10 ms·

After Equifax breach, anger but no action in Congress

242 points by tareqak 9y ago

tareqak 9y ago
Techmeme summary: Martin Matishak / Politico: After Equifax breach compromised the identities of 145M Americans, there was anger in Congress, but the hearings and proposals have led to no real change Could those who downvote this comment please explain why you did so? I try to provide extra context for those who come across this submission, which I get from Techmeme.
rossdavidh 9y ago
In other words, there will have to be a bigger, more painful incident before anything gets done. In part, because a large committee composed mostly of lawyers is not probably the right group to even determine what needs to be done, in this particular case.
- wmeredith 9y ago
  > a large committee composed mostly of lawyers is not probably the right group to even determine what needs to be done, in this particular case Whelp... this is who is deciding what gets done in pretty much all cases.
  - rossdavidh 9y ago
    True, in regards to laws, but in some cases their expertise helps. For example, tort reform might be an issue where a bunch of lawyers do have relevant expertise that the rest of us lack, to see possible unintended consequences, and also what is possible given the rest of the system. But, in the case of IT security, their experience and expertise is, at best, not helpful.
    - tareqak 9y ago
      However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? Isn't a generic concept like that well-understood for lawyers and other people familiar with law?
      - thephyber 9y ago
        > However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? "keeping customer information secure" is not a binary. Most companies that are breached don't know about it until their dat hits the black market. Yahoo! revised their data brach estimates upwards half a dozen times from 100million+ to ~3billion+. The plaintiffs would have to affirmatively prove that a breach happened to the defendant when most defendants don't even know that it happened. It is even harder to contractually enforce when the victim claims it was a nation-state-actor/APT since no company could hold out against a determined APT indefinitely. I'm hopeful that cybersecurity insurance policies will move the needle towards accountability and increased prevention (insurance policies will require good-faith efforts at security policies+procedures+tools+employee actions or they won't pay out).
        tareqak 9y ago
        OK, what about: If a company storing private customer information gets breached (sufficient evidence is found of said breach), then the company must make itself fully available for a third-party investigation to confirm the existence of said breach. If the third-party investigator finds evidence of a breach, then said breach happened. If not, then there was no breach. If one third-party investigator is an insufficiently reliable number, then what about the best two out of three?
  - thephyber 9y ago
    Not exactly. If it were possible for all of the affected to individually sue Equifax, many of them already would have. But the US civil-legal system requires "standing", which in turn requires proof of "damages". The sad fact is that loss of sensitive information is not quantifiable as "damages" for this purpose, even though that same information is worth well north of $millions when the FEC looks at the same kind of information transaction in election campaigns. "The markets" that fiscal conservatives love to talk about don't work when our civil system doesn't recognize that there is value and a market there. If the data breach had resulted in masses of data being traded on the black market, the Equifax breach may have ended in prosecutions and massive lawsuits. Because it didn't, it likely won't end in much. Hell, not even the banks, retailers, and ID security services that did business with Equifax bothered to make a big deal about cancelling their contracts+relationships. The sad fact is that there's a tiny pool of companies with this data and cutting off one company gives the other players (who aren't much better at securing their networks) massive leverage.
- Nelson69 9y ago
  It seems more fundamental to me. Credit firm customers aren't the victims. The generalized GOP party line is that this kind of thing is better left to private enterprise and the federal government shouldn't spend time and money coming up with some sort of identification strategy. So what business has the motivation to spend that kind of effort? Google or Facebook? It's kind of a perfect storm of sorts, there isn't any pressure to fix it, anywhere. The public has even lost interest in it, for the most part.
- username223 9y ago
  > ... there will have to be a bigger, more painful incident before anything gets done. I'm not sure how that happens. Equifax basically exposed everyone in the US with any credit to identity theft and scams. If those thefts trickle out bit by bit over a few years, there will be no single, shocking crime wave, and nothing will happen. It doesn't take genius-level criminals to avoid creating a big enough incident. On the other hand, I would be curious what would happen if some public-minded hacker stole ~150m people's data from one of the other two CRAs, then publicly released 538 specific records...
