19 ms·
A year later, Equifax has faced little fallout from losing data
- goshx 8y agoAnd if you need to set a fraud alert with them you have to do by mail. FML.
- abawany 8y agoHmm, I was able to lock my credit history with all 3 bureaus without using mail; TransUnion was the highest touch in that it required phone confirmation. Prior to that, I had been using the 90-day fraud alert, which I always set online every 90 days.
- goshx 8y agoFor some reason they don’t allow me to do it online. Probably because they were the ones providing my data to whoever is using it.
- usermac 8y agoNothing is going to happen to them in the future as well.
- cperciva 8y agoThey didn't lose anyone's data. They just made accidental public backups. (Seriously though, the use of the same word to describe data loss and data theft is problematic; depending on the nature of the data, one well typically be far more serious than the other.)
- paulddraper 8y agoreleased or leaked
- solarkraft 8y agoI like leaked more than the other suggestions, but it still sounds so ... not reckless. There needs to be way more judgement.
- drdeadringer 8y agoWhy would they leak the data? That seems counter-intuitive to me.
- criddell 8y agoNegligence, incompetence, and apathy.
- craftyguy 8y agoThey lost control of it. Meaning, they no longer control access to it.
- mr_toad 8y agohttps://en.wikipedia.org/wiki/Data_breach https://en.wikipedia.org/wiki/Data_breach
- seangrant 8y agoIt upsets me a lot how these financial institutions have complete power over us. God forbid a bank writes a loan to a scammer in your name, cause to them it's your fault. Absurd!
- nightcracker 8y agohttps://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- dude01 8y agoThis is the Identity Theft sketch -- love it!
- tryptophan 8y agoYes! The only real change that needs to happen is that banks needs to be liable for loans they write in your name fraudulently. If they accept stolen data without verifying it is actually you, it needs to be their fault. The current system of it being your fault makes no sense.
- mysterypie 8y ago> banks needs to be liable for loans they write in your name fraudulently Is this not the case already? I know that it could be an incredible hassle to prove that you didn't take out the loan and that someone else has stolen your identity. (There's also the question of who has the onus of proof -- you or the bank.) But if it's a fraudulent loan and you could prove it was fraudulent (which I agree could be difficult to prove), can you be held responsible?
- asdfasgasdgasdg 8y ago> But if it's a fraudulent loan and you could prove it was fraudulent (which I agree could be difficult to prove), can you be held responsible? The simple answer to this is "no." Identity theft can take time and, occasionally, a small amount of money to clean up. This has a very real cost if you happen to be a person that has little of these resources. But you can never* be held responsible for a loan you didn't take out. This is also the core reason why Equifax has not suffered many consequences: it's because the real world harm of their negligence simply wasn't that significant. I don't even know if there is any data to show that the number of identity thefts has increased in the wake of their breach. *Unless I guess you receive a summons to a court date and don't show up and someone gets a default judgment against you. "Never," here, as usual, means "extremely rarely."
- spaceribs 8y agoEquifax and what they do is the epitome of uselessness [https://www.vox.com/2018/5/8/17308744/bullshit-jobs-book-david-graeber-occupy-wall-street-karl-marx https://www.vox.com/2018/5/8/17308744/bullshit-jobs-book-dav...] They are a company whose sole purpose is to track how reputable a consumer is, which is entirely extrajudicial and arbitrary. How do you fine/hurt/stop something which is pure made up bullshit and had no purpose to begin with?
- tboyd47 8y agoIt's also blatantly unconstitutional because it discriminates against the sects of Islam that don't allow loans with interest (and that's the only way to build "credit").
- InitialLastName 8y agoThe constitution only applies to the federal government. You might mean illegally discriminatory per the 1964 Civil Rights Act, which disallows businesses to discriminate on the grounds of religion. Even that, though, might only be applicable Equifax's customers, since those are the businesses who would be denying service to people without credit histories.
- tboyd47 8y agoThanks, I misspoke. IANAL but I still think Equifax itself is in the wrong. You can't expect businesses that deal in credit to skip due diligence on their customers. Equifax (and the other 2) get to define creditworthiness for all these other businesses.
- abraham_lincoln 8y agoThat would be libel, then.
- g051051 8y ago> Equifax (and the other 2) get to define creditworthiness for all these other businesses. They do not. The CRAs provide the information, and the individual businesses decide what their limits are. A lot of businesses standardize on FICO scores, which just use CRA data. So a business decides what's acceptable, based on the info from CRAs and the model from FICO.
