. not trying to sell me something) "what exactly should I do" now? File for the class action? Freeze my accounts? Get identity protection?
- spinlock 9y agoHow did you find out if you were affected?
- Arubis 9y agoPresumably (s)he holds a US credit card. The stats on this release are such that most adult Americans are more likely affected than not.
- gooseus 9y agoA buddy of mine sent me this reddit thread, I'm reading through it still and don't have much finance/credit knowledge, but it seems legit and unbiased to me so far: https://www.reddit.com/r/personalfinance/comments/6yv4gb/official_mega_thread_recent_equifax_security/ https://www.reddit.com/r/personalfinance/comments/6yv4gb/off... Would be interested in hearing other opinions on what's being said there, especially regarding using the www.equifaxsecurity2017.com site and legal rights.
- dabockster 9y agoI just finished filing a complaint with my state's attorney general's office. YMMV, though.
- inerte 9y agoDoing a credit freeze is a good idea regardless of the recent events: https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...
- donjh 9y agoIn my state that costs $10/bureau, plus another $10 to temporarily unfreeze or permanently unfreeze. The fact that they can leak my information and then charge me to protect myself just seems wrong.
- hedora 9y agoI'd love to see the $70B number pan out (though $500 per person is less than the damages, I think) -- Equifax is a $17B company, and would presumably stop existing if that happened. On the other hand, these things always settle out of court, and Equifax certainly won't settle the suit for more than they're worth. I said it elsewhere, but I think the right response is to opt out of the class, and sue for $1000 in small claims court. If ~15% of the class does this, they are out of business, and lawyers don't get a dime of the $1000. Also, I'd love to see a new non-profit website that automated the paperwork.
- sjg007 9y agoIn small claims court, would you not have to show $1000 worth of damages?
- arduanika 9y agoYes, and it's possible using simply arithmetic and market rates! Given that freezing your credit ratings is a necessary precaution after this damage inflicted by their negligently unpartitioned database, we can calculate: 1 legally guaranteed free credit report / year * ($5 freeze before + $5 unfreeze after) * 3 agencies * 33 more years of healthy remaining life God willing = $990 right there. Move apartments or change jobs just once in that interval, and it will bring you up to a round thousand. Bam.
- sjg007 9y agoActual, not theoretical.
- mlrtime 9y agoCould we create a service that automates most of the work required to sue in SCC?
- X86BSD 9y agoWhy not? Wouldn't it be the same as the kid that automated fighting a speeding ticket or traffic infraction ticket?
- s73ver_ 9y agoGood. I hope they get sued into the stone age. And then, I hope all of the other agencies take note, and start deleting their data.
- devrandomguy 9y agoNah, they'll just create expendable shell companies to decouple the risk from the profit.
- ghughes 9y agoThat’ll be nice for some lawyers. I’d prefer to see severe civil and/or criminal penalties for the senior management folks who allowed this to happen on their watch. Expect many more breaches of this magnitude until C-levels start to feel the consequences of their negligence.
- eloff 9y agoIt's a sign of how awful Equifax is that I find myself rooting for the lawfirms in this case. I really hope they win, and that they get the full $70 billion, and that it's enough to shutter Equifax permanently. What a win that would be! Also it would serve as a nice cautionary tale to companies that infosec matters. That insurance for data breaches matters. Because right now, it's too easy for them to not care. It's us that suffer the consequences, not them. That has to change.
- pc86 9y agoYes, what a win it would be to simply transfer ownership of Equifax from one party to another in the event of bankruptcy. The business itself would continue and nothing would change.
- JumpCrisscross 9y agoInvestors would get wiped out and many people canned. The signalling value is massive.
- bsder 9y agoIf you wipe out the investors, they will start demanding security before investing in a company. And, if you wipe out the stock, you also wipe out big chunks of the compensation of the CEO, CFO, CTO, etc. Until this starts hitting important people in the wallet, nothing will change.
- robteix 9y agoUse of the site they created to check if your data was leaked may contain terms and conditions that waive your rights to sue. [1] https://twitter.com/zackwhittaker/status/906178254331142144 https://twitter.com/zackwhittaker/status/906178254331142144
- bishnu 9y agoIt seems that checking to see if you're affected by the Equifax breach waives your right to sue Equifax: https://techcrunch.com/2017/09/07/i-called-equifax-to-find-out-if-id-been-affected-but-it-just-hung-up-on-me-three-times/ https://techcrunch.com/2017/09/07/i-called-equifax-to-find-o... No idea how ironclad such a clause would be,k though.
- cmiles74 9y agoAt this point they will tell you if your effected and then offer to enroll you in their complimentary "TrustedID" program. If you choose to enroll, that is when you waive your right to join any class action lawsuit.
- lepht 9y agoThis isn't true. Just by entering in your information to check if you're affected, you'll be enrolled automatically if you were indeed affected. Really scummy behavior.
- creeble 9y agoThis is not true. I checked, and it offered me the opportunity to sign up "on or after" a specific date. There is no automatic enrollment.
- lepht 9y agoSorry, I misspoke a bit there. What I was trying to point out was that > If you choose to enroll, that is when you waive your right to join any class action lawsuit. Isn't true. Just by using the site to check, you're waiving your right to participate in a lawsuit, as expressed in the site's Terms of Use linked at the bottom: http://www.equifax.com/terms/ http://www.equifax.com/terms/ > THIS PRODUCT AGREEMENT AND TERMS OF USE ("AGREEMENT") CONTAINS THE TERMS AND CONDITIONS UPON WHICH YOU MAY PURCHASE AND USE OUR PRODUCTS THROUGH THE WWW.EQUIFAX.COM, WWW.IDENTITYPROTECTION.COM AND WWW.IDPROTECTION.COM WEBSITES AND ALL OTHER WEBSITES OWNED AND OPERATED BY EQUIFAX AND ITS AFFILIATES ("SITE"). > No Class or Representative Arbitrations. The arbitration will be conducted as an individual arbitration. Neither You nor We consent or agree to any arbitration on a class or representative basis, and the arbitrator shall have no authority to proceed with arbitration on a class or representative basis. Further detail from an actual lawyer in this comment: https://news.ycombinator.com/item?id=15203185 https://news.ycombinator.com/item?id=15203185
- zimbatm 9y agoHow does Equifax build their database of people exactly? If it's all based on public information then they could argue that it's not really a leak. They are merely interpreting public information to build credit score. If guess for subscribers they could get more information than publicly accessible. What fraction does it represent?
