4 ms·

> Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. Not much to say about that one, for sure.

> Then they started tweeting out links to a phishing site that looked just like their own "equifaxsecurity2017" site. Not much to say about that one, for sure. I still don't understand why they wanted to make a completely separate site with that stupid name. > Meanwhile they had delayed long past the timeline outlined in legal requirements for their reporting of the breach. I think you'll find that they adhered to the letter of the law on that. Maybe you know when Equifax made the breach public, but you don't know when they first contacted the relevant authorities (law enforcement or regulatory). > Where are the Congressional interviews with their executive directorship? Oh, that's coming, for sure. Other companies have been called before congress for far less. But what good has ever come out of such a hearing? That's what you do when you want to save face with the American public and seem like you're going to do something. There might be hope...Al Franken is the ranking member on what I think is the relevant committee, and he usually does a good job in calling out BS when he sees it. > I'm just as incensed about the response of law enforcement How so? What would you expect from law enforcement here?

yebyen 9y ago
> How so? What would you expect from law enforcement here? Copied from another sub-thread I posted in... When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to co-found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did). Many people argued that this business model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company. Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. I would expect for them to get a "time-out" after their bungling of the response to this breach, at the bare minimum. But no, let's give them a participation trophy instead, let them continue handling the response to the breach, they've earned it...
- g051051 9y ago
  > Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. You're presuming that Equifax is guilty of something. Of what? Of being victims of a hack? What about the SEC, who just notified the public now that they were hacked back in 2016? You seem to think that Equifax is guilty of negligence. Good luck proving that. They're subject to security audits not only from the government, but in relation to the contracts they have with their various customers (standard stuff when companies deal with each other, not least of which when consumer data is involved). Their security wasn't good enough, but they didn't know that until too late. Same as Target. Same as Home Depot. Same as the SEC. Equifax is going to get fined. They're going to lose business. They're going to eat the cost of providing identity theft protection/monitoring to the entire country. They're going to have to fight their way back to whatever previous stature they had. But any thought that they're going to be found criminally liable for this is simply not credible.
  - yebyen 9y ago
    Their behavior during the response has been chock full of negligence, and I don't need to prove it in a court of law. I just need you to concede that point, and I can go on with my day. :-D They should not have been in charge of the response, but there was no way for us to know that for sure until they had already flubbed it so badly. They are guilty of handling the response very poorly in a way that has been hashed out and rehashed at least six dozen times on HN until the culmination (so far) yesterday, when we found out that their site was so easy to spoof it fooled even Tim, the Twitter guy from Equifax, who tweeted links to the spoof site out to eight or nine customers over the course of the response. That was possible because of their initial poor (evidently hasty, and negligently so) response. I'm not asking to make anyone criminally liable, I'm suggesting that next time a company leaks sensitive records on 140MM Americans, we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) The poor response was probably made worse because of their internal culture that resulted in the CIO and CISO being canned (that sounds like all of their top technical leadership put out the door) right as the response was just getting underway. That too, in my opinion, was probably negligence! I know we don't put companies in "time out" but it seems like we had better think about doing exactly that in this case, lest we soon find out what it will look like when the (next) other shoe drops. The Equifax story will only continue to get worse! Just wait until their new free credit monitoring systems are breached, and we get to find out exactly what that mandatory class-action arbitration clause we've all heard about is actually intended to do!
yebyen 9y ago
> I still don't understand why they wanted to make a completely separate site with that stupid name. Probably because they still weren't sure that their existing systems were secure. So instead of securing them, or unplugging them, they ... built a new system, both hastily and shoddily! Then they sent out an e-mail to everyone, telling them to put a little bit more of their SSNs than we're all used to providing at the drop of a hat, ... put them into the bucket. Isn't that about the size of it?

yebyen 9y ago

> How so? What would you expect from law enforcement here? Copied from another sub-thread I posted in... When Sonny Vleisides plead guilty to Felony Mail Fraud in 2007, he was forbidden to engage in loan programs, gambling or gaming activities, telemarketing activities, investment programs or any other business involving the solicitation of funds. He went on to co-found the company called Butterfly Labs in 2010, a company that took pre-orders for Bitcoin mining equipment (in many cases soliciting funds for hardware that didn't exist, until it did). Many people argued that this business model was a direct violation of the terms of his supervised release. He stood in front of a judge in 2014 that said there was a "strong smell" of fraud with respect to his company. Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. When does Equifax get their 14 months in jail followed by a supervised release? Never, apparently, they just go on about their business and no charges are filed. I would expect for them to get a "time-out" after their bungling of the response to this breach, at the bare minimum. But no, let's give them a participation trophy instead, let them continue handling the response to the breach, they've earned it...

g051051 9y ago
> Equifax it seems gets to skip the whole "plead guilty" thing and just announced their negligent failure directly to the world. You're presuming that Equifax is guilty of something. Of what? Of being victims of a hack? What about the SEC, who just notified the public now that they were hacked back in 2016? You seem to think that Equifax is guilty of negligence. Good luck proving that. They're subject to security audits not only from the government, but in relation to the contracts they have with their various customers (standard stuff when companies deal with each other, not least of which when consumer data is involved). Their security wasn't good enough, but they didn't know that until too late. Same as Target. Same as Home Depot. Same as the SEC. Equifax is going to get fined. They're going to lose business. They're going to eat the cost of providing identity theft protection/monitoring to the entire country. They're going to have to fight their way back to whatever previous stature they had. But any thought that they're going to be found criminally liable for this is simply not credible.
- yebyen 9y ago
  Their behavior during the response has been chock full of negligence, and I don't need to prove it in a court of law. I just need you to concede that point, and I can go on with my day. :-D They should not have been in charge of the response, but there was no way for us to know that for sure until they had already flubbed it so badly. They are guilty of handling the response very poorly in a way that has been hashed out and rehashed at least six dozen times on HN until the culmination (so far) yesterday, when we found out that their site was so easy to spoof it fooled even Tim, the Twitter guy from Equifax, who tweeted links to the spoof site out to eight or nine customers over the course of the response. That was possible because of their initial poor (evidently hasty, and negligently so) response. I'm not asking to make anyone criminally liable, I'm suggesting that next time a company leaks sensitive records on 140MM Americans, we should remember this chain of events and somehow all do better. (And not have another repeat of this shit show, if possible... but who am I kidding, it will repeat.) The poor response was probably made worse because of their internal culture that resulted in the CIO and CISO being canned (that sounds like all of their top technical leadership put out the door) right as the response was just getting underway. That too, in my opinion, was probably negligence! I know we don't put companies in "time out" but it seems like we had better think about doing exactly that in this case, lest we soon find out what it will look like when the (next) other shoe drops. The Equifax story will only continue to get worse! Just wait until their new free credit monitoring systems are breached, and we get to find out exactly what that mandatory class-action arbitration clause we've all heard about is actually intended to do!

yebyen 9y ago

> I still don't understand why they wanted to make a completely separate site with that stupid name. Probably because they still weren't sure that their existing systems were secure. So instead of securing them, or unplugging them, they ... built a new system, both hastily and shoddily! Then they sent out an e-mail to everyone, telling them to put a little bit more of their SSNs than we're all used to providing at the drop of a hat, ... put them into the bucket. Isn't that about the size of it?