6 ms·

So let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of

So let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of the adult american population. Then the executives sold their stock a day before they announced the hack to the public. Besides the troubling fact that you still use social security and credit card numbers as any form of reliable authentication, how aren't there already federal agents searching every square inch of the company and interviewing key employees under oath? But no, nobody is securing this evidence and thus any lawsuit will probably either fail or end in a small settlement of an amount the company will not be significantly hurt by, causing no reason for stronger security in the future of this or any other company. The kind and amount of information warrant strong regulation in the way the data can be stored and processed (separate monitored networks not reachable from the internet would be the absolute minimum), governmental regulation needs to ensure the security of sensitive personal information like this and regular checks need to be conducted to ensure their adherence, especially in the case of a breach like this after the fact, you can't rely on the company conducting a forensic investigation. But no of course not. I can already hear Americans preach to me how the free market is great and solves all your problems.

TCM 9y ago
The NY Attorney general is looking into the situation now. https://www.nytimes.com/2017/09/08/business/equifax.html?rref=collection%2Fsectioncollection%2Fbusiness&action=click&contentCollection=business&region=rank&module=package&version=highlights&contentPlacement=2&pgtype=sectionfront https://www.nytimes.com/2017/09/08/business/equifax.html?rre...
- slouch 9y ago
  PA to lead the investigation https://twitter.com/PAAttorneyGen/status/906244506844110848 https://twitter.com/PAAttorneyGen/status/906244506844110848
paulddraper 9y ago
> how aren't there already federal agents searching every square inch of the company Usually reserved for criminal cases, not civil ones. > regulation in the way the data can be stored and processed Have it. > regular checks need to be conducted to ensure their adherence Have it. > I can already hear Americans preach to me how the free market is great and solves all your problems. Please quote me the "solve all your problems" source.
- Misker 9y ago
  > Usually reserved for criminal cases Is this not? If that's the case I need to get out of this dumpster fire of a country.
  - paulddraper 9y ago
    IDK whether it has the potential to be, but that's how it currently stands. I can tell because criminal cases are prosecuted by the state; civil cases are prosecuted by private parties. (And class action is always civil.) But by all means, move to somewhere less dumpster-firey where large businesses and governments don't get hacked.
    - xrange 9y ago
      Just to make sure that we aren't all talking past each other... 1. I assume the FBI is investigating the hack itself (who did it, etc.). Citation? 2. I assume the SEC is investigating the suspicious timing the executives who were selling stock before the announcement. I'd also assume it could turn into a criminal investigation. Cite? 3. The class action suit is a civil action asserting that Equifax was negligent (that's what the Bloomberg article that these comments are currently pointing to is about). 4. There could be criminal negligence in securing their networks. It seems like that could be either of a Federal or state issue. Anyone know if this investigation would take place with the FBI, or if there is another federal agency which would take the lead on that?
whalesalad 9y ago
Don't conflate the free market with zero regulation.
- okreallywtf 9y ago
  Maybe not but in every free market argument I've seen, the regulations that free market purists are willing to acknowledge are hazy at best, most likely because they will never need to be implemented because such a system will never exist. Even if it did, it would eventually evolve back into our current system (I think), because I think thats how our current system evolved in the first place.
matt_kantor 9y ago
> how aren't there already federal agents searching every square inch of the company and interviewing key employees under oath? But no, nobody is securing this evidence Do we know that there aren't? Would it be public knowledge if there was an investigation?
api_or_ipa 9y ago
I think your comment can be easily interpreted as a knee-jerk criticism of American regulatory environment en mass. At best this is a straw-man, and at worse it's a hyperbolic jump to assumptions about the attack vector, existing regulations, and how you believe them to be insufficient. It's too early to know anything for sure about the breach and certainly holding pre-made assumptions prevents a more level headed, careful analysis of the facts. That being said, I agree that on the face of it, this is pretty damning evidence that regulations were either not in place, or were not verified to an acceptable level.
- bsenftner 9y ago
  Finance industry regulation is a joke in the USA. It's largely self monitoring based! http://scholarship.law.cornell.edu/cgi/viewcontent.cgi?article=2489&context=facpub http://scholarship.law.cornell.edu/cgi/viewcontent.cgi?artic...
  - api_or_ipa 9y ago
    It's not the thing he/she said, it's how he/she said it. Interestingly, Canada's financial industry is also mostly self-regulated which has always struck me as a foolish model.
devy 9y ago
No amount of governmental regulations can solve the current date breach trends. Even government's own intel agencies got hacked too. No organization is immune to data breaches. It's a matter of time and effort. A lot of us here are engineers and coders. It's our responsibility to design better architecture, security conscious protocols and write securer softwares. And it's up to all of us (regardless which country you are in) to voice up and resist the idea of weakening encryption or allowing backdoors and instead advocate for adopting better and more securer encryptions to safeguard private and sensitive personal information.
