9 ms·

No matter what, Equifax may tell you you’ve been impacted by the hack

217 points by zeep 9y ago

fastball 9y ago
Here is a crazy alternate theory for you guys, which I think fits all the details we have so far. 1. Equifax was never hacked. 2. Equifax accidentally deleted a substantial portion of their database. 3. Come up with a system to get the information they lost back, via a "have I been pwned?" checker. 3a. If you enter your details and they are not in their database, they assume it is one of the persons they deleted, add it to their database, and give you a "maybe hacked" message. Obviously a fictitious person would never have been in any of their databases, deleted or otherwise. So, assuming this fake person must be a deleted person, they add the info and show the "maybe hacked" message. 3b. If you enter your details and you are one of the lucky (haha) persons that were not deleted, you get a "you are safe" message. 4. Equifax gets a lot of their database they deleted back with little effort on their part. What do you think?
- Johnny555 9y ago
  If all they need is a database of basic consumer info, they could buy that list from one of the other credit reporting agencies and avoid the public scrutiny of themselves and the industry itself.
  - fastball 9y ago
    Why would one of the other two sell it to them?
    - Johnny555 9y ago
      avoid the public scrutiny of themselves and the industry They'd probably give it to them for free if that would avoid a huge public disclosure. Though the proposed scenario is impossible, if Equifax really did lose most of their database, asking users to type in their current name/address/SSN (or buying it from a competitor) wouldn't help them, the valuable data is in the credit history, and without that data, Equifax has no business, so they'll go bankrupt. Even if they asked consumers for the data, few people know all of the data that the credit agencies have on them.
    - mjcl 9y ago
      They do it now. Typically businesses only report credit information to one of the bureaus. They exchange information with each other so information eventually makes it around to all three.
- rhizome 9y ago
  If #2 is what happened, they aren't acting in their own interests by saying they were hacked. If they were hacked, that means 3rd parties have the data. If they merely deleted a database, that implies the info is gone and nobody has it. Surreptitiously recreating a database? They can get a list of SSNs from the government, what is a user going to add to that? One of their addresses? All of their previous financial activity? What do you think the database contains? Not to mention the idea that Equifax doesn't have backups.
  - fastball 9y ago
    Junior developer gone rogue then, using a hacking story to cover his tracks.
- justinclift 9y ago
  > 2. Equifax accidentally deleted a substantial portion of their database. Although most people know of stories where backups were broken, didn't work, (etc) for some reason, it would be truly mind boggling for it to be the case here. Deleting a substantial amounts of production data... seen that before (I used to be a NetBackup Admin for large places). But recovery procedures do exist, and for them not to have multiple levels of recovery available for their core mission data is extremely unlikely.
- pktgen 9y ago
  If that was the case, it would be well-known because banks would not be able to get Equifax credit reports on consumers.
- takeda 9y ago
  This is silly, because losing data would be lower outrage, and they might even purchase the data from other agencies so we wouldn't even know it happen. Also the data that leaked is not the valuable data to them. See how proudly they stated that no core databases were affected? Not giving a damn about us? What's valuable to them and to banks that use them are the actual information about our credit. If that was compromised that would kill them, because they would lose trust of their real customers (banks).
  - fastball 9y ago
    crazy alternate theory
bluetwo 9y ago
Just a note: I tried the same thing and was told my information was NOT impacted. I suspect the reason for this might be that I froze my info years ago. In some way they must be screening against people who are frozen, or I got lucky.
- newscracker 9y ago
  I read on Krebs on Security [1] that those who visited the site from a computer got one result, but also got the other when they visited from a mobile phone. Not that this might apply to you, but the results from the equifaxsecurity2017 site do not seem trustable. Quote from the article: > In the early hours after the breach announcement, the site was being flagged by various browsers as a phishing threat. In some cases, people visiting the site were told they were not affected, only to find they received a different answer when they checked the site with the same information on their mobile phones. [1]: https://gixtools.net/2017/09/equifax-breach-response-turns-dumpster-fire/ https://gixtools.net/2017/09/equifax-breach-response-turns-d...
- takeda 9y ago
  My understanding was that people who used their credit report service got affected. Perhaps after you froze you did not have a need to use it.
paul7986 9y ago
Scary their tool isn't even hosted on Equifax. I'm sure Techcrunch verified this is legit, but there's going to be a lot of similar sites shared on Facebook popping up that are similar to get your data.
ams6110 9y ago
If you read the message, it's very noncommital. You "may have been impacted" which doesn't take a position either way. They could issue that response regardless of what you type and cover all possibiliites. My guess: to account for typos, they are responding with "may have been impacted" if they get a hit on either the name or SSN, not only when there is a match on both.
