19 ms·
Equihax
- sschueller 9y agoIs those Donald Trump, Kim Kardashian and Bill Gates real SS numbers?
- blakesterz 9y agoLooks like it COULD BE, those first three numbers are in the range of someone from NY and someone from CA. https://en.wikipedia.org/wiki/List_of_Social_Security_Area_Numbers https://en.wikipedia.org/wiki/List_of_Social_Security_Area_N...
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- pbadenski 9y agoThese seem to have been leaked before [1, 2], so that's not very conclusive... [1] https://www.facebook.com/HydraHackingUnited/posts/961497543923573 https://www.facebook.com/HydraHackingUnited/posts/9614975439... (November 24, 2015) [2] http://www.jeuxvideo.com/forums/1-50-138814262-1-0-1-0-qui-se-souvient-des-hackers-qui-ont-divu.htm http://www.jeuxvideo.com/forums/1-50-138814262-1-0-1-0-qui-s... (June 20, 2013)
- prophesi 9y agoThe third one in the screenshot seems to be for Bill Gates, though it's conveniently cut-off. Has that also been in a previous leak?
- pbadenski 9y agoThere are results showing up on the web, eg. here: http://www.techjamaica.com/forums/showthread.php?110860-Bill-Gates-s-SSN-address-credit-report-and-more-published-by-hackers http://www.techjamaica.com/forums/showthread.php?110860-Bill...
- msumpter 9y agoDunno why, but just surprised that Kim K's credit score with Equifax is 643. Unrelated, sorry.
- blakesterz 9y agoNo, I actually thought the same thing, which made me think maybe this isn't real? That number seems really low, doesn't it?
- tyingq 9y agoI wouldn't be that surprised that she would miss lots of consecutive payments. Not because she didn't have the money, but because she doesn't care. 3 late payments in a row on a mortgage, credit card, etc, drags down your score a lot. Or perhaps she had little credit history. I could see a scenario where most of her stuff is financed through an LLC vs her personal credit. If your business is solely "being popular", almost everything is a business expense :)
- jlgaddis 9y agoI doubt she's sitting down once a week or so and paying any bills. I imagine somebody else does that for her.
- tyingq 9y agoPlenty of celebs are late payers. Whether that's because they pay bills themselves, or just fail to route stuff to their accountants, I have no idea. There's more than one embarrassing car repo celeb picture floating around.
- pbarnes_1 9y agoAuto pay is not hard to set up. This data is questionable anyway.
- zaptheimpaler 9y agoGoes to show how silly credit scores are
- wyldfire 9y agoIt's only ~$14k USD for us to buy 1 mil entries. Maybe we could crowd fund it and see how real it is?
- pavel_lishin 9y agoWhy not buy a single entry - yourself - to verify? I don't particularly want to give these guys $14k.
- sschueller 9y ago600 BTC = ~2,111,994 USD
- pc86 9y agoNearly $3M a few days ago
- thephyber 9y agoNote: The value of BTC dropped more than 10% in the past 8 hours, so the value of the ransom just became much more affordable than before, although it's still higher than the middle of May when Equifax claims the breach began.
- abruzzi 9y agoJust an aside, "ransom" is probably not the right word, since I presume they are not taking money to destroy or not release the data. They're selling the data to anyone, and probably will be happy to sell the same data many times over.
- mythrwy 9y agoMaybe by the time they get their 600 BTC and go to cash out they'll be able to buy a used motorcycle. Or else a small country. One never knows.
- princetontiger 9y agoThis really pisses me off. It's only a matter of time before some random person opens up a cellphone, utlity, or bank account... or worse. Completely messed up. Everyone American should be scared shitless at this incompetence. It's going to cost everyone thousands of dollars over their lives for credit fraud protection. Just another expense to add.
- sschueller 9y agoThis issue has existed before the hack. None of these companies give a shit about security. Maybe this will change things.
- nkrisc 9y agoThey won't care until they have to personally pay out of pocket. Many of us probably will, but they won't.
- pavel_lishin 9y ago> It's going to cost everyone thousands of dollars over their lives for credit fraud protection. In my mind, the Just thing to do would be for Equifax to offer ongoing fraud protection to all of their customers affected by this leak. (Gosh, that might be expensive!)
- rhizome 9y agoI mean sure, if they can't make fraud-avoidance part of their fundamental business model.
- jimktrains2 9y agoIt's also extortion. "Please pay us money to solve the massive problem we created." I don't know how it's legal.