- orf 9y ago
  Sure, in a fantasy land. If you where to hold the management criminally responsible for their lack of investment in IT, security etc you might see increased investment. The very fact that all this data was accessed from their public site is very troubling. What's the chances this is a basic SQL injection issue? What's the chances they didn't invest in security at all?
  - beepboopbeep 9y ago
    High. And they won't be the only agency. I guarantee you we'll hear from the other 2 in the next month or so. Because people aren't held criminally responsible for the security of user data, so why give a shit?
  - jjeaff 9y ago
    My guess is they paid an 3rd party bs service to "scan" their site for vulnerabilities.
  - devy 9y ago
    > If you where (sic) to hold the management criminally responsible for their lack of investment in IT, security etc you might see increased investment. What makes you think lack of investment in IT & security is the main reason they get hacked? Vice versa, NSA has virtually unlimited (let's just say unlimited means tens of billion dollars) budget invested in IT and security. They have the top resources there too. Do they immune from data breaches and being hacked? The answer is a big NO!
gricardo99 9y ago
If there was insider trading on the breach information, they'll be in the slammer soon enough. It would be pretty stupid, considering how easy it would be to get caught, and to avoid a mere ~14% decline on your share value? Yes, people can be stupid and greedy. I guess we'll see if this applies to these execs.
- carapace 9y ago
  And we already know they are stupid and greedy because of the hack.
aresant 9y ago
"Then the executives sold their stock a day before they announced the hack to the public." Selling stock the day before the news makes these guys seem like absolute criminals, but (a) it's not what happened and (b) the soundbyte doesn't represent what is likely the case. The reality: - Breach happened between March - July 2017 - Breach detected July 29th (A Saturday) - Executives sold stock August 1 (A Tuesday) - Breach announced September 9th (5 weeks later) From the company's own statement, which you can BET was vetted by a lot of attorneys: "Equifax discovered the unauthorized access on July 29 of this year and acted immediately to stop the intrusion. The company promptly engaged a leading, independent cybersecurity firm that has been conducting a comprehensive forensic review to determine the scope of the intrusion, including the specific data impacted." I would bet, dollars to donuts, this is just terrible timing optically for the executives. What is much more likely reality is that they detect breaches on a regular basis, and until the forensic team came back with the bombshell - likely many weeks later - of the scope of the data loss, the executives were not even informed.
- dclowd9901 9y ago
  The sales were unplanned, meaning they weren't entered per the usual stock sale cycle. If that's not evidence enough of at least insider trading, coupled with your timeline, I don't know what is.
- dagenleg 9y ago
  July 29 < August 1 < September 9 I don't see anything exonerating in the timeline you described. You are making assumptions here that could excuse the executives if they were true. These are nothing but assumptions though.
- Top19 9y ago
  I'm reading a book now call "Liquidated: an Ethnography of Wall Street" by Karen Ho from Princeton. There is this incredible part at the beginning of the book where the Vice Presidents of Goldman Sachs are training the incoming group of Junior Analysts who have all just graduated MBA school, telling them how to treat the executives of the companies they are going to be analyzing. They make them shout over and over "MANAGEMENT ALWAYS LIES, MANAGEMENT ALWAYS LIES, MANAGEMENT ALWAYS LIES". That scene took place in the early 90's, and I can't imagine anyone thinks it's gotten better in regards to the ethics of top management, their understanding of technology, or their desire to participate in insider training.
ams6110 9y ago
At least they aren't "too big to fail" since there are two other major credit bureaus doing basically the same thing they do.
dang 9y ago
> I can already hear Americans preach to me how the free market is great and solves all your problems. This sort of nationalistic flamebait (pro or con, doesn't matter) breaks this site's rules. Would you please read them and follow them when commenting here? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html On HN we're hoping for at least a slightly higher standard of civility than is common on the internet. Given how strong the forces of polarization (of all kinds) have been as of late, that's something we need everybody here to pitch in with.
timzentu 9y ago
That isn't the only thing that needs to be done. We need to make a new SSN system that is based on Public Key Crypto. Make 2 keys, one fully private stored offline completely by the government, one for us that we then use to create multiple hashes based on what we are doing. 1 for taxes, 1 for loans, 1 for SSN info, 1 for voting (so we can sign for our online voting), 1 for proof of work, etc. then when someone steals our info we can axe a key for that form, and create a new one. the primary key that we hold can't be changed without our knowledge, but in the case that our info is breached, and we lose either of the keys we then go to a government office and verify fully (with a few keys that had already been used and then get a new one. In the case of a bank breach though, we could just kill the existing one and change it at a local branch or online if we trusted that.