cmurf 9y ago
https://trustedidpremier.com/static/terms https://trustedidpremier.com/static/terms "As specified on the website, Your membership subscription may be subject to automatic renewal. TrustedID may, in its sole discretion, terminate this Agreement (or suspend, terminate, or otherwise restrict Your use of and access to the Product) at any time, without notice." Not only can they renew you automatically (unclear what the renewal term is, plausibly the autorenew could obligate you with another year of service you'd have to pay for); but they can also cancel the service, and not inform you. So you're "protected". Maybe. You don't really know, nothing about it is transparent. What we do know, is they're bad at their job of protecting consumer credit data from people who shouldn't have it. They're not to be trusted, and therefore no good reason to agree to anything they offer.
justinclift 9y ago
With this Equifax hack, is it feasible this info release could endanger the lives of people? Specifically, having current address info released for people who that could go badly for. eg ex-partners of violent people, maybe law enforcement (?) people, etc If that's the case, then the fallout (and scrambling-to-relocate by people endangered) from it could be even more massive then so far mentioned. :/
- Johnny555 9y ago
  There are plenty of ways to look up credit report information, I don't think this hack is going to add a significant new risk. Though it'd be nice if this caused new data privacy and protection regulations. (But it won't)
  - justinclift 9y ago
    Cool. :)
Johnny555 9y ago
I entered my real information and they said I was not impacted (but still asked me to sign up for TrustedID). The same for my wife. I tried it again today to make sure the answer didn't change and it's the same as yesterday. Here's the message I got: Based on the information provided, we believe that your personal information was not impacted by this incident. Click the button below to continue your enrollment in TrustedID Premier. Maybe if they can't make a positive match against their "safe" list, they give the warning. They seem to be matching on SSN alone, I entered a completely different last name, and still was told that I'm not impacted, so maybe no one with the last 6 digits of my SSN was impacted.
calvinbhai 9y ago
So, this basically is a way for Equifax to get a mass waiver from people to make a class action lawsuit less damaging to the company. Opting out of the waiver is a long winded process of mailing a form. another funny thing is that if you sign up for their crappy product, you have to come back on a different day and complete the sign up. There wont be emails or notifications. If you forget to signup, then you have basically waived your rights to sue to company. For every SSN entered, Equifax can say in a class action lawsuit that they have waivers from all the following SSNs .... IANAL, but this looks like a sensible strategy for Equifax to save itself after screwing with people's SSNs and personal info.
- conanbatt 9y ago
  Im pretty sure lawyers would tear appart such a shitty tactic. But it will at least keep them busy.
- aptwebapps 9y ago
  This seems too overt, and related to too big an event, to work.
  - cryptocrank 9y ago
    I agree
- lobotryas 9y ago
  I'm confused. If I didn't fill out their form for TrustID, do I still need to mail some kind of form?
- hellofunk 9y ago
  Are you saying that merely by seeing if you were impacted, you are waiving your rights, even if you don't come back on the scheduled day to complete the enrollment? That sounds ridiculous. Nowhere in the simple form that they provided is there any mention of waiving any rights. Nor is there one of those standard checkboxes about "I accept the terms.." when filling out that little form.
randyrand 9y ago
considering all this information has been leaked, how on earth would they expect the people entering in their credentials to be the actual people who own the SSN! with regards to giving up their right to class action
notyourday 9y ago
So basically Equifax now is engaging in fraud on massive scale. It needs to be dealt with the same way as we dealt with this company called Arthur Anderson.
- tomrod 9y ago
  Allow them to rebrand?
  - zwerdlds 9y ago
    Hey now. Accenture is a totally different company. They have reliable analysts who do good work. /s
    - hypercluster 9y ago
      Ha interesting, didn't know of Accenture's history.
  - notyourday 9y ago
    https://en.wikipedia.org/wiki/Arthur_Andersen#Enron_scandal https://en.wikipedia.org/wiki/Arthur_Andersen#Enron_scandal
- pjc50 9y ago
  So were the robosigners, and some of them eventually (years later) got fines: http://www.marketwatch.com/story/us-breaks-down-93-bln-robo-signing-settlement-2013-02-28 http://www.marketwatch.com/story/us-breaks-down-93-bln-robo-...
khc 9y ago
Even if the information they returned was correct, do you trust them enough to enter your SSN and name anymore? Surely they will be hacked again and you will be impacted by the next hack. 1. Enter SSN 2a. Impacted by this hack 2b. Not impacted by this hack but will be impacted by next
- Johnny555 9y ago
  They already have your SSN unless you have no bank account, credit card, utilities in your name, a loan, etc. I think it'd be nearly impossible to be an adult living on your own and not have your SSN in a credit agency's database.
  - zeep 9y ago
    If you would be able to block them from buying your SSN under the current system, you would not be able to get any loans.
fastball 9y ago