- coliveira 9y ago
  I think we need to see very large scale attacks based on this data, before anything gets done. Something like in the tune of a trillion dollars exchanging hands in a few hours, that would probably bankrupt a few large companies and make them force the government to do something about it.
cletus 9y ago
Bear in mind we’re at an odd time politically where the GOP controls the White House, the House and the Senate. There is a very small window to essentially pass legislation unchecked and that hasn’t been easy with a 52-48 (with a tie breaker) majority in the Senate. We saw several failed attempts at repealing Obamacare. What’s more that majority is about to shrink to 51-49. My point here is the GOP currently has no time for anything bipartisan. That doesn’t mean they’ll address this of course. But it’s just not as important as the donor class agenda is right now. Once Doug Jones is seated and we start to approach the midterms expect to see more unifying issues instead of, say, hugely unpopular tax bills for billionaires.
- rossdavidh 9y ago
  Also, eventually, a data breach that inconveniences or outrages a bunch of millionaires will happen.
  - lbotos 9y ago
    What would that breach look like? I'm asking sincerely, because I can't fathom what kind of data breach that would be that wouldn't be able to be "smoothed" in a mater of days. - Black card number stolen? Card frozen. - FDIC insured account attempted to be flushed. Banks flag and or fraud protected.
    - yardie 9y ago
      Because it won't pop up right away. It will show up when that line of credit taken out in your name goes into collections 90 days from opening. You should read up on the havoc that is caused with stolen identity. I'm not talking stolen credit cards, more like unknown judgements taken out against you and wage (in extreme cases, wage garnishments).
    - WorldMaker 9y ago
      FDIC has a per-person insurance liability limit of $250,000 per bank. It's possible you could find an idiot with more than that in a single bank, presumably in CDs, with no other insurance coverage on it. You need some sort of strange reverse Nigerian Prince scheme to cash that out without a paper trail ("I'm executing his will and he explicitly stated to hand out all of his assets, damn the losses, as $20 bills and fresh turkeys to orphans and other passersby on Christmas Day." Maybe call it a "Christmas Carol scheme"?). It's unlikely to be worth the time investment in terms of being a useful bank robbery, but it certainly would send a weird message to someone.
mikestew 9y ago
Yeah, that's why I bought Equifax call options a little bit after the breach was announced. Made good money on those options, and it pisses me off. It pisses me off that after an event that should bankrupt a company such as Equifax, I lay hard-earned on the table knowing that I have an extremely good chance of a healthy ROI simply because of vested interests and status quo. Like other political hot topics, this is one of those things that causes me to ask, "okay, then, how bad does it have to get before populist outrage brings about change?" Something worse happens, and this is the time, right? Nope. And so on from one event to the next. OTOH, in this case maybe the invalidation of vast amounts of data will alone bring about changes out of necessity. There will probably be a rough patch of lawsuits, debate, and perhaps a new law or two, but perhaps it will eventually shake out something better.
- JumpCrisscross 9y ago
  > how bad does it have to get before populist outrage brings about change? We had a bill in the New York State Senate after the Equifax breach [1]. It was dead on arrival. Practically nobody called in to offer support. It was apparent that nobody's political career would be made nor broken by this bill. When it died, there was no press; nobody noticed nor cared. [1] https://www.nysenate.gov/legislation/bills/2017/s1104/amendment/a https://www.nysenate.gov/legislation/bills/2017/s1104/amendm...
  - mehrdadn 9y ago
    I'm guessing most people didn't know about it to offer support? Seems like a failure of the press if they didn't monitor bills and bring awareness... That said, I'm not sure how much of a fix timely disclosure is. Maybe people thought it wouldn't go even remotely far enough to help a significant number of people and hence wouldn't be worth it. (I could even see it being harmful if it makes it less likely to get more serious legislation passed.)
    - JumpCrisscross 9y ago
      > I'm guessing most people didn't know about it to offer support? A bit of this, a bit of that. I was excited about the bill and offered to help. When it came to selling it, however, people were more animated by Trump, affordable housing and the MTA. Despite our obsession with privacy on Hacker News, it hasn't been properly sold to the public. > I'm not sure how much of a fix timely disclosure is It was to allow the Attorney General to investigate these crimes. Right now, there is no disclosure requirement. Unless the company reports its breach and co-operates with state Attorneys General, they basically can't be held accountable at the state level. So, naturally, they refuse to co-operate.
