9 ms·
Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed
- Exuma 9y agoThe plot thickens.
- kylehotchkiss 9y agoI'm sure this looks good for the insider trading news.
- ringaroundthetx 9y ago> Pros for not prosecuting: The size of the sells were truly negligible for all executives involved, in proportion to how many shares they have and routinely liquidate. The same argument that there were any sells at all would been made regardless of the number of shares. A company that size will always have material non public information. Equifax's OPSEC was horrible all along and a gigantic leak was bound to happen, so the extent and ramifications of this fairly routine breach were eeeeehhhh not considered. > Cons for not prosecuting: The execs did it on the same day. Something something the people something want blood.
- rgbrenner 9y agoA company that size will always have material non public information. If you're in that position, then wouldn't you make sales regularly on scheduled dates? (say quarterly) Otherwise theyre asking to get prosecuted, if not for this sale then the next.
- ringaroundthetx 9y agoRight, and these execs did that as well. I mentioned that in the "routinely liquidate" part, but I guess it wasn't clear, they do liquidate shares on a schedule. Sure, doing anything out of that schedule is always a risk, and doing things on that schedule doesn't mean there isn't insider trading still happening. A successful prosecution under these equities-specific market sanctions will rely on more than that.
- rhizome 9y agoI'm under the impression that these were not 10b5-1 sales.
- jlgaddis 9y agoI am too, since I read TFA and it says -- twice, I think -- that they weren't.
- ringaroundthetx 9y agoNothing I said disputes that? We are agreeing? I guess I'll attempt to reword it yet again: They have 10b5-1 sales, or even if we don't know we can see that they have sales on an internval. They can have sales outside of the schedule. Sales outside of the schedule always have the risk of scrutiny. These sales are getting scrutiny for being outside of the schedule.
- deleted 9y ago[deleted]
- otakucode 9y agoIf I were a shareholder in Equifax, I would probably be looking very closely at what those executives are paid. They adamantly insist that they had no idea about the most significant thing to happen at their company in years. Clearly, they're not just lazy, they have to be aggressively, emphatically incompetent.
- chiph 9y agoThey're acting like they're not a technology company. Despite rooms full of servers and storage devices that hold their only product.
- thephyber 9y agoAnd for the investor lawsuits against C*Os for destruction of share value due to (gross?) negligence.
- ArchReaper 9y agoI thought this was already known? Is this a new revelation?
- paulgb 9y agoThe headline is ambiguous, but it's not five months before they disclosed, it's five months before the July date they originally disclosed they were hacked.
- ringaroundthetx 9y ago> In a statement, the company said the March breach was not related to the hack that exposed the personal and financial data on 143 million U.S. consumers, but one of the people said the breaches involve the same intruders.
- cft 9y agoI think it's good news- if your identity has not been used, there's less chance that it will be, because the data has been already out for that long.
- sbov 9y agoI was told they usually aren't used until at least a year after the fact, because this line of reasoning. Not sure how true that is.
- rdiddly 9y agoI would probably wait at least until everybody's free fraud protection expires, which is usually a year.
- 086421357909764 9y agoThis is exactly how it works. Passwords can be changed, your personal details can't.
- otakucode 9y agoPerhaps not true THIS time at least... https://krebsonsecurity.com/2017/09/equifax-hackers-stole-200k-credit-card-accounts-in-one-fell-swoop/ https://krebsonsecurity.com/2017/09/equifax-hackers-stole-20...
- cm2187 9y agoThis data will likely surface in the open in a few years, like for most other major leaks.
- beager 9y agoTo red team that line of reasoning: hold on to the hacked data but don't use it, wait till public forgets about it, don't give business/lawmakers a reason to neuter the data, then strike a few years down the line.
- 9y ago
- dogma1138 9y agoThe timeframe isn't unusuall unless they've also have not reported it to major stakeholders and regulatory bodies. That said this might absolve them of some responsibility if 5 months ago that vulnerability wasn't disclosed to major companies.
- icedchai 9y agoSounds like good news for my short position.