This isn't a very rigorous test, and TC's assertion that this may be random is probably untrue given that the results seem to be consistent if you enter the same details multiple times. The idea that Equifax has implemented a random yet deterministic checking system seems beyond the pail of belief. If I had to guess, I would say that Equifax is not checking against a list of people that they know are compromised, but rather against a list that they know have NOT been compromised. So if you check a name, and it is in Equifax's database AND it is known to be uncompromised, you get back a "you are safe message". For everyone else they give a generic "you maybe were effected", emphasis on the "maybe". Obviously a fictional person with fictional details is not going to be in Equifax's database, so they would just throw the generic maybe message.
- sulam 9y ago
  I have 5 and 7 yr old girls. To the degree that either exists with respect to the finance industry, they both exist. Neither has credit, obviously, or any interactions with a credit agency. The only people who have their SSNs are the federal government and our health care provider, which has some very strict laws about what they can do with _any_ data they have. Equifax says the 7-yr old "may" have been affected. The 5 yr old comes back clean. This sure looks scammy.
  - ams6110 9y ago
    Sadly, "very strict laws" don't have much ability to prevent data breaches due to zero-days or simple incompetence.
    - sulam 9y ago
      Sure, but they didn't give data to a credit agency. That would require consent, and even if you assume they ignored HIPAA, if they'd done it for one daughter they'd have done it for both.
  - malnourish 9y ago
    I came back clean.
deleted 9y ago
[deleted]
nsxwolf 9y ago
I can't reproduce these results.
deleted 9y ago
[deleted]
hpcjoe 9y ago
I will be blunt, and I am very incensed by this. My comments ... https://twitter.com/hpcjoe/status/906549917509980160 https://twitter.com/hpcjoe/status/906549917509980160 This is an extinction level event for Equifax. They need to be disassembled, their stored data destroyed correctly and securely, their negligent officers charged. This isn't an accident. You don't surface 0.134 BILLION bits of PII without some sort of criminal level incompetence. Any organization that uses Equifax data in any decision making process needs to be held accountable, as there may have been earlier intrusions also undiscovered, that have altered. Which, if they then choose to use them in any decision process whatsoever, brings them liability for misuse of possibly tampered with data. I am quite serious when I say that Equifax should cease to exist as a result of this. All others should be audited for security, and audited hard. Again, not being hyperbolic. But quite direct, with appropriate levels of anger at Equifax.
- programbreeding 9y ago
  It's (unfortunately) far more likely that they'll simply re-brand as something else. For all intents and purposes, Equifax will cease to exist; except it will be exactly the same thing under a different name.
- coliveira 9y ago
  I agree completely. The only reason for this company to exist is to maintain the data that now is compromised. This company needs to be brought down as quickly as possible for everyone's safety, and the other two companies need to be seriously monitored.
- cmurf 9y ago
  The department of justice should break them. This is their job. But this is a government with a grifter at the top, so I have almost no confidence attorney general Sessions will investigate this seriously, let alone destroy the company. He very clearly enjoys targeting e.g. black people who smoke weed with incarceration, destroying their lives, than punishing Equifax's officers, board, or shareholders with destruction. I have more confidence in a handful of state attorneys general working on this effort.
- 9y ago
c3534l 9y ago
Given the fact that every other week some company gets hacked and leaks data on customers they shouldn't have been keeping in the first place, I'm looking forward to some court precedent being set. I don't know why the Equifax leak is getting all the attention and hate when https://haveibeenpwned.com/ https://haveibeenpwned.com/ discloses a major hack constantly, but it'd be great if companies were held financially responsible for security carelessness and improper disclosure.
johnnyb9 9y ago
Someone comments in TFA that Equifax likely gives random results to garbage inputs to deter criminals from using it as a way to validate data.
companyhen 9y ago
I keep seeing people say Blockchain technology would prevent this type of hack. True?
- mbillie1 9y ago
  Blockchain technology would prevent a web app vulnerability? What on earth?
  - companyhen 9y ago
    I was wondering the same.. just what I saw some of the crypto people I follow on Twitter say.
Kiro 9y ago
In Sweden your social security number is public information. What's the reason for it being private in the US? Sounds like a horrible thing to rely on for security anyway.
- mmagin 9y ago
  The banking industry decided to, in effect, use it as an authentication token. Even though it was stated that it should not be used for such.
  - Terr_ 9y ago
    And then, when their shitty "easy signups" authentication is exploited, they attempt to reframe the flaw as the individual's identity being stolen, rather than the bank being negligent. Relevant comedy: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- unit91 9y ago
  In the US, a combination of personal information is taken by most as proof that you are who you claim to be. If you know enough of someone else's information, you can steal money rather easily. We need a better identity solution, but it's what we have right now.
  - literallycancer 9y ago
    There is probably no way to make that work, without improving the security. Same thing with credit cards, is it so hard to ask for a PIN when trying to pay with them? Or use 2FA like in any internet banking? For what it's worth, here in Europe you could pretend to be someone else as well, if you have enough information, but what's the point when you can't touch their money?