- mlthoughts2018 8y agoI see so many comments on HN arguing that being outraged about this type of thing and pedantically hammering on it even unto the detriment of your personal life is not worth it. Comments arguing the opposite get sanctimoniously downvoted, whether it’s prolonged outrage about police brutality, abuses of political power, unpunished fraud or privacy breaches, and so on. But truly it just seems like sustained outrage is just not high enough to bring about justice.
- whatshisface 8y agoA politician could probably sweep the board picking up all of this unresolved outrage laying around, I don't understand why nobody is trying to do it.
- darkmighty 8y agoIt's about balances of power. There's unfortunately a strong tendency for corporate power to overwhelm all other institutions, given how centrally organized, self-optimizing, evolving it is. Government ideally should offer a balancing power, an equally intelligent, evolving structure safeguarding individuals (and humanity vs economics). The problem is corporations have found ways to control governments and will use their power to terminate impacts on their productivity, which will inevitably include human rights, quality of life, human values. The only solution I can see is through legislation, strictly forbidding and creating institutions to prevent corporate interferance in government. Some measures: 1) Outlawing lobbying more broadly, improving campaign financing, etc. 2) Reforming the government to promote greater adaptability and efficiency, mimicking how companies improve themselves through competition. There are quite a few examples of countries with good control over corporations (Japan I think is quite strict at least in terms of election financing and advertising), and good alignment of government and human values. But many others, notably by the US, turn more and more the opposite way towards corporate/economic absolutism. It's been said before, but people put a little too much fear into AI takeover when gigantic, scalable, self-improving systems with trivial values (economic output) are already almost taking over the world. Fear The Corporation.
- kodablah 8y ago
- alexnewman 8y agohttps://clark.com/personal-finance-credit/equifax-lawsuits-small-claims-court/ https://clark.com/personal-finance-credit/equifax-lawsuits-s...
- solarkraft 8y ago> West sued Equifax for nearly $5,000, but the judge agreed to give her $690 ($90 of which was for court fees) Come on. > Going toe to toe with Equifax’s representative in front of a judge, Haigh won $8,000. That's better. But you could still argue that it's not adequate.
- siphor 8y agoanyone know why there hasn't been a class action lawsuit around this? If individuals could win....
- the_unknown 8y agoI'm most disappointed in the Canadian gov't and their lack of action. This would have been the perfect opportunity to mandate change - We don't have to send data on all of our people and their credit history to this American company. Or at least without actual legislation and rules around governance, security, and actual penalties for breaches. Instead we let them get away with - no more than a handful of Canadians were affected - followed by - oops, yup lots of Canadians - followed by - holy heck, how many Canadians are there way up there? We don't need to go along with this. Yet it never seems to get better.
- cat199 8y agoTime to call Theo de Raadt! https://en.wikipedia.org/wiki/Calgary_Internet_Exchange https://en.wikipedia.org/wiki/Calgary_Internet_Exchange
- branchless 8y agoTrudeau doesn't have the stomach for anything this complex.
- 3pt14159 8y agoDid you write to your MP? Did you meet with them? These things only get fixed when people speak up. I met with my MP over the weaponization of autonomous systems. I've put a ton of work into understanding where all this is headed. I spoke up[0] at the hearing on electoral reform about the cybersecurity risks of computerized elections, but I'm only one man. I've been able to get some things through, like pressuring the Liberal Government to put up more resources[1] but political will lags public outcry. If you want something changed you can't just complain online in your little bubble. [0] I was one of only two people that spoke up about it and it was added to the final report. The world is changeable. What it takes is showing up and pushing hard. [1] https://www.cbc.ca/news/politics/budget-billion-cyber-security-1.4547685 https://www.cbc.ca/news/politics/budget-billion-cyber-securi...
- the_unknown 8y agoGood question though obviously asked assuming the opportunity to judge and belittle judging by the "...you can't just complain online in your little bubble." I actually did and ended up with a purely political answer blaming the difficulty of regulation and consumer-beware-ism. Even though in this particular case there really is no opportunity to beware - its either go with the banks that are all part of this or live on a commune singing about flowers -- and it is way too cold here in the winter for that!
- sebazzz 8y agoOr how corporate USA get unpunished over and over again.
- jimnotgym 8y agoOk I will be the one to start it. This it's why we needed GDPR. The courts have been totally unwilling to combat this kind of corporate malpractice, assessing the costs of a breach to be puny. My opinion is, if your business is sensitive data then being careless with it should be an existential threat to that business.