davesque 9y ago
Given how technically inept and thoroughly entrenched the major institutions of our financial system are, I'm almost at the point where I'm waiting until Russia or North Korea reveals that they've been planting malware for years in all of our major banks and that they're going to go ahead and push a big red button and just take all our money. Or maybe that's already happening and they're being smart by not talking about it.
- JumpCrisscross 9y ago
  > go ahead and push a big red button and just take all our money This would result in a twenty-four hour recession. The U.S. banking system can be shut down [1] while records are analyzed and fraudulent transactions reversed. Presumably a digital hack would result in digital dollars being stolen and subsequently frozen. Whatever couldn't be recovered would probably be, in large part and at least at the retail level, re-imbursed with new money. [1] https://en.wikipedia.org/wiki/Emergency_Banking_Act https://en.wikipedia.org/wiki/Emergency_Banking_Act
- greenleafjacob 9y ago
  Thankfully since we aren’t all using Bitcoin, all such transactions can be reversed.
  - davesque 9y ago
    But you can't spend any Bitcoin unless you possess some wallet's secret key. Explain to me how that poses a comparable risk to the egg baskets that are today's financial institutions. If your secret key isn't compromised, there's just no way your coins can be transferred. Furthermore, in the event that any kind of mass fraud takes place which exploits some flaw in the protocol itself (contrasted with a flaw in an exchange platform or something similar), the ledger could be hard-forked. It was done after Ethereum's DAO debacle with /relatively/ little consequence.
mehrdadn 9y ago
Is it known how many people have actually gotten their identities stolen so far as a result of this attack? I would imagine it would not end up high on Congress's priority list if the number is still low.
- g051051 9y ago
  Known? As of now, 0. Some people are blaming the Equifax breach for identity theft, but it's highly unlikely that was the case, they're just picking the easiest target.
  - mehrdadn 9y ago
    How about "known" in the sense of "there's a significant uptick of ID theft cases here after the breach statistically that sure suggests it was the cause, but we obviously can't necessarily pin down any individual cases on any individual breach"? a.k.a.: how much evidence is there of actual harm having resulted from the breach?
    - g051051 9y ago
      Again, pretty much 0. I haven't seen a single reputable report of any statistically significant increases in ID Theft.
  - decebalus1 9y ago
    It's too early to tell. They may be still sitting on the stolen data for multiple reasons: - the 1 free year of identity protection to expire - if there's a surge, it will definitely be on the radar, it will be more publicized and more and more people will take defensive actions (like buying extended identity protection and/or freezing credit). As we can see, it kinda blew over. I mean, that's what I'd do if I'd be in the 'stolen data' business.
MollyR 9y ago
Infuriating. We need digital consumer protection laws to put increased pressure on companies to take cyber security seriously.
- g051051 9y ago
  True, but we mainly need a better way to validate identities than information that is easily stolen.
gehwartzen 9y ago
It's pretty amazing just how much data Equifax has on consumers. They also own TheWorkNumber which contains data from HR/payroll of any company using the service (everything from pay, title, insurance info, union affiliation etc). I'm not sure what hackers got away with but potentially much more than just some SSNs. Then there are countless other credit analytics companies hoarding all kinds of other specialized data. It's scary to think about. As a PSA: check out the list [1] of credit reporting companies that the CFPB puts out. It has the names and contact info for most and you can get copies of your full reports from them upon request (most are either required or do so voluntarily). It's a lot of effort to hit all of them but pretty eye opening and, frankly crazy, to see just how much is tracked. There are databases for how often, and where, you return items to stores/businesses as one example. [1](http://files.consumerfinance.gov/f/201604_cfpb_list-of-consumer-reporting-companies.pdf http://files.consumerfinance.gov/f/201604_cfpb_list-of-consu...) List Of Consumer Reporting Companies
deleted 9y ago
[deleted]
syshum 9y ago
That is because they are attempting to solve the wrong problem Congress needs to do 3 things 1. Find away to limit and prohibit SSN from being used for Identity. 2. Give People Ownership over their PII, end the concept of "who collects it owns it" 3. Make companies liable for damages when they lose control over PII that is collected Congress does NOT, should not, and likely can not create rules and regulations to govern data storage, security, etc. They should stop trying as that is not a problem they need to solve nor is it a problem that should be "fixed" in law
jedikv 9y ago
Did anyone manage to successfully obtain a police report number as a result of this fuck up by equifax?