    - quuquuquu 9y ago
      What do you mean by, "you can't touch their money"? You can spoof their identity, to instantly acquire material goods / lines of credit. And, if you are extremely persistent, you can spoof identity documents and hack bank accounts.
WisNorCan 9y ago
I have now placed freezes [1] on my accounts with each of the four agencies. It is perplexing to pay $5-10 to each of these companies that have collected my data without my permission to stop the sale of that data. In particular after they have mismanaged that data and put me at risk. They will probably see a large surge in revenue based on this breach. [1] https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...
- nickthemagicman 9y ago
  Whats the fourth? I just know of Equifax, Experian, Transunion.
  - WisNorCan 9y ago
    From the New York Times [0]: In the meantime, here’s hoping that this breach is the nudge you need to finally sign up for permanent freezes on your credit files. I’ve used them for years, and here’s how they work. You sign up (and pay some fees, because you knew it wasn’t going to be free to protect data that you didn’t ask these companies to store, right?) at Equifax’s, Experian’s and TransUnion’s websites. Christina Bater, managing director at Barrett Asset Management in New York, suggests freezing your file at the little-known company Innovis, too. Hey, why not? [0] https://www.nytimes.com/2017/09/08/your-money/identity-theft/equifaxs-instructions-are-confusing-heres-what-to-do-now.html?mcubz=0 https://www.nytimes.com/2017/09/08/your-money/identity-theft...
  - seanp2k2 9y ago
    https://www.washingtonpost.com/business/economy/five-facts-about-the-fourth-bureau/2011/07/15/gIQASOcWII_story.html https://www.washingtonpost.com/business/economy/five-facts-a... There are quite a few, actually.
  - nickthemagicman 9y ago
    Thank you both!
ozpri 9y ago
"New York attorney general Eric Schneiderman has hammered Equifax for using language meant to discourage arbitration and is asking Equifax for answers over the data breach. The company has stated since it would not bar consumers from joining breach-related lawsuits." Is anyone else mortified that this is the reality? Where companies are allowed to dictate how much legal privilege we have to seek legal recourse if they legitimately screw up?
- user5994461 9y ago
  Welcome to capitalist America!
SoMisanthrope 9y ago
This title is patently false. After entering my information in the Equifax incident site, the site claimed that I and my mother were "potentially impacted". However, both my aunt and cousin were NOT "potentially impacted." While my single experience qualifies as an anecdote, I nullifies this idiotic headline.
billions 9y ago
Yet another argument for decentralization. Data monopolies have single points of failure.
peter303 9y ago
Not true. It said 'not impacted' when entered fake account and 'impacted' when I typed mine.
gsnedders 9y ago
And they have still, as far as I can tell, not communicated to anyone who the Canadian and UK affected people are; they've merely stated that there are some…
crb002 9y ago
Every attorney here in the Federal bar needs to file an emergency injunction on Monday asking the US Government cease sharing confidential bank data with Equifax until they are paid statutory damages, and Equifax posts bond large enough to cover any future data breach payout.
rayiner 9y ago
The reaction here seems pretty over the top to me. Leaking a bunch of private information is bad, I guess. As a former federal employee, my SSN/etc. were leaked in the OPM breach a couple of years ago. So far, it’s hard zero repercussions for me (or anybody else I know). There are many layers of defense mechanisms in place. It’s not like just having some numbers let’s you do whatever you want. The US banking system has a ton of human checks and balances and ways to reverse things in place. If I ever saw an unusual charge on my credit cards, I’d just get it refunded. How much actual harm is going to come out of this? My suspicion is not that much.
- k_sh 9y ago
  > If I ever saw an unusual charge on my credit cards, I’d just get it refunded. How much actual harm is going to come out of this? My suspicion is not that much. Fraudulent charges on an existing account is not the concern when someone has your SSN and other high-value information - it's the ability for someone else to open an account in your name that you have no knowledge of.
  - ChuckMcM 9y ago
    This is the thing that bites you. Someone opens a store credit card in your name, uses it enough to get the credit limit to a point where they can walk off with enough stuff to make it worthwhile. Guess who gets reported to the debt collectors? Not them, you do. And here is the really sad bit, when you tell the debt collector that its a bogus account and not you, by law they have to stop hassling you but instead of 'retiring' the debt they just resell it to another debt collector to get back some of the money they paid for it. So the cycle doesn't stop.
    - harryh 9y ago
      It's also illegal to sell a debt when the owner has knowledge that it is fraudulent.
      - ChuckMcM 9y ago
tuxxy 9y ago
Does anyone have any information about taking them to court yourself (small claims or otherwise)? This breach has affected me and as a cryptographic software engineer, I am exceptionally upset. I intend to go as far as my funds and personal knowledge will carry me.
- tonyztan 9y ago
  I submitted this a few hours ago: https://news.ycombinator.com/item?id=15207727 https://news.ycombinator.com/item?id=15207727. Basically the steps to file a small claims lawsuit.
hedora 9y ago
Where is the class action lawsuit for their intent to defraud the entire US and Canadian populations?!?