- deleted 9y ago[deleted]
- rotrux 9y agoIMPORTANT: The date of disclosure is ALSO the date that demand for hacked data explodes. It's good practice to have a staged-disclosure procedure for leaks of this nature. For example: your bank should be told to start fine-tuning its anti-fraud capabilities BEFORE the entire world is made aware that you can be defrauded in this particular manner.
- TwelveNights 9y agoI noticed that too. If they released breach information before trying to patch it up, that would have been a horrible play.
- leesalminen 9y agoThat's really interesting. We noticed a statistically significant number of declines on debit/credit cards roughly 1 week before Equifax publicly disclosed.
- orf 9y ago> One possible explanation, according to several veteran security experts consulted by Bloomberg, is that the investigation didn’t uncover evidence that data was accessed. Most data breach disclosure laws kick in only once there’s evidence that sensitive personal identifying information like social security numbers and birth dates have been taken. There was one company (very well known) I know of that was breached, but their logging and general security infrastructure was so poor that they had no direct evidence that customer info was breached, so they didn't have to report the hack. They only found the intrusion due to excessive load the intruders caused on some services. Customer info was certainly accessed (the attackers where everywhere), it's just there was no record of it as the records they kept where so few and far between. Part of me thinks it's a pretty clever workaround to such laws.
- KGIII 9y agoBetween this and them lobbying for no-fault for data exfiltration, it keeps getting better and better. My credit has been locked since the OPM fiasco, I'd like to recommend others consider it.
- 086421357909764 9y agoI worked on a breach where during the investigation we found reverse tunnels out of the network (back to the VP's house) where he'd been working on stuff unbeknownst to the firm. They had a VPN to a competitor that a sales engineer had setup when they were exploring collaboration, that had never been closed. Their DMZ was awesome on paper (cool color chart) but was literally non-existent. The final icing on the cake, their network equipment and firewalls were all second hand with existing firewall rules left when new ones were added. After printing out the rules.. at the very bottom ANY/ANY. There wasn't a lack of money, hundreds of millions were dumped in by investors. Everyone there had the i'm an engineer so I don't have to follow rules, that's for the sales guys attitude and that more than did them in from a security perspective.
- otakucode 9y agoSure, that combined with the fact that courts simply refuse to refer to anything involving software a 'negligence', no matter how extravagantly negligent it might be, would make that a pretty good strategy. The only flaw in it, really, is that it would also open you up to things like the Sony hack which actually had them shut down operations for awhile. As much as companies REALLY do not want to ever admit it, no matter what they do, their software IS their business in every sense. Without it in a working state, they have to shut their doors. So I suppose you have to strike a balance... secure enough that things keep working, but not so secure that it actually costs money...
- ams6110 9y agoIf they had an outside security firm helping them starting in March, and another breach in July, that doesn't say much for the capabilities and competency of the security firm.
- valas 9y agoIt's quite possible the security firm was asked to audit their systems, but not asked (or paid) to fix them.
- 086421357909764 9y agoA lot of people want you to come in and find a quick answer and fix, rarely allowing a full proper investigation. Many times they're adverse to spending money and want to cut corners where they can. It's actually disheartening. Much like one of the posters above, I've seen people purposely stop investigations because if the investigation reported on known issues it would open up more questions about other wrong doings. The Irony is their actions on remediation are almost exactly in line with the decisions made that often times lead to the incident. It's cyclical.
- chii 9y agoSo you can't do this with accounting audit, so laws should be updated to make security audits the same!
- ams6110 9y agoI suppose the difference is that in accounting, any irregularities or shennanigans are quantifiable in dollars. Security breaches maybe sometimes are, but often are not. I'm guessing there nobody able to prove that his or her identity was stolen as a result of this breach, to say nothing of being able to specify a dollar amount of loss that can be backed up. With often vague or only theoretical damages, it's harder to muster support for draconian consequences. Also people can sort of understand accounting. Dollars and cents and balances are something most people can comprehend. Computer software and security breaches, on the other hand, are much more of a black box for most people. They can't intuitively understand what's sensisible and reasonable and what would constitute negligence when it comes to protecting software sytems and data, other than by relying on what other people tell them.