- martin1975 9y agoThe legal term is racketeering (https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corrupt_Organizations_Act https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...).
- paulddraper 9y ago> It claims to be the real EQUIFAX hackers, unlike the last darknet site that was soon taken down by morons. I hadn't heard about this last site. How did morons take it down? Or is that suppose to mean that morons put it up? English...
- uniformlyrandom 9y agoBoth. Morons put it up, got called on it by non-morons, and then took it down.
- thedevil 9y agoIf I were the real hacker, I would prove it by leaking information that wasn't already public. If I were someone pretending to be the real hacker, I would show a screenshot of SSNs that I could find with Google (e.g. Kim Kardashian, Donald Trump, and Bill Gates).
- wyldfire 9y agoI think you're right. But if they had leaked information that wasn't public, we wouldn't have a way to verify it, right?
- thedevil 9y agoMaybe. If I were the real hacker wanting to prove it, I'd maybe leak a few celebrities without previously leaked SSNs. I think at least one of them would unintentionally verify it for the public by getting upset and ranting on Twitter. If that didn't work, I'd try something else. Disclaimer: I'm no expert on security. I just like applying my things-I-might-do technique.
- ribosometronome 9y agoWell, I suppose you could always try applying for a credit card with the leaked info and seeing if you get approved!
- chias 9y agoDoesn't necessarily work. In my late teens I got confused about what my SSN actually was, and entered it wrong when opening a bank account / credit card. Worked fine. I realized my mistake a few years later and went through quite the endeavor to fix it.
- bluetwo 9y agoIf I were trying to prove I had the data, I would pick a very rich but private street, say in Bevery Hills or Jackson Hole, and release all data from all people who lived there. Chaos.
- robertelder 9y agoCool, this is good news as it means I might actually be able to find out my credit score. I recently sent in an application to Equifax to get my credit score along with all the security documents, proof of address, passport, drivers license, registered mail etc. and they rejected my application because I didn't provide a hydro bill. Unfortunately, I live in an apartment and I don't pay hydro, so I sent in a copy of the lease agreement instead but that wasn't good enough :(
- jitix 9y agoSame here.. I applied for a loan and they found that Equifax doesn't even have my report (although the other two do). After countless phone calls they agreed to start the investigation and then the hack happened. The whole concept of private credit bureaus (that to multiple ones whose data dont match up) is fucked up. I think the federal govt should step in an put a stop to this.
- rothbardrand 9y agoThe federal government is the reason it is this way-- the FCRA "Fair credit reporting act" is what give this bureaus virtual immunity from liability for propagating false information and the like. This is a great example of where regulation is anti-consumer because the regulations that pretend to protect consumers provide very little protection for consumers and a great deal of protection for the CRAs.
- fractal618 9y ago> Cool, this is good news as it means I might actually be able to find out my credit score. Hahaha
- sova 9y agothe brighter side is the side of genius
- pbourke 9y agoScore or report? You're entitled to a copy of your credit report annually from each credit bureau, but not the score. I believe lenders typically use a score computed by s third party - often the "FICO Score," from Fair Isaac.
- Beltiras 9y agoI wonder if this will introduce instability in credit for consumers. Could this actually have long term ramifications for the US economy?
- ryeguy_24 9y agoI wonder as well. I think we all forget how important credit reports are in giving banks comfort to lend (not that this is the only way to do it, but it seems that this is the current way). If people can default on a uncollateralized loan with no ramifications, no bank would lend and the credit engine would shut down.
- hedora 9y agoPeople also forget about of rule of law. I defaulted on my loan? Sue me. Want to give me a loan? Search for me in public court records.
- ryeguy_24 9y agoIf you think about it from the bank's perspective though, why would they lend you any money if you were likely to default and they would have to sue you to get money back. That would mean that the cost of your loan would go up for them and therefore, your borrowing rate goes up tremendously. Humans don't have an innate right to borrow money. It's a service provided by financial institutions for a fee. I don't think credit reports are the best solution (far from it) but they definitely improve your ability to borrow money, at least if you have a good one. :)
- alasdair_ 9y ago>Humans don't have an innate right to borrow money. It's a service provided by financial institutions for a fee. This would be fine, except those financial institutions get THEIR money from the fed discount window. If their service was entirely private, that would be one thing but having the government involved changes the concept of "rights", especially when the fed loans out money with the express reason that the banks will loan it out in turn.
- artursapek 9y agoPosting our president's SSN on your blog after obtaining it from a darknet page... priceless.
- sova 9y agoI applaud your concise cleverness, even if this is not the time nor the place!