- empath75 9y agoThe credit card companies and lenders provide them with your information. It's not public.
- pishpash 9y agoIt's not public data, it's data that creditors provide.
- oh_sigh 9y agoPrivate companies report information about you to the big agencies, and then they blend in public information. So it is a mix of public and private information.
- runesoerensen 9y agoNYS Attorney General on the arbitration/rights waiver clause: "This language is unacceptable and unenforceable. My staff has already contacted @Equifax to demand that they remove it." https://twitter.com/AGSchneiderman/status/906195350532304896 https://twitter.com/AGSchneiderman/status/906195350532304896 Also: "I am launching a formal investigation into the #Equifax breach. Today, I sent a letter to @Equifax seeking additional information." https://twitter.com/AGSchneiderman/status/906197644841766912 https://twitter.com/AGSchneiderman/status/906197644841766912
- hcurtiss 9y agoYeah, I'm not sure the arbitration language is applicable here anyway. The claims would arise from Experian's failure to secure their data, not from use of the "Products" offered by TrustedID (namely, the website allowing me to check) or the subject matter of the Terms of Use agreement.
- mjn 9y agoTheir FAQ [1] now appears to explicitly say so: that the class-action waiver and arbitration agreement only apply to disputes over the credit-monitoring product itself, not over the original breach. I don't know if they have some way to still weasel out of that, but publishing that clarification on their website seems like it'd make it harder? Do the TrustedID Terms of Use limit my options related to the cyber security incident? The arbitration clause and class action wavier included in the TrustedID Premier Terms of Use applies to the free credit file monitoring and identity theft protection products, and not the cybersecurity incident. [1] https://www.equifaxsecurity2017.com/frequently-asked-questions/#tab-2 https://www.equifaxsecurity2017.com/frequently-asked-questio...
- jjm 9y agoIt's time for this draconian type of business service be disrupted. It's gotten too big and unregulated. We often question monopolistic behavior with regard to market share and competition for physical goods. However we don't see this type of questioning with regard to data monopolies. Hate to say it that while I enjoy the use of Google and Facebook, they may also fall into this arena. Though with those companies at least an order of magnitude worth of effort MORE is expended on some form of heightened security, communication, and standards primary thru tertiary of their core offering.
- c3534l 9y agoEquifax isn't a monopoly. There are four major credit bureaus in the US. At best that's an oligopoly, but all that realistically does in this situation is provide more points of security failure.
- zackmorris 9y agoI'd like to know how much influence the consumer credit industry had in pushing through things like the Citizens United decision. Corporations love to be people when they can influence elections and make money off poor folks, but I wonder if they're ready to take the corporate death penalty when they break the law. A bunch of class action lawsuits might make options like Move to Amend a lot more palatable to corporations facing that kind of scrutiny. It also gives political capital to organizations working to prevent rollbacks on consumer protections implemented after the Great Recession. If Equifax's reputation hangs on a single hack, then they probably weren't that reputable to begin with. Why should we have to live under decisions that benefit them when they no longer exist, or weren't even who we thought they were?
- pmarreck 9y agoMaybe it's time to issue everyone private keys where the public key is your "SSN" and it is signed by N people you know to verify identity
- slivanes 9y agoBonus point task: . Get leaked info for Donald Trump . Used said info to access recent tax returns
- quickthrower2 9y agoCareful. Don't start a conspiracy.
- dickbasedregex 9y agoI'd love, love, love to finally see a company earnestly held responsible for their negligent security practices but I have no hope. Doubly so with this administration. Equifax getting run into the ground would help a president.
- Waterluvian 9y agoThe hack exposes lenders (banks, etc.) to a huge amount of risk, right? So don't they also have an interest in seeing agencies like Equifax punished severely for a hack like this?
- symlinkk 9y agoThis is probably a dumb question but how does Equifax, TransUnion, etc actually get the credit info in the first place? If I wanted to start a credit monitoring company, could I do it?
- hbosch 9y agoYour bank gives it to them.
- Dowwie 9y agoConsider the possibility that the hackers were agents of a sovereign power, such as one who has been hurt by economic sanctions and has a history of cyber warfare. This state could decide to respond to US economic aggression by using the compromised information of hundreds of millions of Americans to engage in fraudulent activity. This event is leading me to about how social security numbers can no longer serve the role that they have with establishing trust in identity, although they can continue to be used to uniquely identify a US citizen. This hack may push markets, and government, to widely adopt biometrics and other sensitive, personally identifiable information. What won't happen, unfortunately, is the political will to regulate how uniquely identifiable personal information is managed and stored. Suppose that rather than Equifax, Facebook were hacked. What kind of intelligence and reports does Facebook have on people that would eclipse that of social security numbers and credit history?
- gbarc888 9y agoUndoubtedly Equifax will claim that the hackers were agents of a sovereign power, to escape liability. Regardless, they admitted on their own web page that there was a flaw in their web application. Biometrics would be a terrible idea. Mass surveillance, anyone?
- matt_wulfeck 9y agoIt irks me that I can't file a "long term" (7 year) fraud alert unless I can prove with a police report that my identity has already been stolen. It's like giving people a flu shot only if they can prove with a doctors note that they currently have the flu. Hello! We're trying to prevent fraud here! This whole industry needs to be turned upside down.
- kbullaughey 9y agoAssuming an approximately Bernoulli outcome from Equifax’s perspective, the stock market thinks there’s only a 13% chance they’ll be shuttered by this negligence.
- bojackstorkman 9y agoThis is an interesting point. I'm not great with math, but I'd love if you could share how you calculated that?
- topspin 9y agoI'd appreciate advice from someone in the know about credit monitoring/repair services. There are so many and little credible information available about their capabilities and performance. If you have experience with this who do you recommend? I've been caught up in the DOD breech, this Equifax incident and a couple smaller ones. I'm not interested in pinching pennies here; I want good results.
- hcurtiss 9y agoIMHO - credit monitoring has limited utility. While it can help you identify issues more quickly, it's still after the fact. For that reason, I bought the family a Zander Insurance plan. If you get hacked, they handle the fix (including outreach to the credit bureaus) and cover your expenses. This year they also added some credit/identity monitoring features and wallet replacement. I've not yet had to use them, but the service makes a lot of sense to me. https://www.zanderins.com/idtheft2 https://www.zanderins.com/idtheft2
- frankydp 9y agoJust freeze your credit. It cost a couple dollars, but worth it. It is a hassle to unfreeze sometimes, but worth it. https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs#place https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...