TCM 9y ago

The NY Attorney general is looking into the situation now. https://www.nytimes.com/2017/09/08/business/equifax.html?rref=collection%2Fsectioncollection%2Fbusiness&action=click&contentCollection=business&region=rank&module=package&version=highlights&contentPlacement=2&pgtype=sectionfront https://www.nytimes.com/2017/09/08/business/equifax.html?rre...

slouch 9y ago
PA to lead the investigation https://twitter.com/PAAttorneyGen/status/906244506844110848 https://twitter.com/PAAttorneyGen/status/906244506844110848

paulddraper 9y ago

> how aren't there already federal agents searching every square inch of the company Usually reserved for criminal cases, not civil ones. > regulation in the way the data can be stored and processed Have it. > regular checks need to be conducted to ensure their adherence Have it. > I can already hear Americans preach to me how the free market is great and solves all your problems. Please quote me the "solve all your problems" source.

Misker 9y ago
> Usually reserved for criminal cases Is this not? If that's the case I need to get out of this dumpster fire of a country.
- paulddraper 9y ago
  IDK whether it has the potential to be, but that's how it currently stands. I can tell because criminal cases are prosecuted by the state; civil cases are prosecuted by private parties. (And class action is always civil.) But by all means, move to somewhere less dumpster-firey where large businesses and governments don't get hacked.
  - xrange 9y ago
    Just to make sure that we aren't all talking past each other... 1. I assume the FBI is investigating the hack itself (who did it, etc.). Citation? 2. I assume the SEC is investigating the suspicious timing the executives who were selling stock before the announcement. I'd also assume it could turn into a criminal investigation. Cite? 3. The class action suit is a civil action asserting that Equifax was negligent (that's what the Bloomberg article that these comments are currently pointing to is about). 4. There could be criminal negligence in securing their networks. It seems like that could be either of a Federal or state issue. Anyone know if this investigation would take place with the FBI, or if there is another federal agency which would take the lead on that?

whalesalad 9y ago

Don't conflate the free market with zero regulation.

okreallywtf 9y ago
Maybe not but in every free market argument I've seen, the regulations that free market purists are willing to acknowledge are hazy at best, most likely because they will never need to be implemented because such a system will never exist. Even if it did, it would eventually evolve back into our current system (I think), because I think thats how our current system evolved in the first place.

matt_kantor 9y ago

> how aren't there already federal agents searching every square inch of the company and interviewing key employees under oath? But no, nobody is securing this evidence Do we know that there aren't? Would it be public knowledge if there was an investigation?

api_or_ipa 9y ago

I think your comment can be easily interpreted as a knee-jerk criticism of American regulatory environment en mass. At best this is a straw-man, and at worse it's a hyperbolic jump to assumptions about the attack vector, existing regulations, and how you believe them to be insufficient. It's too early to know anything for sure about the breach and certainly holding pre-made assumptions prevents a more level headed, careful analysis of the facts. That being said, I agree that on the face of it, this is pretty damning evidence that regulations were either not in place, or were not verified to an acceptable level.

bsenftner 9y ago
Finance industry regulation is a joke in the USA. It's largely self monitoring based! http://scholarship.law.cornell.edu/cgi/viewcontent.cgi?article=2489&context=facpub http://scholarship.law.cornell.edu/cgi/viewcontent.cgi?artic...
- api_or_ipa 9y ago
  It's not the thing he/she said, it's how he/she said it. Interestingly, Canada's financial industry is also mostly self-regulated which has always struck me as a foolish model.

devy 9y ago

No amount of governmental regulations can solve the current date breach trends. Even government's own intel agencies got hacked too. No organization is immune to data breaches. It's a matter of time and effort. A lot of us here are engineers and coders. It's our responsibility to design better architecture, security conscious protocols and write securer softwares. And it's up to all of us (regardless which country you are in) to voice up and resist the idea of weakening encryption or allowing backdoors and instead advocate for adopting better and more securer encryptions to safeguard private and sensitive personal information.