217 points by zeep 9y ago

Here is a crazy alternate theory for you guys, which I think fits all the details we have so far. 1. Equifax was never hacked. 2. Equifax accidentally deleted a substantial portion of their database. 3. Come up with a system to get the information they lost back, via a "have I been pwned?" checker. 3a. If you enter your details and they are not in their database, they assume it is one of the persons they deleted, add it to their database, and give you a "maybe hacked" message. Obviously a fictitious person would never have been in any of their databases, deleted or otherwise. So, assuming this fake person must be a deleted person, they add the info and show the "maybe hacked" message. 3b. If you enter your details and you are one of the lucky (haha) persons that were not deleted, you get a "you are safe" message. 4. Equifax gets a lot of their database they deleted back with little effort on their part. What do you think?

Johnny555 9y ago
If all they need is a database of basic consumer info, they could buy that list from one of the other credit reporting agencies and avoid the public scrutiny of themselves and the industry itself.
- fastball 9y ago
  Why would one of the other two sell it to them?
  - Johnny555 9y ago
    avoid the public scrutiny of themselves and the industry They'd probably give it to them for free if that would avoid a huge public disclosure. Though the proposed scenario is impossible, if Equifax really did lose most of their database, asking users to type in their current name/address/SSN (or buying it from a competitor) wouldn't help them, the valuable data is in the credit history, and without that data, Equifax has no business, so they'll go bankrupt. Even if they asked consumers for the data, few people know all of the data that the credit agencies have on them.
  - mjcl 9y ago
    They do it now. Typically businesses only report credit information to one of the bureaus. They exchange information with each other so information eventually makes it around to all three.
rhizome 9y ago
If #2 is what happened, they aren't acting in their own interests by saying they were hacked. If they were hacked, that means 3rd parties have the data. If they merely deleted a database, that implies the info is gone and nobody has it. Surreptitiously recreating a database? They can get a list of SSNs from the government, what is a user going to add to that? One of their addresses? All of their previous financial activity? What do you think the database contains? Not to mention the idea that Equifax doesn't have backups.
- fastball 9y ago
  Junior developer gone rogue then, using a hacking story to cover his tracks.
justinclift 9y ago
> 2. Equifax accidentally deleted a substantial portion of their database. Although most people know of stories where backups were broken, didn't work, (etc) for some reason, it would be truly mind boggling for it to be the case here. Deleting a substantial amounts of production data... seen that before (I used to be a NetBackup Admin for large places). But recovery procedures do exist, and for them not to have multiple levels of recovery available for their core mission data is extremely unlikely.
pktgen 9y ago
If that was the case, it would be well-known because banks would not be able to get Equifax credit reports on consumers.
takeda 9y ago
This is silly, because losing data would be lower outrage, and they might even purchase the data from other agencies so we wouldn't even know it happen. Also the data that leaked is not the valuable data to them. See how proudly they stated that no core databases were affected? Not giving a damn about us? What's valuable to them and to banks that use them are the actual information about our credit. If that was compromised that would kill them, because they would lose trust of their real customers (banks).
- fastball 9y ago
  crazy alternate theory

bluetwo 9y ago

Just a note: I tried the same thing and was told my information was NOT impacted. I suspect the reason for this might be that I froze my info years ago. In some way they must be screening against people who are frozen, or I got lucky.

newscracker 9y ago
I read on Krebs on Security [1] that those who visited the site from a computer got one result, but also got the other when they visited from a mobile phone. Not that this might apply to you, but the results from the equifaxsecurity2017 site do not seem trustable. Quote from the article: > In the early hours after the breach announcement, the site was being flagged by various browsers as a phishing threat. In some cases, people visiting the site were told they were not affected, only to find they received a different answer when they checked the site with the same information on their mobile phones. [1]: https://gixtools.net/2017/09/equifax-breach-response-turns-dumpster-fire/ https://gixtools.net/2017/09/equifax-breach-response-turns-d...
takeda 9y ago
My understanding was that people who used their credit report service got affected. Perhaps after you froze you did not have a need to use it.

paul7986 9y ago

Scary their tool isn't even hosted on Equifax. I'm sure Techcrunch verified this is legit, but there's going to be a lot of similar sites shared on Facebook popping up that are similar to get your data.

ams6110 9y ago

If you read the message, it's very noncommital. You "may have been impacted" which doesn't take a position either way. They could issue that response regardless of what you type and cover all possibiliites. My guess: to account for typos, they are responding with "may have been impacted" if they get a hit on either the name or SSN, not only when there is a match on both.