- vthallam 9y agoThis is like the whole country's credit card holders got affected. Is it a suggested idea to freeze your credit reporting account and not allow any issuance of new credit cards? or Like SSN Lock provided by my EVerify provided by USCIS?
- coldcode 9y agoI have said for years this credit controlling triopoly needs to be shut down and replace with something less disgusting. Ever tried to fix a mistake they made in your credit report? You may as well be dealing with the Spanish Inquisition. There is no penalty for Cxx's who perpetuate inept security to make more money so security is always job #99. These folks seem to have cornered the market on ineptness. I doubt any lawsuit will make them do anything different.
- lr4444lr 9y agoOrganizations at the hazy nexus of the public-private spheres (e.g. public benefits corporations, regional transit authorities, FINRA, health insurance companies) appear to be endlessly prone to "disgusting" fallout like this, no?
- kolbe 9y agoI think suing the organizations who irresponsibly gave our data to such an unsafe organization will be more fruitful. Equifax doesn't have enough money to truly compensate, but JP Morgan, Bank of America, &c do.
- lightbyte 9y agoI hope this succeeds and bankrupts Equifax, but then what? Over a hundred million Americans still have their SSN exposed, what are we going to do about that?
- deleted 9y ago[deleted]
- ineptech 9y agoIs it time for a Federal Department of Verifying Whether People Are Who They Say They Are? Veryifying identity with SSN is broken. The right way is probably more or less how big webapps do it - MFA + a password that the user can reset by providing a bunch of info. The government has the necessary private info to do this in most cases (e.g. DL# plus your income from last year's taxes), and can fall back to "Show up at a police station/DMV/other office and talk to a human" in disputed cases. I'm sure there are lots of private corporations that would love to be the One True Arbiter of who's who, but none of us would trust them, or want to pay the price. An open source solution (something like Keybase?) seems possible, but not without government backing.
- 3JPLW 9y agoUSPS is a good contender for identity validation, too.
- mmagin 9y agoUSPS is no longer really part of the federal government.
- chrismealy 9y agoYes it is, 100%.
- chrismealy 9y agoI love that I got downvotes for this. People are mad about the post office.
- burnte 9y agoThey should downvote it, it's entirely inaccurate. https://en.wikipedia.org/wiki/United_States_Postal_Service#Governance_and_organization https://en.wikipedia.org/wiki/United_States_Postal_Service#G...
- simonswords82 9y agoIt's always seemed odd to me that Experian and Equifax have the upside of being both arbitrarily in charge of so much data and wield ridiculous power, and yet somehow they're still largely independent and profit making. I'll watch the outcome of this breach with interest. It strikes me that at the very least credit rating agencies should be non-profit and very closely monitored by government. This will include ensuring security best practice is followed. As others have rightly pointed out, they even have the audacity to call us customers. Like somehow we turned 18 and signed up for their service. I certainly didn't, and it annoys me that a company whom I have no control over can make or break my credit history.
- g051051 9y agoYou're what's called a "consumer", as in "Consumer Financial Protection Bureau". You're only a "customer" of Equifax if you purchase one of their products. The CRAs don't make or break your credit history, that's the businesses that supply information to them. The CRAs are aggregators, and just report what their members tell them.
- mbillie1 9y agoCredit algorithms, specifically your FICO score, are not transparent. There is no reason beyond the naive assumption of good faith on the part of these companies to believe that they don't make or break at least your credit SCORE.
- cr0sh 9y agoI don't think you're even a consumer. You are the product. The sell this "information" (your identity and more) between businesses looking to establish whether to give you credit or whatnot.
- floatrock 9y ago> It strikes me that at the very least credit rating agencies should be non-profit and very closely monitored by government. This will include ensuring security best practice is followed. Tell that to people riding their free class-action credit monitoring from when their OPM background investigation records got leaked to the russians or chinese thanks to the government's "security best practices".
- hbosch 9y agoSSN's need firewalls.
- mamazaco 9y agoDoes anyone know how the hackers got in?
- mamazaco 9y agoHaha admin/admin according to https://krypt3ia.wordpress.com/2017/09/14/equihax/ https://krypt3ia.wordpress.com/2017/09/14/equihax/
- bodz 9y agoA lawsuit seems appropriate, but I'm confused on their allegations. How can this lawsuit claim that Equifax "wasn't spending enough or doing enough to protect the information" when nobody, except for those within the company, know how much is spent or done to protect the information? Is there some public record I'm not aware of that says Equifax underspent on cybersecurity? Or is this lawsuit just a shot in the dark hoping to hit a target? I wouldn't be surprised at all if the allegation is true, but AFAIK there's no way these individuals actually have proof of it, and it seems like a flaw in our legal system that people are allowed to make allegations like this without any type of proof.
- lr4444lr 9y agoIf the plaintiff's expert witnesses can be brought in to show convincingly that the nature of the breach - as we can see from the outside - suggests basic common safeguards were not taken, that could force Equifax's hand to show otherwise.
- HelloMcFly 9y agoThat's what the "or" is for in "wasn't spending enough or doing enough." It's evident that they did not do enough to protect the information. Spend is a proxy for action, but ultimately it's the action (or inaction) that matters here. I only see them exonerating themselves to a large degree if they engaged in routine third-party audits of their security and consistently responded to every identified issue.
- lightbyte 9y agoI'm not a lawyer, but is that not what discovery is for?
- ilaksh 9y agoThis reminds me. Fight Club was a great movie.
- crb002 9y agoSo essentially three Equifax shares to every victim?
- schiffern 9y agoAs usual, Bruce Schneier was right. "Data is a Toxic Asset" https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
- 31reasons 9y agoProspects of this data used to hack the next elections are frightening.
- larrykwg 9y agoSo let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of the adult american population. Then the executives sold their stock a day before they announced the hack to the public. Besides the troubling fact that you still use social security and credit card numbers as any form of reliable authentication, how aren't there already federal agents searching every square inch of the company and interviewing key employees under oath? But no, nobody is securing this evidence and thus any lawsuit will probably either fail or end in a small settlement of an amount the company will not be significantly hurt by, causing no reason for stronger security in the future of this or any other company. The kind and amount of information warrant strong regulation in the way the data can be stored and processed (separate monitored networks not reachable from the internet would be the absolute minimum), governmental regulation needs to ensure the security of sensitive personal information like this and regular checks need to be conducted to ensure their adherence, especially in the case of a breach like this after the fact, you can't rely on the company conducting a forensic investigation. But no of course not. I can already hear Americans preach to me how the free market is great and solves all your problems.