242 points by tareqak 9y ago

Techmeme summary: Martin Matishak / Politico: After Equifax breach compromised the identities of 145M Americans, there was anger in Congress, but the hearings and proposals have led to no real change Could those who downvote this comment please explain why you did so? I try to provide extra context for those who come across this submission, which I get from Techmeme.

rossdavidh 9y ago

In other words, there will have to be a bigger, more painful incident before anything gets done. In part, because a large committee composed mostly of lawyers is not probably the right group to even determine what needs to be done, in this particular case.

wmeredith 9y ago
> a large committee composed mostly of lawyers is not probably the right group to even determine what needs to be done, in this particular case Whelp... this is who is deciding what gets done in pretty much all cases.
- rossdavidh 9y ago
  True, in regards to laws, but in some cases their expertise helps. For example, tort reform might be an issue where a bunch of lawyers do have relevant expertise that the rest of us lack, to see possible unintended consequences, and also what is possible given the rest of the system. But, in the case of IT security, their experience and expertise is, at best, not helpful.
  - tareqak 9y ago
    However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? Isn't a generic concept like that well-understood for lawyers and other people familiar with law?
    - thephyber 9y ago
      > However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? "keeping customer information secure" is not a binary. Most companies that are breached don't know about it until their dat hits the black market. Yahoo! revised their data brach estimates upwards half a dozen times from 100million+ to ~3billion+. The plaintiffs would have to affirmatively prove that a breach happened to the defendant when most defendants don't even know that it happened. It is even harder to contractually enforce when the victim claims it was a nation-state-actor/APT since no company could hold out against a determined APT indefinitely. I'm hopeful that cybersecurity insurance policies will move the needle towards accountability and increased prevention (insurance policies will require good-faith efforts at security policies+procedures+tools+employee actions or they won't pay out).
      - tareqak 9y ago
        OK, what about: If a company storing private customer information gets breached (sufficient evidence is found of said breach), then the company must make itself fully available for a third-party investigation to confirm the existence of said breach. If the third-party investigator finds evidence of a breach, then said breach happened. If not, then there was no breach. If one third-party investigator is an insufficiently reliable number, then what about the best two out of three?
- thephyber 9y ago
  Not exactly. If it were possible for all of the affected to individually sue Equifax, many of them already would have. But the US civil-legal system requires "standing", which in turn requires proof of "damages". The sad fact is that loss of sensitive information is not quantifiable as "damages" for this purpose, even though that same information is worth well north of $millions when the FEC looks at the same kind of information transaction in election campaigns. "The markets" that fiscal conservatives love to talk about don't work when our civil system doesn't recognize that there is value and a market there. If the data breach had resulted in masses of data being traded on the black market, the Equifax breach may have ended in prosecutions and massive lawsuits. Because it didn't, it likely won't end in much. Hell, not even the banks, retailers, and ID security services that did business with Equifax bothered to make a big deal about cancelling their contracts+relationships. The sad fact is that there's a tiny pool of companies with this data and cutting off one company gives the other players (who aren't much better at securing their networks) massive leverage.
Nelson69 9y ago
It seems more fundamental to me. Credit firm customers aren't the victims. The generalized GOP party line is that this kind of thing is better left to private enterprise and the federal government shouldn't spend time and money coming up with some sort of identification strategy. So what business has the motivation to spend that kind of effort? Google or Facebook? It's kind of a perfect storm of sorts, there isn't any pressure to fix it, anywhere. The public has even lost interest in it, for the most part.
username223 9y ago
> ... there will have to be a bigger, more painful incident before anything gets done. I'm not sure how that happens. Equifax basically exposed everyone in the US with any credit to identity theft and scams. If those thefts trickle out bit by bit over a few years, there will be no single, shocking crime wave, and nothing will happen. It doesn't take genius-level criminals to avoid creating a big enough incident. On the other hand, I would be curious what would happen if some public-minded hacker stole ~150m people's data from one of the other two CRAs, then publicly released 538 specific records...
coliveira 9y ago
I think we need to see very large scale attacks based on this data, before anything gets done. Something like in the tune of a trillion dollars exchanging hands in a few hours, that would probably bankrupt a few large companies and make them force the government to do something about it.