- lwansbrough 8y agoWe don’t need GDPR. We need sane penalties for data breaches caused by incompetence. The last thing Canada needs is to put ourselves at any more disadvantage with the US market.
- Sharlin 8y agoYou mean data breaches are fine as long as they’re intentional?
- iamdave 8y agoThat's the exact opposite of what they meant and is what Hanlon preaches to us about.
- wongarsu 8y agoIf you divide causes into "accidental" and "intentional", and assume "caused by incompetence" belongs into the "accidential" catagory, then the comment "We don’t need [X]. We need sane penalties for [Y] caused by incompetence" can be read as arguing against penalties for intential actions. If they meant the opposite of that, then that's a really weird way to express it.
- Sharlin 8y agoSo what did they mean? GDPR is basically what they said, plus that you have to show you have made a meaningful effort to stop data breaches from happening before they happen. Is that bad? Intentional data breach is basically the business model where you sell private information without getting meaningful consent from your users. Do you think that is okay because you need that to stay competitive with US companies?
- spullara 8y agoThey didn't lose your data they shared it.
- paulddraper 8y agoIt'd have been nicer if they had lost it.
- mrnobody_67 8y agoSocialize the losses, capitalize on the gains. Just like all the big banks in 2008.
- harryh 8y agoRevised headline: A year later, the vast majority of people have faced little fallout from having data about them inadvertently made public. Nearly all of the dire predictions made at the time of the breach have been wrong to date.
- darkerside 8y agoTell that to my coworker who spent all day on the phone last week fighting identify fraud with his bank. The impacts will be intermittent lightning strikes on random people at random times. To everyone else, business as usual.
- harryh 8y ago1) A few hours on the phone != getting hit by lightning. 2) It's still a bit early to trust the data, but so far identity theft rates do not appear to be up significantly in the aftermath of the equifax breach.
- kodablah 8y agoAre you saying this anecdote makes the dire predictions accurate? Or are you just saying it had > 0 effect? The parent post was talking about the former as a whole, not sure it's worth countering with the latter.
- paulcole 8y ago> The impacts will be intermittent lightning strikes on random people at random times. To everyone else, business as usual. And that's acceptable to virtually everyone.
- pizzazzaro 8y agoUntil it affects you. Then you're outraged, but too late to do anything.
- g051051 8y agoCan your coworker trace the identity fraud to the Equifax breach? As opposed to all of the identity fraud that happened throughout the years before the breach?
- b0rsuk 8y agoI suppose users are just "getting used to" data breaches? Like clicking your way through pop-up windows asking for permission to install?
- draw_down 8y agoThese breaches are a story in the news for maybe a couple days and then it’s down the memory hole. Unless it’s your property being affected as in the Sony hack, what’s the point of worrying about it? There are basically no consequences.
- mjevans 8y agoAt least the US, and probably other countries as well, have the issue of no reliable means of /authentication/. I feel like this won't be solved until a proper national ID replaces the thing that __everyone__ is forced to use as one even though it isn't supposed to be; 'social security' numbers. That method would need to be secure, reliable, and traceable. All contracts / inquiries that require use of the identity signature would also need to register that use; ideally the government would run an observation oracle that mirrors the publicly published signatures each agency hosts on their own (which would be a defacto place to check for use/abuse of the signatures). This would also oblivate the need for services like equifax to exist at all.
- spydum 8y agoAgree, too often we are using drivers licenses #s (which btw, are public record often), address, phone numbers, and worst case SSNs and foolish "security questions" in the US for identity. None of these are appropriate authenticators of a person, and almost all of this data has been leaked in the past. I think if there is anyone who is well suited to tackle this, it's.. banks. There are so many bank locations, most people have an existing relationship with a local bank. If we allow tellers in banks responsible for verifying identity of people (the same way a social security office or DMV office verifies a person: birth certs and records checking), they could be be paid to be the hands and feet of something like national ID system.
- AnssiH 8y agoI think the availability of digital authentication methods significantly varies by country. E.g. here in Finland TUPAS (https://en.wikipedia.org/wiki/TUPAS https://en.wikipedia.org/wiki/TUPAS) is used by both government sites and private companies. It relies on two-factor bank credentials that almost everyone here has. Two-factor has been standard since online banking became a thing in the 90s and all banks are part of the ~10 bank groups so there aren't any small unsupported banks that I'm aware of. Government sites also support ID cards but no-one uses that option. I believe some other countries have working, but different, digital authentication schemes as well. Maybe Estonia and Belgium? These don't work over the phone, though, and asking for address and your identity code (or some part thereof) remains a common over-the-phone "verification" method, at least here. So the identity code / social security number issue still exists, at least to some extent.