- astura 9y agoEDIT: see philipodonnell's reply to this post for an alternative explanation. I may have jumped the gun. As far as I know credit scores are not part of credit reports as they do not show up when you request your credit report. If they were storing "credit score" as part of your credit report but withholding that information when you request a copy that would seem to violate the Fair Credit Reporting Act. It wouldn't really make sense to store a credit score with the report anyways, it would only make sense to generate it on the fly only when a lender requests it. I'm assuming that different creditors report credit information on different days so it would be changing every time a creditor submitted information on that person which would be multiple times a month for someone with multiple accounts. And if the credit score algorithm was updated they would have to recalculate the "credit score" field on the entire database! This wouldn't really make sense from a technical perspective. Furthermore, there's not just one "credit score," there's different algorithms for coming up with a credit score. One creditor may request FICO 8 and another one may request VantageScore 3.0 on the same day. Then another comes by and wants FICO 5. So even if they saving a credit score in the database I wouldn't think that they would have a field labeled as a generic "credit score" without any qualifier. It would be "FICO 8 score" or whatever algorithm was used to generate the score. There's also other problems, I don't have my Equifax report in front of me right now but credit bureaus store alternative/former names which aren't included here. Like for me my reported names are FirstName LastName; FirstName MiddleInital LastName; and FirstName MiddleName LastName. All because different creditors reported my name slightly differently. If you change your name (like Kim Kardashian did - she's Kim Kardashian West now) it would report both your former name(s) and current name(s). I don't see any indication that this sort of information is included. Therefore I very seriously doubt the authenticity. (From a technical perspective "pdf" is not a MIME type, the MIME type of PDF files is "application/pdf")
- Ajedi32 9y agoI actually kinda hope all the data is made public, as that would (at least hopefully) force people to stop treating knowledge of someone's SSN as valid proof of identity, and lead to a better situation overall.
- safisher 9y agoI hope this is fake and some would-be scammers get scammed by a scammer.
- kmix27 9y agoI really hope that's the outcome here. I also think this should pave the way for real legal consequences for moronic data security. Individuals are banned from using computers when prosecuted, what about "no internet for companies who've proven they can't use it responsibly"
- creatonez 9y ago> Individuals are banned from using computers when prosecuted Who is banned from using computers? You mean, in prison?
- Kroniker 9y agoIt can be a punishment for certain crimes- or as an extended punishment after jail. Things like stalking where a computer was a primary method, valid threats made on a computer, etc.
- kodt 9y agoSome convicted hackers have been banned from the internet, if ever caught using it they go back to prison. There have been cases of people being banned from using any personal computer.
- gipp 9y agoKevin Mitnick, famously, ages ago. Not sure if anyone else has ever had that.
- hamburglar1 9y agoThis looks like B.S. to me. - Who would store date of birth as a string? - If we are stringifying dob why is address still seperated? - Why are the credit report reasource Ids in the thousands not 1M +? - Why is the file size null but the file is listed with it's mimeType? I know equifuckingsucks at security but this is a setup that would actually just be difficult to interact with from a data stand point
- jerf 9y ago"Who would store date of birth as a string?" Enterprise. "If we are stringifying dob why is address still seperated?" Enterprise. "Why are the credit report reasource Ids in the thousands not 1M +?" Enterprise. "Why is the file size null but the file is listed with it's mimeType?" Enterprise. Be grateful you are in a position to be horrified. I'm currently fighting my way through a system that is not currently "Enterprise" yet, but was certainly headed full bore in that direction.
- koolba 9y agoExactly. The data model, and particular data typing, being terrible is more indicative of it being legit. Not less.
- zwerdlds 9y agoAnyone who has to work with the clowns in the credit reporting biz knows that this data is probably sitting on some COBOL-backed shimmed-out VAX talking to drum memory storage.
- alunchbox 9y agosad truth
- paulddraper 9y agoIndeed. This is one of those cases where reality is worse than the fabrication.
- 9y ago
- weatherlight 9y agohttps://trustedidpremier.com/eligibility/enroll.html https://trustedidpremier.com/eligibility/enroll.html ^ you can see if you or any of the above mentioned people have been compromised using this tool.
- jnbiche 9y agoYeah, at best, that tool from Equifax is unreliable. People have put in fake users and SSN and still it's told them they were affected. At worst, it's just another way to get customers to sign up for a new service.
- weatherlight 9y agoI put in the SSN of my family and it states we were affected, I put in fake names and SSN and it says we were probably not affected.