- TCM 9y agoThe NY Attorney general is looking into the situation now. https://www.nytimes.com/2017/09/08/business/equifax.html?rref=collection%2Fsectioncollection%2Fbusiness&action=click&contentCollection=business®ion=rank&module=package&version=highlights&contentPlacement=2&pgtype=sectionfront https://www.nytimes.com/2017/09/08/business/equifax.html?rre...
- slouch 9y agoPA to lead the investigation https://twitter.com/PAAttorneyGen/status/906244506844110848 https://twitter.com/PAAttorneyGen/status/906244506844110848
- paulddraper 9y ago> how aren't there already federal agents searching every square inch of the company Usually reserved for criminal cases, not civil ones. > regulation in the way the data can be stored and processed Have it. > regular checks need to be conducted to ensure their adherence Have it. > I can already hear Americans preach to me how the free market is great and solves all your problems. Please quote me the "solve all your problems" source.
- deleted 9y ago[deleted]
- rangersanger 9y agoMy hope is that this opens a larger discussion on the business practices of these credit bureaus, the kind of data they collect, and ultimately their harm to the public good. As far as I'm concerned, they stole my data first, then they packaged it up neatly and gave it to shady persons. Yes, I'm aware that I "consented" to their collection of my data when I signed up for a credit card, or a car loan, but it's not a system you can realistically opt out of. If I want to rent an apartment or, sometimes, even get a job, I need to consent to a credit pull, so I need to have a positive credit history. So, we have a private sector monopoly that I am coerced to give my data to, for free, to function in society. Seems like a good business to be in, but as an outsider I'd like to see something drastic happen. Perhaps nationalization, or breaking up of the big three with deep regulation. *edited to add omitted "three" in last sentence.
- mbillie1 9y agoNationalization of credit agencies - or even regulation governing exactly how credit scores are computed, and making that information transparent to the public - would be a huge step forward. Credit-determining algorithms are presently a black box to the public.
- ajoy 9y agoIs it not possible to write to our legislative representatives about this about how we think?
- zanny 9y agoYou can absolutely write them, you just might find you have a hard time making them care over the sound of campaign donations from the credit oligopoly.
- mbillie1 9y agoI call my both my senators and my congressional representative almost daily. It's important to do, I think more people need to be active in that sense.
- ThrustVectoring 9y agoCoordinating the response here is the key part here, but "massive number of suits in small-claims court" is probably better for threatening Equifax with an existential legal threat. Equifax employs about 10,000 people worldwide. A million small-claims cases has each Equifax employee handling 100 small-claims cases. I don't think they can handle that level of distributed legal aggression. It just takes too much time by too many people, especially if people refuse to settle for anything less than $1000. Probably the best way to crowdsource it is to go through the process yourself, write a step-by-step guide to what you did, and post the results on social media.
- williamscales 9y agoDoes anyone know of a sort of recipe book for how to file a small claims court case in this sort of matter? I'm interested in this avenue but I don't want to spend a lot of time figuring out how to do it or potentially screw up some little thing that renders the whole effort futile. It seems like the argument might be slightly more subtle than a case of, say, theft or fraud. It's negligence.
- tonyztan 9y agohttps://news.ycombinator.com/item?id=15207727 https://news.ycombinator.com/item?id=15207727
- politician 9y agoIt's time for the USA to adopt EU-style GDPR protections, by constitutional amendment if necessary.
- sillysaurus3 9y agoHow likely is it that Equifax will face any real trouble from this breach? Will this be one of the first cases where security negligence causes real harm to a company? Or will it turn out to be another slap on the wrist?
- marksellers 9y agoI should hope something happens. This is a monumental fuckup.
- Justsignedup 9y agoSlap on the wrist, guaranteed: - potentially every one of the 143M people are going to have some sort of trouble - WORST CASE equifax shuts down, but that doesn't matter. too late. - if everyone was to win a lawsuit for everything equifax is worth, they'd get maybe $100 minus lawyer fees. And worse, now we have a financial system dependent on 2 companies. Making a 3rd isn't an easy matter. ::shrug::
- tryingagainbro 9y ago143 million people, or essentially every US citizen over 18 (give or take a few million.) It most likely includes Senators, Congressman, Donald Trump etc etc. So, yeah, a lot of people will be inconvenienced and pissed off, ad for a very good reason.
- jstarfish 9y agoSenators, congressmen and Donald Trump himself all had their data previously leaked at least once before. Nothing changed as a result.
- banderman 9y agoI like how people are encouraged to pay $5-10 to each reporting agency to have their file locked. Multiply that by the 140,000,000 people whose data leaked... should generate some nice revenue for all 3 of these companies holding your exploitable personal data hostage.
- privaroonie 9y agoYeah, I would think so. So far, we've learned that they've exposed virtually everyone's data through their incompetence (thus exposing nearly every adult in the US to a high risk of identity fraud), sold stock to avoid personal financial losses before the news broke, and set up a scam site to trick people into giving up their right to sue. If this isn't criminal, then nothing is. If someone doesn't go to jail over this, why the hell shouldn't I just go out and commit fraud on a daily basis myself? It seems to be rewarded in our society...
- nxsynonym 9y ago>> why the hell shouldn't I just go out and commit fraud on a daily basis myself? Because corporations are protected, individuals are not. This is what happens when business(profit) takes precedence over human rights. There will be no repercussions for those responsible. No changes will be implemented. At best we'll get a public apology, but even that seems far-fetched.
- samstave 9y agoShould a sound approach, then, not be, to incorporate one-self at birth? What if A Person were to be born into a corporation and all transactions made by thhem be the corporations actions - if things go south, dissolve the company. (clearly this is simplistic, but you get the idea) I want to re-form myself into one of these corporations which has little retribution for actions. I shall pledge 10% of SamStave INC LLC to any attorney on the ~~~prowl~~~ case...