- poulsbohemian 9y agoI do performance / app triage work, but see the same thing. Often I walk in to a supposed "emergency" only to discover the problem has been occurring for months, if not years. Often, there is a significant cost (IE: in the millions) but either the organization isn't willing to remediate, or isn't even aware of the full scope of the cost (IE: "It's not my budget so I don't care"). In at least one case, I came across a security problem where the response was "oh yeah, we've known about that for years". Sigh. Sadly, too often unless companies have a very large customer who gets angry with them, or they are publicly shamed for a problem, they just let it magically go.
- MichaelGG 9y agoI came across a "hole" in the design of a vendor I was evaluating. Their fancy Java UI actually just downloaded plaintext root credentials to their MySQL database. All security was client side. As a bonus the root credentials were debug logged to the user's local computer. Making it worse, they actively sold this as a multi-tenant platform to be used with mutually untrusting parties. When I met with engineering and started to explain, they started smiling and said "this is a known issue and we're going to fix it in our next version." Quite some time later I ran across people using it in the wild and they had not passed a lot of the glaring holes. Even their newer version had a hidden input field on the edit profile page named "IsAdmin". This did exactly what you think. They ended up having a successful exit as far as I know and I've never heard anyone speak ill of them security-wise. Telecom is a mess. These holes are easily exploitable for direct profit. But there's so much more low-hanging fruit, I don't think people bother.
- ploxiln 9y agoThis stuff is really the ultimate technical debt. Fixing it seems to provide zero benefit today. But there is a significant chance that one day it's an extinction event (or just a billion-dollar blunder, if you're big enough to survive it).
- acscott 9y agoRisk v. reward I'm afraid. The Sarbanes-Oxley legislation attempted to put skin in the game for the C execs in public companies; so, I cannot help but notice how many public companies delisted, went private after that. The whole of the corporate charter was meant to insulate investors' personal wealth against risks. I guess this is where licensing can provide a backstop to poor development practices, but it seems to have not really caught on.
- addicted 9y agoHere's a question. What if based on this hack and others, someone decides to publicly post all the details they are aware of. So basically I can go on a website and look up all the hacked SSNs and the person and their information associated with that. How will the US cope with that? The reason I ask that question is that it's definitely not gonna happen. But it's arguably a lot better than the situation right now where we have a few malicious actors who do have that information. If the data was completely public I feel you'd have a huge effort to fix the problem bwcahwe your neighbor can look up your credit worthiness. Yet I think the situation right now is worse because we won't have that effort to fix the problem yet 95% of the people who would have caused you problems have that data.
- mberger 9y agoWhat would I do with that though? As a resident of a country that's affected, if I hit a profile that happens to have fraud protection, I go to jail. Now, if I was in a country not so friendly to the US I might have a shot.
- depotcomplete 9y agoAhhh, so rivers are private? Problem here is that credit worthiness is a function of a public good. In fact, you cannot separate the two.
- perseusprime11 9y agoSide bar: is anyone buying insurance from them in the wake of this hack? They seem to be giving it for free for a year.
- tyywebb 9y agoJust let me know where to sign the class action.
- depotcomplete 9y agoYou didn't lose a finger. If you had, you would have recovered more.
- daveheq 9y agoWhy do we trust corporations over government again?
- anaheim_ducks 9y agoKaspersky? http://thehill.com/policy/cybersecurity/350949-new-russia-suspicions-about-kaspersky-cybersecurity-five-things-to-know http://thehill.com/policy/cybersecurity/350949-new-russia-su...
- crb002 9y agoThis emphasizes why companies need to post bonds in case of a breach. They shouldn't have to be sued after the fact. Security should be priced in up front so they have massive financial incentive from the get go to protect confidential government data.
- depotcomplete 9y agoHow do you price an event that rarely occurs?
- depotcomplete 9y agoHas anyone heard of techniques to re-identify de-identified data sold in bulk to marketers? Each company who sells this info. is not required to disclose their methodology. If you recall: AMA re-identified every doctor's prescription writing in this country. If you recall, Equifax bought NCTUE, a valuable collection of historical zip codes from a concern who thought of the info. as a credit header. Perhaps, even less so. FCRA really meant nothing here. How many zip codes are needed to re-identify every prescription record (i.e., PDE - prescription drug event) in this country? What is the least information required?