cletus 9y ago

Bear in mind we’re at an odd time politically where the GOP controls the White House, the House and the Senate. There is a very small window to essentially pass legislation unchecked and that hasn’t been easy with a 52-48 (with a tie breaker) majority in the Senate. We saw several failed attempts at repealing Obamacare. What’s more that majority is about to shrink to 51-49. My point here is the GOP currently has no time for anything bipartisan. That doesn’t mean they’ll address this of course. But it’s just not as important as the donor class agenda is right now. Once Doug Jones is seated and we start to approach the midterms expect to see more unifying issues instead of, say, hugely unpopular tax bills for billionaires.

rossdavidh 9y ago
Also, eventually, a data breach that inconveniences or outrages a bunch of millionaires will happen.
- lbotos 9y ago
  What would that breach look like? I'm asking sincerely, because I can't fathom what kind of data breach that would be that wouldn't be able to be "smoothed" in a mater of days. - Black card number stolen? Card frozen. - FDIC insured account attempted to be flushed. Banks flag and or fraud protected.
  - yardie 9y ago
    Because it won't pop up right away. It will show up when that line of credit taken out in your name goes into collections 90 days from opening. You should read up on the havoc that is caused with stolen identity. I'm not talking stolen credit cards, more like unknown judgements taken out against you and wage (in extreme cases, wage garnishments).
  - WorldMaker 9y ago
    FDIC has a per-person insurance liability limit of $250,000 per bank. It's possible you could find an idiot with more than that in a single bank, presumably in CDs, with no other insurance coverage on it. You need some sort of strange reverse Nigerian Prince scheme to cash that out without a paper trail ("I'm executing his will and he explicitly stated to hand out all of his assets, damn the losses, as $20 bills and fresh turkeys to orphans and other passersby on Christmas Day." Maybe call it a "Christmas Carol scheme"?). It's unlikely to be worth the time investment in terms of being a useful bank robbery, but it certainly would send a weird message to someone.

mikestew 9y ago

Yeah, that's why I bought Equifax call options a little bit after the breach was announced. Made good money on those options, and it pisses me off. It pisses me off that after an event that should bankrupt a company such as Equifax, I lay hard-earned on the table knowing that I have an extremely good chance of a healthy ROI simply because of vested interests and status quo. Like other political hot topics, this is one of those things that causes me to ask, "okay, then, how bad does it have to get before populist outrage brings about change?" Something worse happens, and this is the time, right? Nope. And so on from one event to the next. OTOH, in this case maybe the invalidation of vast amounts of data will alone bring about changes out of necessity. There will probably be a rough patch of lawsuits, debate, and perhaps a new law or two, but perhaps it will eventually shake out something better.

JumpCrisscross 9y ago
> how bad does it have to get before populist outrage brings about change? We had a bill in the New York State Senate after the Equifax breach [1]. It was dead on arrival. Practically nobody called in to offer support. It was apparent that nobody's political career would be made nor broken by this bill. When it died, there was no press; nobody noticed nor cared. [1] https://www.nysenate.gov/legislation/bills/2017/s1104/amendment/a https://www.nysenate.gov/legislation/bills/2017/s1104/amendm...
- mehrdadn 9y ago
  I'm guessing most people didn't know about it to offer support? Seems like a failure of the press if they didn't monitor bills and bring awareness... That said, I'm not sure how much of a fix timely disclosure is. Maybe people thought it wouldn't go even remotely far enough to help a significant number of people and hence wouldn't be worth it. (I could even see it being harmful if it makes it less likely to get more serious legislation passed.)
  - JumpCrisscross 9y ago
    > I'm guessing most people didn't know about it to offer support? A bit of this, a bit of that. I was excited about the bill and offered to help. When it came to selling it, however, people were more animated by Trump, affordable housing and the MTA. Despite our obsession with privacy on Hacker News, it hasn't been properly sold to the public. > I'm not sure how much of a fix timely disclosure is It was to allow the Attorney General to investigate these crimes. Right now, there is no disclosure requirement. Unless the company reports its breach and co-operates with state Attorneys General, they basically can't be held accountable at the state level. So, naturally, they refuse to co-operate.

davesque 9y ago

Given how technically inept and thoroughly entrenched the major institutions of our financial system are, I'm almost at the point where I'm waiting until Russia or North Korea reveals that they've been planting malware for years in all of our major banks and that they're going to go ahead and push a big red button and just take all our money. Or maybe that's already happening and they're being smart by not talking about it.