- jdmichal 9y agoThis is extremely difficult for a single person to do without piercing the veil. https://en.m.wikipedia.org/wiki/Piercing_the_corporate_veil https://en.m.wikipedia.org/wiki/Piercing_the_corporate_veil
- astockwell 9y agoIndeed, this seems only logical. I honestly have this thought every time I make a large financial decision: Renting a house? Would be much easier to break the lease (Should I ever need to) if my surrogate 'corporation' with few assets were the leasee. Ditto with many medical situations/other large expenses. Plus, much better tax deductions!
- bitmapbrother 9y agoDoes anyone have information on the hack and what OS / Server they were running?
- nfRfqX5n 9y agoany way to check if we're affected by the hack without putting info into their form? i called them earlier to see if i had an account, but i don't.
- ebiggs 9y agoEven when there isn't a data breech I don't understand how all big 3 credit agencies survive doing their business as they currently do... which is to expose people to the injury of identify theft by default, and then tell them to pay up if they want a product that protects them from that threat.. How is that not seen as akin to a gangster protection racket?
- gigatexal 9y agoI signed up to be notified before I knew that doing so waived my rights to sue them. Those damn agreements, I need to read the fine print.
- deanstag 9y agoWith all the Equifax headlines today, I was wondering if there would be a few poor souls in the the Equifax Tech Department who feels atleast a bit responsible for the whole mess. ( I do understand it is a collective responsibility of the management as well ) edit: Was the analysis of the hack published?
- ryanmarsh 9y agoThe H1B's are not going to sacrifice their chance at citizenship nor should they.
- deanstag 9y agoWhy is H1B relevant here?
- whipoodle 9y agoYou mean on the board of directors, not in the tech department. Edit: people never seem to like it when I say this. The phrase "the buck stops here" has a meaning.
- deanstag 9y agoHaha. I meant in all layers of the organization. Could be the IT Security Department, Policy Department, Could be the homegrown development team, anything.
- Z1nfandel 9y agoThe most frustrating place to be in these scenarios is the IT (especially security) department. Go ask any security guy if they think their environment is secure. Very few of us will say yes. It frequently boils down to we ask for things, and there are budget/manpower/time limitations in getting them implemented. So a breach occurs, execs say to IT staff "Why was this possible." IT staff says "We requested back in <month> to fix this, and its working through the slow process" Execs say "Why didn't you scream louder, identifying it as a critical issue" IT: "There are 1000's of other issues, just like this one. The attackers just managed to exploit this one, instead of one of the others. We can't identify all issues as critical, because then nothing is critical." Both parties stay frustrated thinking the other isn't doing their job right.
- perseusprime11 9y agoThis is just pure crazy. There should not be any non-govt agencies that store such sensitive information. This is not like credit card where you end up getting a new card. You can't change your name and ssn. I wonder how we will tackle this problem.
- cr0sh 9y ago> I wonder how we will tackle this problem. Short answer: We won't. Nothing is likely to drastically change. It'll just be another blip on this week's news, and on to the next big thing that comes up. Some individuals, over time, will likely have their lives screwed with, but because not everyone at one time will have this happen to them, nobody will care. Think about how long the EU and others had chip-and-pin for their cards. Also, everyone knew it was more secure. But it's only been in the past 6 months or so that the United States is finally getting it - and it isn't everywhere yet. I'm not trying to say chip-and-pin would have helped this situation (it wouldn't have). I'm just trying to convey just what kind of social and political inertia is at hand here in the United States, not to mention the size of our collective apathy, and extremely short attention spans. Had something like this had happened in the 1970s or 80s - heads would've rolled. 60 Minutes would have been all over it. Dan Rather would have frothed at the mouth. It would have been crazy to the extreme in the media and elsewhere. Change might have even occurred. Today? We'll be lucky if we're still talking about this in any amount next Friday.
- danblick 9y agoFrom a security standpoint, it seems like there's a problem treating everyone's social security number as if it's some kind of secret key. Has there been any real discussion about alternatives to the present system? How else could authentication work for opening a bank account? I imagine that the present system survives (1) because of inertia, and (2) because it doesn't require much infrastructure and so it's relatively cheap. Maybe the next step is something like putting a chip into driver's licenses and ID cards nationwide?
- ebiggs 9y agoSoc sec. number is used as an immutable unique identifier for Americans since that's really the only piece of information that can be used in such a way. I'm not aware of anybody relying on it as a sole means of authentication... if it's used for authentication it's always combined with additional information such as "you had a revolving credit account with: a, b, c, or d".
- deleted 9y ago[deleted]
- cletus 9y agoOk, so credit reporting agency collects sensitive personal and financial data on basically every adult American, loses it to a bunch of criminals and now I have to deal with the consequences? I looked into credit freezes yesterday. This is really a total scam. You have to _call_ each of the three agencies and pay a fee ($5 to $10) each time. If you need to unfreeze your report to make a legitimate credit application you have to call each of them twice (once to unfreeze and another to freeze) paying fees every time. Now if you're a paying member (paying a minimum of $15/month to each agency) you can just lock and unlock your credit file on a mobile app (well, three mobile apps and I'm not sure all three support this). It's amazing how convenient things get once they're already extorting you for "credit protection". This shouldn't even be legal. Also, if a fraudster defrauds a financial institution with your personally identifiable details, it should be an issue between the agency and the financial institution as you were not a party to this loan. The reporting agency saying you were should be slander. Financial institutions should be interested in consumers having an easy ability to lock their credit files as it would decrease the number of fraudulent credit applications. So why can't I have a mobile app (or three) for free that allows me to easily lock and unlock my file or, better yet, to vet every inquiry and approve it or not?
- SonicSoul 9y agohmm i called the 3 mentioned here today and all were free. https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq... Equifax — 1-800-349-9960 Experian — 1‑888‑397‑3742 TransUnion — 1-888-909-8872
- throwaway17761 9y agoThe Chief Security Officer's credentials are a degree in music[1]! I wish I was kidding. https://www.linkedin.com/in/susan-m-93069a/ https://www.linkedin.com/in/susan-m-93069a/
- njharman 9y agoThis is the kind of thing that should end/bankrupt a company.
- carapace 9y agoApologists please STFU you're making me sick. Everyone else, call your representative. You know how people say, "Pictures or it didn't happen?" Call your representatives and tell them what you think, or it might as well have never happened.
- jacquesm 9y agoYour comment history is some of the worst stuff on HN and some of the best stuff on HN. Could you attempt to leave out the worst bits?