orf 9y ago
Sure, in a fantasy land. If you where to hold the management criminally responsible for their lack of investment in IT, security etc you might see increased investment. The very fact that all this data was accessed from their public site is very troubling. What's the chances this is a basic SQL injection issue? What's the chances they didn't invest in security at all?
- beepboopbeep 9y ago
  High. And they won't be the only agency. I guarantee you we'll hear from the other 2 in the next month or so. Because people aren't held criminally responsible for the security of user data, so why give a shit?
- jjeaff 9y ago
  My guess is they paid an 3rd party bs service to "scan" their site for vulnerabilities.
- devy 9y ago
  > If you where (sic) to hold the management criminally responsible for their lack of investment in IT, security etc you might see increased investment. What makes you think lack of investment in IT & security is the main reason they get hacked? Vice versa, NSA has virtually unlimited (let's just say unlimited means tens of billion dollars) budget invested in IT and security. They have the top resources there too. Do they immune from data breaches and being hacked? The answer is a big NO!

gricardo99 9y ago

If there was insider trading on the breach information, they'll be in the slammer soon enough. It would be pretty stupid, considering how easy it would be to get caught, and to avoid a mere ~14% decline on your share value? Yes, people can be stupid and greedy. I guess we'll see if this applies to these execs.

carapace 9y ago
And we already know they are stupid and greedy because of the hack.

aresant 9y ago

"Then the executives sold their stock a day before they announced the hack to the public." Selling stock the day before the news makes these guys seem like absolute criminals, but (a) it's not what happened and (b) the soundbyte doesn't represent what is likely the case. The reality: - Breach happened between March - July 2017 - Breach detected July 29th (A Saturday) - Executives sold stock August 1 (A Tuesday) - Breach announced September 9th (5 weeks later) From the company's own statement, which you can BET was vetted by a lot of attorneys: "Equifax discovered the unauthorized access on July 29 of this year and acted immediately to stop the intrusion. The company promptly engaged a leading, independent cybersecurity firm that has been conducting a comprehensive forensic review to determine the scope of the intrusion, including the specific data impacted." I would bet, dollars to donuts, this is just terrible timing optically for the executives. What is much more likely reality is that they detect breaches on a regular basis, and until the forensic team came back with the bombshell - likely many weeks later - of the scope of the data loss, the executives were not even informed.

dclowd9901 9y ago
The sales were unplanned, meaning they weren't entered per the usual stock sale cycle. If that's not evidence enough of at least insider trading, coupled with your timeline, I don't know what is.
dagenleg 9y ago
July 29 < August 1 < September 9 I don't see anything exonerating in the timeline you described. You are making assumptions here that could excuse the executives if they were true. These are nothing but assumptions though.
Top19 9y ago
I'm reading a book now call "Liquidated: an Ethnography of Wall Street" by Karen Ho from Princeton. There is this incredible part at the beginning of the book where the Vice Presidents of Goldman Sachs are training the incoming group of Junior Analysts who have all just graduated MBA school, telling them how to treat the executives of the companies they are going to be analyzing. They make them shout over and over "MANAGEMENT ALWAYS LIES, MANAGEMENT ALWAYS LIES, MANAGEMENT ALWAYS LIES". That scene took place in the early 90's, and I can't imagine anyone thinks it's gotten better in regards to the ethics of top management, their understanding of technology, or their desire to participate in insider training.

ams6110 9y ago

At least they aren't "too big to fail" since there are two other major credit bureaus doing basically the same thing they do.

dang 9y ago

> I can already hear Americans preach to me how the free market is great and solves all your problems. This sort of nationalistic flamebait (pro or con, doesn't matter) breaks this site's rules. Would you please read them and follow them when commenting here? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html On HN we're hoping for at least a slightly higher standard of civility than is common on the internet. Given how strong the forces of polarization (of all kinds) have been as of late, that's something we need everybody here to pitch in with.

timzentu 9y ago

That isn't the only thing that needs to be done. We need to make a new SSN system that is based on Public Key Crypto. Make 2 keys, one fully private stored offline completely by the government, one for us that we then use to create multiple hashes based on what we are doing. 1 for taxes, 1 for loans, 1 for SSN info, 1 for voting (so we can sign for our online voting), 1 for proof of work, etc. then when someone steals our info we can axe a key for that form, and create a new one. the primary key that we hold can't be changed without our knowledge, but in the case that our info is breached, and we lose either of the keys we then go to a government office and verify fully (with a few keys that had already been used and then get a new one. In the case of a bank breach though, we could just kill the existing one and change it at a local branch or online if we trusted that.