4 ms·

I'm personally more upset about their continued incompetence in their response to the breach, than about the breach itself. I'm sorry I can't write more right

by yebyen 9y ago

I'm personally more upset about their continued incompetence in their response to the breach, than about the breach itself. I'm sorry I can't write more right now... First they suppressed valuable information in the form of interviews with their CISO that were public until September 10, when they came down for some reason. Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. About this time, the CIO and CISO were removed from the picture entirely. A few days later, each of these gaffes became known. Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. Where are the Congressional interviews with their executive directorship? Not on the calendar yet, why don't we schedule it for next February 30th. First of never. I'm just as incensed about the (seeming lack of) response of law enforcement, which admittedly I don't personally have much visibility into, but seems inadequate. At a minimum I would argue that Equifax needs a "time-out." Ideally they would not be handling the response to this situation at all. They should go on the hook to pay someone competent to handle the response.

g051051 9y ago
> Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. Not much to say about that one, for sure. I still don't understand why they wanted to make a completely separate site with that stupid name. > Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. I think you'll find that they adhered to the letter of the law on that. Maybe you know when Equifax made the breach public, but you don't know when they first contacted the relevant authorities (law enforcement or regulatory). > Where are the Congressional interviews with their executive directorship? Oh, that's coming, for sure. Other companies have been called before congress for far less. But what good has ever come out of such a hearing? That's what you do when you want to save face with the American public and seem like you're going to do something. There might be hope...Al Franken is the ranking member on what I think is the relevant committee, and he usually does a good job in calling out BS when he sees it. > I'm just as incensed about the response of law enforcement How so? What would you expect from law enforcement here?
- yebyen 9y ago
  > How so? What would you expect from law enforcement here? Copied from another sub-thread I posted in... When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to co-found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did). Many people argued that this business model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company. Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. I would expect for them to get a "time-out" after their bungling of the response to this breach, at the bare minimum. But no, let's give them a participation trophy instead, let them continue handling the response to the breach, they've earned it...
  - g051051 9y ago
    > Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. You're presuming that Equifax is guilty of something. Of what? Of being victims of a hack? What about the SEC, who just notified the public now that they were hacked back in 2016? You seem to think that Equifax is guilty of negligence. Good luck proving that. They're subject to security audits not only from the government, but in relation to the contracts they have with their various customers (standard stuff when companies deal with each other, not least of which when consumer data is involved). Their security wasn't good enough, but they didn't know that until too late. Same as Target. Same as Home Depot. Same as the SEC. Equifax is going to get fined. They're going to lose business. They're going to eat the cost of providing identity theft protection/monitoring to the entire country. They're going to have to fight their way back to whatever previous stature they had. But any thought that they're going to be found criminally liable for this is simply not credible.

by yebyen 9y ago

g051051 9y ago

> Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. Not much to say about that one, for sure. I still don't understand why they wanted to make a completely separate site with that stupid name. > Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. I think you'll find that they adhered to the letter of the law on that. Maybe you know when Equifax made the breach public, but you don't know when they first contacted the relevant authorities (law enforcement or regulatory). > Where are the Congressional interviews with their executive directorship? Oh, that's coming, for sure. Other companies have been called before congress for far less. But what good has ever come out of such a hearing? That's what you do when you want to save face with the American public and seem like you're going to do something. There might be hope...Al Franken is the ranking member on what I think is the relevant committee, and he usually does a good job in calling out BS when he sees it. > I'm just as incensed about the response of law enforcement How so? What would you expect from law enforcement here?

yebyen 9y ago
> How so? What would you expect from law enforcement here? Copied from another sub-thread I posted in... When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to co-found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did). Many people argued that this business model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company. Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. I would expect for them to get a "time-out" after their bungling of the response to this breach, at the bare minimum. But no, let's give them a participation trophy instead, let them continue handling the response to the breach, they've earned it...
- g051051 9y ago
  > Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. You're presuming that Equifax is guilty of something. Of what? Of being victims of a hack? What about the SEC, who just notified the public now that they were hacked back in 2016? You seem to think that Equifax is guilty of negligence. Good luck proving that. They're subject to security audits not only from the government, but in relation to the contracts they have with their various customers (standard stuff when companies deal with each other, not least of which when consumer data is involved). Their security wasn't good enough, but they didn't know that until too late. Same as Target. Same as Home Depot. Same as the SEC. Equifax is going to get fined. They're going to lose business. They're going to eat the cost of providing identity theft protection/monitoring to the entire country. They're going to have to fight their way back to whatever previous stature they had. But any thought that they're going to be found criminally liable for this is simply not credible.