- hellofunk 9y agoWhen taking extreme positions or offering gambles at humor or impression, it is often impossible to know which side of the line you will fall. As they say in Hollywood, no one knows anything (about what will become a hit).
- carapace 9y agoSo many possible responses. First of all, let me tell you I'm a lonely curmudgeon with no social life and about 1.5 friends. HN functions for me as a crude surrogate for socializing, in addition to its functions as a place to read about cool stuff, and yes, occasionally, a place to pop off and talk a little trash. I do try to contribute good stuff. So understand that I'm being sincere when I say, thank you for taking the time to read through my comment history. I also want to say that I do my best not to troll, and when I fail and people call me on it, I admit the mistake and apologize. I was trolling you a little bit there in the other thread and I apologize. Now then, as to leaving out the worst bits I don't think I can oblige you. In the first place, because my comments are sincere. I don't always phrase things in the nicest way, but I have a real point to make with a given comment or I would omit it. In the second place, what is the "decision algorithm" for "best" vs. "worst"? My point is, what you or I think are my best/worst comments may be totally different from what the next person thinks. I have had one comment moderated by dang once (and I was really embarrassed that he had to do it.) Other than that I pretty much stand by what I've said. There are a few comments I would delete if I could but that bird flew the coop long ago. Consider the old saw about advertising, "Half of your ad budget is wasted, the problem is, no one can tell you which half." That said, I take your comment to heart and I'll try to be less cranky on HN. But I stand by the comment I made above (for example): Apologists for computer INsecurity make me sick. It's far past time to fix this mess. Related to that, the people who says "Oh I give a crap." but don't call their representative or something like that are basically part of the problem. If one person read my snarky shitty comment and made the call, it was worthwhile. As for all the people that read it and didn't pick up the phone, I want them to know they suck, just a little, because I'm mad at them. In fact, I'm mad at most people. We stand at the pinnacle of history. But everyone is busy driving and talking on their cellphones at the same time while meanwhile the Monarch Butterfly is going extinct right before our eyes! There may not be elephants in fifty years. Okay, that's enough of that. Gotta calm down. ;-) Now about that other thread, where I was kinda trolly, my point there was that Rational Materialist fundamentalism is still fundamentalism. I am a rational materialist. Physics is the "Word of God". Nevertheless, I have had personal experience that indicates that physics is contingent on consciousness. I'm not going to be able to offer any sort of scientific proof of that because the structure of the Universe precludes it. But it's true. It is a true statement that cannot be proven. Not even in theory. There are hard limits to rationality, that a rational person must take account of to be rational. Consider: you're hanging out somewhere discussing rationality, when suddenly into the room bursts a Mad Logician! He's got a bomb and he shouts, "Do something irrational right now or I'm gonna blow us all to kingdom-come!" What do you do? If you start hopping up and down on one foot that's irrational, but to do so to prevent the ML from detonating his bomb is rational! Maybe if you ignore him he'll just go away. It's Russell's Paradox. This sentence doesn't describe itself. These words have no meaning. Etc. My quip about the square-root of two was meant to point out the fundamental nature of irrationality. Pythagoras is said to have killed the first guy to point out that two and the square-root of two are incommensurable. The "rational space" is a subset of the real space. There will always be places on the map marked, "Here be Dragons". (Also, if you call shamans con-men be sure to make sure that none of them can hear you. ;-)
- devhead 9y agoOur compliance rules dictate a 24hour window before we must share the data breach, in what world does the top personal data overlords have no obligation to disclose in a shorter window? Maybe had they done that, they wouldn't have had time to cash out their stocks before they tanked upon release.
- pg_is_a_butt 9y agoawww... you're cute. you think these sheep will put in the effort to make an example of anything? you're all idiots.
- joeblau 9y agoWhere is the credit report ICO? I have some Ethereum I want to invest.
- mgleason_3 9y agoWhy is there not a criminal case against these idiots? When you are controlling something dangerous and you allow that thing to harm someone else, it's a criminal offense. It's not a matter of whether it's hard. It's simply your responsibility to ensure no one gets hurt. This company has already caused harm to literally everyone in the US. Minimally, we all now have to take action to attempt to avoid identity theft. And it only gets worse from here. And these bastards have the chutzpah to wait until hurricane Irma is upon us to make the announcement.
- williamscales 9y agoToo big to fail!
- innovate 9y agofreezing credit profiles is a good idea but full account numbers (liability accounts only) as well as addresses and employer data were also part of this breach, its likely there will be many long-term consequences unfortunately...someone with this data can easily impersonate you and level up the level fraud
- josephorjoe 9y agoEquifax really needs to die over this, like Arthur Andersen after Enron. https://en.wikipedia.org/wiki/Arthur_Andersen#Demise https://en.wikipedia.org/wiki/Arthur_Andersen#Demise
- throwaway613834 9y agoQuestion: Is there any way to get a notification whenever a credit account of any sort has been opened in my name, WITHOUT freezing my credit or otherwise crippling/slowing/altering any process that exists? I just want a letter or email notification, not any other changes to anything. Ideally a free way, but paid if a free way doesn't exist...
- evidencepi 9y agoA perfect application for blockchain.
- cliffcrosland 9y agoTo be honest, I feel bad for the engineering team at Equifax. The vulnerability that compromised their system was a bug in an open-source Java library, Apache Struts, and security researchers only noticed it a few days ago. It seems that the Equifax team had very little time to react and update their software. In some sense, I feel that more blame should be placed on the engineers who built the highly popular open-source software, not the Equifax team. Some large number of Fortune 100 companies also experienced the same vulnerability simply because they trusted a widely used library. Makes me wary of trusting other big OS libraries, but since rebuilding every part of the stack from scratch is infeasible and unproductive, we don't have much choice but to use them. Technical announcement: Severe security vulnerability found in Apache Struts using lgtm.com (CVE-2017-9805): https://lgtm.com/blog/apache_struts_CVE-2017-9805_announcement https://lgtm.com/blog/apache_struts_CVE-2017-9805_announceme...
- eh78ssxv2f 9y agoI would have expected the data to be encrypted at rest. I am not sure why that was not the case.
- einrealist 9y agoIt doesnt help if that data is being accessed all the time by applications. You just have to break into one application in order to exfil the data or to get the decryption method along with the encrypted data. 'Encryption at rest' only works for data that is not actively used, like backups or if a physical storage device is stolen. A better additional safeguard is to have quotas and alarms in place for data access. Is data being accessed sequentially in a application environment where data is usually accessed randomly? Is data access bound to individual credentials and do indivudals access more data than usual? I think, there is actually potential for new database products or addons, which can reduce the impact of breaches in the vicinity of these 'core databases'.