cmurf 9y ago

https://trustedidpremier.com/static/terms https://trustedidpremier.com/static/terms "As specified on the website, Your membership subscription may be subject to automatic renewal. TrustedID may, in its sole discretion, terminate this Agreement (or suspend, terminate, or otherwise restrict Your use of and access to the Product) at any time, without notice." Not only can they renew you automatically (unclear what the renewal term is, plausibly the autorenew could obligate you with another year of service you'd have to pay for); but they can also cancel the service, and not inform you. So you're "protected". Maybe. You don't really know, nothing about it is transparent. What we do know, is they're bad at their job of protecting consumer credit data from people who shouldn't have it. They're not to be trusted, and therefore no good reason to agree to anything they offer.

justinclift 9y ago

With this Equifax hack, is it feasible this info release could endanger the lives of people? Specifically, having current address info released for people who that could go badly for. eg ex-partners of violent people, maybe law enforcement (?) people, etc If that's the case, then the fallout (and scrambling-to-relocate by people endangered) from it could be even more massive then so far mentioned. :/

Johnny555 9y ago
There are plenty of ways to look up credit report information, I don't think this hack is going to add a significant new risk. Though it'd be nice if this caused new data privacy and protection regulations. (But it won't)
- justinclift 9y ago
  Cool. :)

Johnny555 9y ago

I entered my real information and they said I was not impacted (but still asked me to sign up for TrustedID). The same for my wife. I tried it again today to make sure the answer didn't change and it's the same as yesterday. Here's the message I got: Based on the information provided, we believe that your personal information was not impacted by this incident. Click the button below to continue your enrollment in TrustedID Premier. Maybe if they can't make a positive match against their "safe" list, they give the warning. They seem to be matching on SSN alone, I entered a completely different last name, and still was told that I'm not impacted, so maybe no one with the last 6 digits of my SSN was impacted.

calvinbhai 9y ago

So, this basically is a way for Equifax to get a mass waiver from people to make a class action lawsuit less damaging to the company. Opting out of the waiver is a long winded process of mailing a form. another funny thing is that if you sign up for their crappy product, you have to come back on a different day and complete the sign up. There wont be emails or notifications. If you forget to signup, then you have basically waived your rights to sue to company. For every SSN entered, Equifax can say in a class action lawsuit that they have waivers from all the following SSNs .... IANAL, but this looks like a sensible strategy for Equifax to save itself after screwing with people's SSNs and personal info.

conanbatt 9y ago
Im pretty sure lawyers would tear appart such a shitty tactic. But it will at least keep them busy.
aptwebapps 9y ago
This seems too overt, and related to too big an event, to work.
- cryptocrank 9y ago
  I agree
lobotryas 9y ago
I'm confused. If I didn't fill out their form for TrustID, do I still need to mail some kind of form?
hellofunk 9y ago
Are you saying that merely by seeing if you were impacted, you are waiving your rights, even if you don't come back on the scheduled day to complete the enrollment? That sounds ridiculous. Nowhere in the simple form that they provided is there any mention of waiving any rights. Nor is there one of those standard checkboxes about "I accept the terms.." when filling out that little form.

randyrand 9y ago

considering all this information has been leaked, how on earth would they expect the people entering in their credentials to be the actual people who own the SSN! with regards to giving up their right to class action

notyourday 9y ago

So basically Equifax now is engaging in fraud on massive scale. It needs to be dealt with the same way as we dealt with this company called Arthur Anderson.

tomrod 9y ago
Allow them to rebrand?
- zwerdlds 9y ago
  Hey now. Accenture is a totally different company. They have reliable analysts who do good work. /s
  - hypercluster 9y ago
    Ha interesting, didn't know of Accenture's history.
- notyourday 9y ago
  https://en.wikipedia.org/wiki/Arthur_Andersen#Enron_scandal https://en.wikipedia.org/wiki/Arthur_Andersen#Enron_scandal
pjc50 9y ago
So were the robosigners, and some of them eventually (years later) got fines: http://www.marketwatch.com/story/us-breaks-down-93-bln-robo-signing-settlement-2013-02-28 http://www.marketwatch.com/story/us-breaks-down-93-bln-robo-...

khc 9y ago

Even if the information they returned was correct, do you trust them enough to enter your SSN and name anymore? Surely they will be hacked again and you will be impacted by the next hack. 1. Enter SSN 2a. Impacted by this hack 2b. Not impacted by this hack but will be impacted by next

Johnny555 9y ago
They already have your SSN unless you have no bank account, credit card, utilities in your name, a loan, etc. I think it'd be nearly impossible to be an adult living on your own and not have your SSN in a credit agency's database.
- zeep 9y ago
  If you would be able to block them from buying your SSN under the current system, you would not be able to get any loans.