JumpCrisscross 9y ago
> go ahead and push a big red button and just take all our money This would result in a twenty-four hour recession. The U.S. banking system can be shut down [1] while records are analyzed and fraudulent transactions reversed. Presumably a digital hack would result in digital dollars being stolen and subsequently frozen. Whatever couldn't be recovered would probably be, in large part and at least at the retail level, re-imbursed with new money. [1] https://en.wikipedia.org/wiki/Emergency_Banking_Act https://en.wikipedia.org/wiki/Emergency_Banking_Act
greenleafjacob 9y ago
Thankfully since we aren’t all using Bitcoin, all such transactions can be reversed.
- davesque 9y ago
  But you can't spend any Bitcoin unless you possess some wallet's secret key. Explain to me how that poses a comparable risk to the egg baskets that are today's financial institutions. If your secret key isn't compromised, there's just no way your coins can be transferred. Furthermore, in the event that any kind of mass fraud takes place which exploits some flaw in the protocol itself (contrasted with a flaw in an exchange platform or something similar), the ledger could be hard-forked. It was done after Ethereum's DAO debacle with /relatively/ little consequence.

mehrdadn 9y ago

Is it known how many people have actually gotten their identities stolen so far as a result of this attack? I would imagine it would not end up high on Congress's priority list if the number is still low.

g051051 9y ago
Known? As of now, 0. Some people are blaming the Equifax breach for identity theft, but it's highly unlikely that was the case, they're just picking the easiest target.
- mehrdadn 9y ago
  How about "known" in the sense of "there's a significant uptick of ID theft cases here after the breach statistically that sure suggests it was the cause, but we obviously can't necessarily pin down any individual cases on any individual breach"? a.k.a.: how much evidence is there of actual harm having resulted from the breach?
  - g051051 9y ago
    Again, pretty much 0. I haven't seen a single reputable report of any statistically significant increases in ID Theft.
- decebalus1 9y ago
  It's too early to tell. They may be still sitting on the stolen data for multiple reasons: - the 1 free year of identity protection to expire - if there's a surge, it will definitely be on the radar, it will be more publicized and more and more people will take defensive actions (like buying extended identity protection and/or freezing credit). As we can see, it kinda blew over. I mean, that's what I'd do if I'd be in the 'stolen data' business.

MollyR 9y ago

Infuriating. We need digital consumer protection laws to put increased pressure on companies to take cyber security seriously.

g051051 9y ago
True, but we mainly need a better way to validate identities than information that is easily stolen.

gehwartzen 9y ago

It's pretty amazing just how much data Equifax has on consumers. They also own TheWorkNumber which contains data from HR/payroll of any company using the service (everything from pay, title, insurance info, union affiliation etc). I'm not sure what hackers got away with but potentially much more than just some SSNs. Then there are countless other credit analytics companies hoarding all kinds of other specialized data. It's scary to think about. As a PSA: check out the list [1] of credit reporting companies that the CFPB puts out. It has the names and contact info for most and you can get copies of your full reports from them upon request (most are either required or do so voluntarily). It's a lot of effort to hit all of them but pretty eye opening and, frankly crazy, to see just how much is tracked. There are databases for how often, and where, you return items to stores/businesses as one example. [1](http://files.consumerfinance.gov/f/201604_cfpb_list-of-consumer-reporting-companies.pdf http://files.consumerfinance.gov/f/201604_cfpb_list-of-consu...) List Of Consumer Reporting Companies

deleted 9y ago

[deleted]

syshum 9y ago

That is because they are attempting to solve the wrong problem Congress needs to do 3 things 1. Find away to limit and prohibit SSN from being used for Identity. 2. Give People Ownership over their PII, end the concept of "who collects it owns it" 3. Make companies liable for damages when they lose control over PII that is collected Congress does NOT, should not, and likely can not create rules and regulations to govern data storage, security, etc. They should stop trying as that is not a problem they need to solve nor is it a problem that should be "fixed" in law

jedikv 9y ago

Did anyone manage to successfully obtain a police report number as a result of this fuck up by equifax?