- bitmapbrother 9y agoThere is some debate as to which Struts exploit was used. If it was the one from Sept, 2017 then you make a valid argument. However, if the exploit used was years old then the fault clearly lies on Equifax for not keeping their servers up to date. Also, didn't the Equifax breach happen in May, 2017? If so, I fail to see how the Sept, 2017 exploit plays into this unless it was in the wild months before it was published in Sept, 2017 - which I find hard to believe.
- yahna 9y agoI just want to complain about the credit freeze option for a second. Like many other people I decided to use this because of the breach, I went to the government identity theft site and found some links. Equifax - Fill out the form. "Additional information required" please mail stuff to us. Experian - In your state (washington) there is an 11 dollar fee for this service. Transunion - Fill out a signup form, complete with god damn security questions. Do the quiz about stuff on my credit report. 10 dollar fee. Go fuck yourselves you fucking bastards. I hope experian goes out of business because of this, I really do.
- shawn-butler 9y agoIt gets worse.. some financial news outlets are reporting that the CFO and executives leading two business divisions dumped shares prior to the news. Equifax responded they didn't know about the breach and it is unrelated.
- slackfan 9y agoFor the record, their form doesn't work. You can enter any arbitrary word and any random six digits and it will tell you that you probably have been affected, and will prompt you to sign up. Don't fall for this scam.
- odammit 9y agoThere really needs to be a law for "you did something obviously wrong and got caught and you kind of suck as a human being" with the punishment being your arms get cut off and you get tossed into a tank with sharks. That should be the execs' punishment for the stock sales. Also, technically speaking, this company sucks.
- drawkbox 9y agoWe need more competition in consumer credit agencies and need more control over access. We probably need more competition in corporate credit agencies as well like Moodys/S&P that got us into the housing crash. The lock-in deals these companies have make them get really lazy on their core tasks.
- whyenot 9y agoSuppose each person affected has to spend an hour protecting themselves from this breach. The cost in wasted time would be 16,313 years. It's high time to set an example. Equifax should no longer exist as a company. People responsible should end up in jail. Company executives should be held personally liable. Some would claim it is unfair, but the only way to keep this from happening again and again is for those responsible to face serious consequences.
- Nomentatus 9y agoCredit card companies could provide other businesses such as Equifax distinct mere-reference numbers which the customer doesn't see and which can't be used for purchases - just to absolutely identify which card, for all parties. These could be added to the magnetic stripe or chip in the card, for example. (It might be gilding the Lilly, but many such reference numbers could be used for a given card, re privacy issues or otherwise. But then those numbers couldn't be usefully passed between companies for all purposes.) There's no need for anyone but the customer and Credit Card company itself to retain the actual credit-obtaining-number (other than to allow future purchases with permission, which is the rarer case, often needs to be prevented not facilitated, and doesn't excuse Equifax having more than a reference number.) Yet the credit card companies don't do this. Why not? 'Cause humans are idiots, all of us, that's why. PS - run to the patent office and you might be able to make a ton of money patenting this, since patents are now given to whoever shows up at the patent office with the appropriate fees first. Precedence doesn't matter. You would be implying that you thought the idea up independently, of course, but you're smart, right? That's totally the sort of thing you could think of independently. Then when you're rich, you too can help choose what the patent laws look like, and whether rich people should pay taxes.
- unstatusthequo 9y agoI've seen at least four class actions filed within 24 hours. The first was last night.
- ausjke 9y agoGo to hell Equifax, whoever is in charge of security there should be put into custody before all the litigation. Multiple steps must be taken for nowadays people to get credit card and debit card or whatever(loans, money transfer,...). Use SSN, name, mother maid name, a few security questions, two-step authentication by default, all passwords must be hashed and salted otherwise it is a crime for the DBA,etc. Just switched away from 15+-year-yahoo-email after its leakage, now it comes Equifax, which is 1000x more critical, it is so bad.
- poland2 9y agoThis kind of thing actually can be prevented. There should be a law to force to sacrifice some convenience for safety. Well, it is convenient to access everything by Internet. But it is a double sword Simple but not too simple!!
- smcnally 9y ago"PSA: If you check Equifax's site to see if your data was stolen, you waive your rights to sue Equifax or be part of a class action suit." https://twitter.com/zackwhittaker/status/906178254331142144 https://twitter.com/zackwhittaker/status/906178254331142144
- kabdib 9y agoI'm involved in the design and maintenance of a PCI environment. Given the auditing requirements for these environments it is mind-boggling that an intrusion of this magnitude went unnoticed for several months. I'm left with the conclusion that they were either negligent or incompetent, or layers of management were actively trying to cover things up.
- astaroth360 9y agoTime to get rid of credit agencies as a whole. They are entirely useless. Make a Government agency that handles it instead of trusting the private industry to make as much profit as they can to the detriment of damn near everyone.
- sequoia_semper 9y agoNot a single Mr. Robot reference here? I'm disappointed.
- mrb 9y agoSo everybody has been talking about "freezing" your Equifax account for a little bit of protection... Well it turns out the Equifax security freeze PIN (which is all the "secret" info an attacker needs to unfreeze it) is just the date & time: MMDDYYHHMM! https://mobile.twitter.com/webster/status/906346071210778625 https://mobile.twitter.com/webster/status/906346071210778625
- colemannugent 9y agoIf this is true (and it looks like it is), this is absolutely insane. For me this puts Equifax into beyond negligent territory.
- usaphp 9y agoBut would not an attacker then have to know the exact minute that you froze your account on? If you have only a few tries to unlock your account - how would attacker possibly guess it?
- warent 9y ago525,600 possible pins for a whole year is staggeringly tiny. 1440 tries max if you know the day. 720 if you know if it was day or night. Botnet and/or proxies can do the rest
- woogiewonka 9y agoHas anyone notified them of this bafoonery?
- arunmib 9y agoBit curious about everyone's thought process with regards to credit freezing. I'm thinking about leaving the freeze in place and only do temporary unlock on as needed basis. Considering SSN and other info. compromised have longer life time, I really cannot think of any other option.