- ceejayoz 9y agoMaybe they've fixed it, but it has definitely been wonky. Some folks got different responses on mobile vs. desktop with the same info. https://techcrunch.com/2017/09/08/psa-no-matter-what-you-write-equifax-may-tell-you-youve-been-impacted-by-the-hack/ https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri...
- g051051 9y agoIt's asking for the last 6 digits of SSN and name. Considering that is 1 million unique numbers, out of 146 million potentially compromised accounts, you could probably put any number in there and be reasonably sure of getting a hit.
- jnbiche 9y agoThis is a very good point and may explain this phenomenon. However, I'm not 100% sure that those numbers are equally distributed. Still, it may well account for the fact that random numbers still resulted in a hit. Good point.
- gervase 9y agoIn case anyone else is curious about any ongoing activity (none yet) at the listed addresses, and didn't feel like transcribing: https://blockchain.info/address/1KELNpR9ECN46QaNGxPhoJDL4iqaa7Hgch https://blockchain.info/address/1KELNpR9ECN46QaNGxPhoJDL4iqa... https://etherscan.io/address/0x8D992F58f3887cCD72A14FE29aD22Ed0789f70Ef https://etherscan.io/address/0x8D992F58f3887cCD72A14FE29aD22...
- VMG 9y agolet us keep in mind that these balances can be inflated by the final recipients
- simik 9y agoInstructions for private buy dosn't make sense. Transaction id is public, so anyone can write them and claim a transaction is theirs.
- shawabawa3 9y agoPresumably first person to email gets the private address to buy, so if you're slow you'll have wasted 0.2BTC
- zwily 9y agoThey should have had you send a message signed with the source address of the 0.2 to their email.
- yebyen 9y agoI was going to say "Nobody would know how to do this" but in reality, it's probably a bit more like "Not enough people would know how to do this" and if they're taking increments of 0.2BTC, they're hoping or expecting to get some real volume. Making it just hard enough that anyone with a Coinbase account and a credit card can't just do it without actually running a full node of their own, would probably be bad for business.
- mrb 9y agoDoing so wouldn't accomplish anything. The second (larger) part of the payment still has to be sent and negotiated over PGP-encrypted email.
- deleted 9y ago[deleted]
- philipodonnell 9y agoMaybe the hack occurred on an api reporting server? The examples look like logs of api requests to something that generates PDF versions of credit reports, like an API a bank might use to access credit reports. When you get your report it goes through a process of "generating" the report which you then download as a PDF. This could be logs from that generation service. If the hackers got unrestricted access they may have found the API's logs and just copied them along with the PDFs?
- Tasboo 9y agoThis seems odd to say, but if they included a price for just a simple name+birth date query, there is probably a decent price point people would actually pay just to know if they are on there. Like if they have even just half of the names querying for their own identities for like $30 a pop, that'd be more than what they are asking for for the whole bulk.
- deadmik3 9y agoyeah that's what I thought it was going to get to when I started reading the screenshot. but I guess not all criminals are smart marketers
- vaishaksuresh 9y agoThink of the operational cost involved to satisfy everybody's query.
- spraak 9y agoCouldn't it easily be automated? A lot of upfront work but then just monitoring.
- vaishaksuresh 9y agoRunning servers takes resources too and in this case the servers need to support millions of queries.
- ringaroundthetx 9y agoMight as well scrap AML/KYC laws now that everyone can open any account anywhere with someone's ID
- spdustin 9y agoThe social security number for Donald Trump in their sample was issued around 1963. Seems fishy.
- 3JPLW 9y agoNote the new edit on the blog post: They silently corrected the sample data for Bill Gates, changing his state from WI to WA. Major red flag; if it was wrong in the original data just keep it that way and release a few more samples for verification.
- xena 9y agoi mean to be fair it got fixed on the onion site.
- blondie9x 9y agoBitcoin and Etherium are used too much for money laundering. They need to be regulated. There is also so much energy used to mine the coins. More than many countries. We need to really think about what we get out of building a money a laundering technology primarily used on the dark net.
- ciex 9y agoThat's over. Now there will always be another cryptocurrency to take over money transfer for criminal activities.
- int_19h 9y agoStrong encryption is used too much to coordinate illegal activities, such as terrorism. It needs to be regulated. Except, how do you actually intend to regulate it? Enacting a law to do so is easy. Actually enforcing that law is another matter.
- LambdaComplex 9y agoAnd you know who terrorists recruit? Children. You do care about the children, don't you?