fastball 9y ago

This isn't a very rigorous test, and TC's assertion that this may be random is probably untrue given that the results seem to be consistent if you enter the same details multiple times. The idea that Equifax has implemented a random yet deterministic checking system seems beyond the pail of belief. If I had to guess, I would say that Equifax is not checking against a list of people that they know are compromised, but rather against a list that they know have NOT been compromised. So if you check a name, and it is in Equifax's database AND it is known to be uncompromised, you get back a "you are safe message". For everyone else they give a generic "you maybe were effected", emphasis on the "maybe". Obviously a fictional person with fictional details is not going to be in Equifax's database, so they would just throw the generic maybe message.

sulam 9y ago
I have 5 and 7 yr old girls. To the degree that either exists with respect to the finance industry, they both exist. Neither has credit, obviously, or any interactions with a credit agency. The only people who have their SSNs are the federal government and our health care provider, which has some very strict laws about what they can do with _any_ data they have. Equifax says the 7-yr old "may" have been affected. The 5 yr old comes back clean. This sure looks scammy.
- ams6110 9y ago
  Sadly, "very strict laws" don't have much ability to prevent data breaches due to zero-days or simple incompetence.
  - sulam 9y ago
    Sure, but they didn't give data to a credit agency. That would require consent, and even if you assume they ignored HIPAA, if they'd done it for one daughter they'd have done it for both.
- malnourish 9y ago
  I came back clean.

deleted 9y ago

[deleted]

nsxwolf 9y ago

I can't reproduce these results.

deleted 9y ago

[deleted]

hpcjoe 9y ago

I will be blunt, and I am very incensed by this. My comments ... https://twitter.com/hpcjoe/status/906549917509980160 https://twitter.com/hpcjoe/status/906549917509980160 This is an extinction level event for Equifax. They need to be disassembled, their stored data destroyed correctly and securely, their negligent officers charged. This isn't an accident. You don't surface 0.134 BILLION bits of PII without some sort of criminal level incompetence. Any organization that uses Equifax data in any decision making process needs to be held accountable, as there may have been earlier intrusions also undiscovered, that have altered. Which, if they then choose to use them in any decision process whatsoever, brings them liability for misuse of possibly tampered with data. I am quite serious when I say that Equifax should cease to exist as a result of this. All others should be audited for security, and audited hard. Again, not being hyperbolic. But quite direct, with appropriate levels of anger at Equifax.

programbreeding 9y ago
It's (unfortunately) far more likely that they'll simply re-brand as something else. For all intents and purposes, Equifax will cease to exist; except it will be exactly the same thing under a different name.
coliveira 9y ago
I agree completely. The only reason for this company to exist is to maintain the data that now is compromised. This company needs to be brought down as quickly as possible for everyone's safety, and the other two companies need to be seriously monitored.
cmurf 9y ago
The department of justice should break them. This is their job. But this is a government with a grifter at the top, so I have almost no confidence attorney general Sessions will investigate this seriously, let alone destroy the company. He very clearly enjoys targeting e.g. black people who smoke weed with incarceration, destroying their lives, than punishing Equifax's officers, board, or shareholders with destruction. I have more confidence in a handful of state attorneys general working on this effort.
9y ago

c3534l 9y ago

Given the fact that every other week some company gets hacked and leaks data on customers they shouldn't have been keeping in the first place, I'm looking forward to some court precedent being set. I don't know why the Equifax leak is getting all the attention and hate when https://haveibeenpwned.com/ https://haveibeenpwned.com/ discloses a major hack constantly, but it'd be great if companies were held financially responsible for security carelessness and improper disclosure.

johnnyb9 9y ago

Someone comments in TFA that Equifax likely gives random results to garbage inputs to deter criminals from using it as a way to validate data.

companyhen 9y ago

I keep seeing people say Blockchain technology would prevent this type of hack. True?

mbillie1 9y ago
Blockchain technology would prevent a web app vulnerability? What on earth?
- companyhen 9y ago
  I was wondering the same.. just what I saw some of the crypto people I follow on Twitter say.

Kiro 9y ago

In Sweden your social security number is public information. What's the reason for it being private in the US? Sounds like a horrible thing to rely on for security anyway.

mmagin 9y ago
The banking industry decided to, in effect, use it as an authentication token. Even though it was stated that it should not be used for such.
- Terr_ 9y ago
  And then, when their shitty "easy signups" authentication is exploited, they attempt to reframe the flaw as the individual's identity being stolen, rather than the bank being negligent. Relevant comedy: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
unit91 9y ago
In the US, a combination of personal information is taken by most as proof that you are who you claim to be. If you know enough of someone else's information, you can steal money rather easily. We need a better identity solution, but it's what we have right now.
- literallycancer 9y ago
  There is probably no way to make that work, without improving the security. Same thing with credit cards, is it so hard to ask for a PIN when trying to pay with them? Or use 2FA like in any internet banking? For what it's worth, here in Europe you could pretend to be someone else as well, if you have enough information, but what's the point when you can't touch their money?
  - quuquuquu 9y ago
    What do you mean by, "you can't touch their money"? You can spoof their identity, to instantly acquire material goods / lines of credit. And, if you are extremely persistent, you can spoof identity documents and hack bank accounts.