- deleted 9y ago[deleted]
- philipps 9y agoIs a credit freeze the most effective option here? What else can be done to prevent the possible effects of this? The FTC site also mentions a Fraud Alert for cases of suspected identity theft: https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...
- jaypaulynice 9y agoSorry, but companies that save pennies and nickels only to lose billions deserve this...but makes no sense that individuals have to suffer the consequences...of course they release the news when it's hurricane season.
- orange_county 9y agoI think the banks and loan industry are as guilty for giving information like this out to ththe credit bureaus. Next time you apply for a loan or open a credit card, ask them who they report this too. If it's Equifax, walk away.
- woogiewonka 9y agoHow do we get in on this lawsuit? What are the implications of this hack to an average person and what if anything should they do about it?
- marbu 9y ago> Others expressed frustration that three senior executives sold about $1.8 million in stock in the days following the discovery of the hack. A spokeswoman for Equifax said the men “had no knowledge that an intrusion had occurred at the time.” Wait, what? Isn't this a blatant example of insider trading? Moreover connected to a problem they are responsible for?. Do they seem to be really that stupid or is there a chance that they could get away with that in the end?
- Khaine 9y agoThee company and its management should be bankrupted. In Roman times the architect of a aqueduct and his family had to stand under it during the final stages of construction. This was a motivation to ensure they did a good job. Its high time we brought back this sentiment to leadership. If you knowingly monumentally fuck up you should be ruined.
- PacketPaul 9y agoI think a reasonable outcome is free credit monitoring for LIFE. I don't understand how these companies get away with only one year of service as if the information will be removed after that year.
- anonu 9y agoI think this shows that inanity of centralized credit rating agencies. How do we disrupt this? What if every person you owed money to (Credit cards, mortgage companies, car loan companies) basically reported your payment status on a monthly basis on the blockchain? I think this could work... Anyone could check your credit history - but at least it would be decentralized. There's obviously a lot of questions: How do you protect privacy of individuals? How to identify individuals with a number other than your SSN? Or maybe you do anyway... keeping your SSN secret in this day and age is clearly not viable longterm.
- throwawayjava 9y agopermanent and unrevokable authentication tokens are dangerous.
- bunderbunder 9y agoThe Fair Credit Reporting Act requires Consumer Reporting Agencies to do two things that are fundamentally at odds with the idea of using a blockchain: Negative information must be removed from your record after a certain amount of time. And false or inaccurate information - which some studies suggest exists on about 25% of consumer credit reports - must be removed or amended upon request. Both of these are Good Things. One of the most important things our legal system provides is opportunities for remediation when something goes wrong.
- TaylorGood 9y agoIf you enter Test and 12345 into their "checking site" it says account has been breached: https://twitter.com/zackwhittaker/status/906247688768905216 https://twitter.com/zackwhittaker/status/906247688768905216
- bogomipz 9y agoThe US has an adult population(who would hence have credit profiles) of 245 million people. At 143 million, this breach affects more than half of the adult population. Given this, the majority of credit rating systems of the US has been compromised. Isn't this enough that the whole "social security number as a master key" system has to be dismantled? How can it be trusted now? There is no way to opt out of having your data collected and sold by Equifax, Experian, TransUnion. The power these companies have over US citizens is incredible. Anyone that's ever tried to remove incorrect data on their credit report knows how painful it is to deal with these companies. Despite dealing and brokering in electronic data to buyers of your credit profile, your interactions with them as a consumer can only occur via paper mail and mailing letters which means weeks or even months for basic communication. They operate like thugs. I hope this is the end of them and by extension the other two agencies as well.
- thesagan 9y agoI don't think the SSN can be trusted as a key. They should be considered public data now. There's no going back.
- bogomipz 9y agoConsumers will end up footing the bill for this. This company will just increase the fee for credit checks in order to pay the penalty.
- cmurf 9y agoGood. I hope they go out of business, and the shareholders are wiped out for having it run incompetently.
- ada1981 9y ago$70B works out to less than $500/ person. I imagine that the firm will take 25-50%. Also, Equifax will likely just go bankrupt vs. paying 4x what they are worth. Perhaps we should seek to have the company turned over to the people, at which point a blockchain based credit system can be implemented.
- martin1975 9y agojust me here or has this given good pretext for mandatory national id laws, possibly on a biometric/EMV type of card, or worse, skin implanted rfid chips?
- stevebmark 9y agoSemi-related: When does CloudFlare get sued into the ground for man-in-the-middle-attacking all of their customers for several months?
- vivekd 9y agoIf someone offered me this case, I would probably decline it on grounds that I didn't see a reasonable prospect of winning. Equifax still hasn't revealed any data about how it was hacked, without that information it's hard to prove they were negligent. Negligence requires three things: duty, breach and damages. As to duty: Does Equifax really owe a duty to every single person whose data it keeps. That would be a tough argument to make. They didn't sign any contract or make any agreement with the people whose data they collect. So where does the duty come from? Even if the plaintiffs were able to overcome that hurdle, they would then have to prove breach. Was Equifax careless in they way they handled information security? I don't see evidence of that, the mere fact that they were hacked doesn't necessarily mean they were careless. All Equifax would have to show to win on this count is that they had some sort of basic security system in place comparable to what other businesses it's size have in place. My guess is that they do have a security system and that this probably wouldn't be hard for that to show. Being hacked would be considered under law to be an intervening criminal action. It is established that people are not responsible when damage is caused by someone else's criminal action. So long as Equifax took basic, prudent steps to protect data, they can't be held responsible for intervening criminal action. As to damages It's hard to see how anything of monetary value was lost by the plaintiffs in this case. There was a loss of privacy, but I haven't heard of courts giving out awards for that sort of loss. I'm sure people more familiar with information security could point to flaws in they way Equifax protected info. And certainly the way they reacted to the hack was negative. But bad or imperfect behaviour doesn't in and of itself give rise to a claim for monetary damages in court. This case doesn't seem winnable to me. There is some argument that if you use Equifax's identity theft protection you may be able to sue, which I think is what this class action is about. But that still doesn't give rise to damages because none of the plaintiffs can prove that their identity was actually stolen. And you still don't have breach (no proof that the hack was the result of Equifax's carelessness).
- leyth 9y agoHow does Equifax gather data on people? Do they get it from the government?
- throwawaymanbot 9y agoAs an American, I find it odd, that someone (in this case a corporation) can collect private information on me, and make money of of me, without so much as a share of the profits. Where have I seen this model before??