WisNorCan 9y ago

I have now placed freezes [1] on my accounts with each of the four agencies. It is perplexing to pay $5-10 to each of these companies that have collected my data without my permission to stop the sale of that data. In particular after they have mismanaged that data and put me at risk. They will probably see a large surge in revenue based on this breach. [1] https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...

nickthemagicman 9y ago
Whats the fourth? I just know of Equifax, Experian, Transunion.
- WisNorCan 9y ago
  From the New York Times [0]: In the meantime, here’s hoping that this breach is the nudge you need to finally sign up for permanent freezes on your credit files. I’ve used them for years, and here’s how they work. You sign up (and pay some fees, because you knew it wasn’t going to be free to protect data that you didn’t ask these companies to store, right?) at Equifax’s, Experian’s and TransUnion’s websites. Christina Bater, managing director at Barrett Asset Management in New York, suggests freezing your file at the little-known company Innovis, too. Hey, why not? [0] https://www.nytimes.com/2017/09/08/your-money/identity-theft/equifaxs-instructions-are-confusing-heres-what-to-do-now.html?mcubz=0 https://www.nytimes.com/2017/09/08/your-money/identity-theft...
- seanp2k2 9y ago
  https://www.washingtonpost.com/business/economy/five-facts-about-the-fourth-bureau/2011/07/15/gIQASOcWII_story.html https://www.washingtonpost.com/business/economy/five-facts-a... There are quite a few, actually.
- nickthemagicman 9y ago
  Thank you both!

ozpri 9y ago

"New York attorney general Eric Schneiderman has hammered Equifax for using language meant to discourage arbitration and is asking Equifax for answers over the data breach. The company has stated since it would not bar consumers from joining breach-related lawsuits." Is anyone else mortified that this is the reality? Where companies are allowed to dictate how much legal privilege we have to seek legal recourse if they legitimately screw up?

user5994461 9y ago
Welcome to capitalist America!

SoMisanthrope 9y ago

This title is patently false. After entering my information in the Equifax incident site, the site claimed that I and my mother were "potentially impacted". However, both my aunt and cousin were NOT "potentially impacted." While my single experience qualifies as an anecdote, I nullifies this idiotic headline.

billions 9y ago

Yet another argument for decentralization. Data monopolies have single points of failure.

peter303 9y ago

Not true. It said 'not impacted' when entered fake account and 'impacted' when I typed mine.

gsnedders 9y ago

And they have still, as far as I can tell, not communicated to anyone who the Canadian and UK affected people are; they've merely stated that there are some…

crb002 9y ago

Every attorney here in the Federal bar needs to file an emergency injunction on Monday asking the US Government cease sharing confidential bank data with Equifax until they are paid statutory damages, and Equifax posts bond large enough to cover any future data breach payout.

rayiner 9y ago

The reaction here seems pretty over the top to me. Leaking a bunch of private information is bad, I guess. As a former federal employee, my SSN/etc. were leaked in the OPM breach a couple of years ago. So far, it’s hard zero repercussions for me (or anybody else I know). There are many layers of defense mechanisms in place. It’s not like just having some numbers let’s you do whatever you want. The US banking system has a ton of human checks and balances and ways to reverse things in place. If I ever saw an unusual charge on my credit cards, I’d just get it refunded. How much actual harm is going to come out of this? My suspicion is not that much.

k_sh 9y ago
> If I ever saw an unusual charge on my credit cards, I’d just get it refunded. How much actual harm is going to come out of this? My suspicion is not that much. Fraudulent charges on an existing account is not the concern when someone has your SSN and other high-value information - it's the ability for someone else to open an account in your name that you have no knowledge of.
- ChuckMcM 9y ago
  This is the thing that bites you. Someone opens a store credit card in your name, uses it enough to get the credit limit to a point where they can walk off with enough stuff to make it worthwhile. Guess who gets reported to the debt collectors? Not them, you do. And here is the really sad bit, when you tell the debt collector that its a bogus account and not you, by law they have to stop hassling you but instead of 'retiring' the debt they just resell it to another debt collector to get back some of the money they paid for it. So the cycle doesn't stop.
  - harryh 9y ago
    It's also illegal to sell a debt when the owner has knowledge that it is fraudulent.
    - ChuckMcM 9y ago

tuxxy 9y ago

Does anyone have any information about taking them to court yourself (small claims or otherwise)? This breach has affected me and as a cryptographic software engineer, I am exceptionally upset. I intend to go as far as my funds and personal knowledge will carry me.

tonyztan 9y ago
I submitted this a few hours ago: https://news.ycombinator.com/item?id=15207727 https://news.ycombinator.com/item?id=15207727. Basically the steps to file a small claims lawsuit.

hedora 9y ago

Where is the class action lawsuit for their intent to defraud the entire US and Canadian populations?!?