- tarr11 8y agoHave there been any studies about the actual consequences of these data breaches on victims (in terms of fiscal, social or even emotional impact)?
- ARothfusz 8y agoThe correct response should have been for credit card holders to sue their credit card companies. We have a relationship with the card companies, and they chose to share data with a third party, so the credit card companies are responsible. This class action suit did not happen as far as I know. Why not? If we're so outraged and thus there's a market for it, why didn't banks start offering their own credit cards with guarantees not to share your data with any third parties? Also, why should it be risky for someone to know your name, address, and social security number? Yes, I agree it is risky, but it shouldn't be. Those things are not me. They're not even secrets. Knowing those things should not give you superpowers.
- iamdave 8y agoThat class action suit did not happen as far as I know Yes it did. The complaint can be found below. https://images.law.com/contrib/content/uploads/documents/398/20174/Equifax-consumer-complaint.pdf https://images.law.com/contrib/content/uploads/documents/398...
- ianai 8y agoAny idea whether it’s going anywhere?
- deleted 8y ago[deleted]
- p49k 8y agoThe correct response should have been for credit card holders to sue their credit card companies. Which we won't be able to do at all in a few years thanks to the ubiquitousness of forced arbitration clauses?
- maxsilver 8y ago> The correct response should have been for credit card holders to sue their credit card companies Why? Why should it be the victims job to find and prosecute criminals? Should victims also be responsible for breaking up monopolies? Or cleaning up oil spills? Or to keep hospital patient records private? How much time and money should victims be required to invest in lawsuits, to bring justice against illegal mistakes made by entities with thousands of people and million/billions of dollars? Wouldn't it be better if we had government agencies draft and strictly enforce regulations to prevent this. Like say, an EPA for environment, or HIPAA for healthcare, or GDPR for consumer/business data?
- cryptozeus 8y agoThis is the same case like big banks during financial crisis. I can’t believe they are still a running company after such a big blunder. Worst part is I as an individual never wanted my social security and personal data be mined by such companies let alone have it hacked. We have no say in this.
- cheriot 8y agoA Trump appointee ended the investigation into Equifax https://www.reuters.com/article/us-usa-equifax-cfpb/exclusive-u-s-consumer-protection-official-puts-equifax-probe-on-ice-sources-idUSKBN1FP0IZ https://www.reuters.com/article/us-usa-equifax-cfpb/exclusiv... Wikipedia has more of this guy's greatest hits. I especially love this one: "In January 2018, Mulvaney canceled an investigation into a South Carolina payday lender that had previously donated to his congressional campaigns." https://en.wikipedia.org/wiki/Mick_Mulvaney#Tenure_2 https://en.wikipedia.org/wiki/Mick_Mulvaney#Tenure_2
- andirk 8y agoGreat find! I like the "Mulvaney submitted a quarterly budget request for the [Consumer Financial Protection Bureau] to the Federal Reserve for $0." And after trying to shut down the database of consumer complaints, turns out "8 of the 10 firms with the most complaints about them had contributed to Mulvaney's campaigns."
- darepublic 8y agoThe problem is that I have no choice but to use equifax when I need to do anything involving my credit rating. They have a bizarre monopoly on this vital aspect of life. When I go to the banks asking for them to give me my credit score that they have on file they defiantly refuse me.
- blondie9x 8y agoIt's interesting there is more concern and discussion regarding social media privacy but very little discussion of this PII information that consumers are not able to control at the moment. Why should consumers not be able to control who can access this PII data and when they can request it be deleted? They can do so with social media data, so why not this? If they do choose to delete it with a given company another company can retain it who has exercised more fiduciary responsibility by keeping consumers secure. If the company changes and fixes the holes then consumers should be able to start sharing data again with that company from that point forward.
- pasbesoin 8y agoFurther evidence of the lack of any effective competition in this space. And of wholesale regulatory capture. So, U.S. public, what are you going to do about it? Bolster organizations who can effectively mitigate (public or private, to put that agnostically), or let the wave carry you under?
- RickJWagner 8y agoData is like 'electronic IP' such as videos, music and computer programs in that it's a precious resource that's easily stolen. The problem is that it's not easy to secure. Physical things can be stuck in a vault or watched over by armed guards. Electronic IP can be swiped in the blink of an eye and replicated many times once obtained. It's a hard problem. To date, only ham-fisted excessive financial fines have been used to scare the general public. That technique isn't viable for the long term-- we need something better.
- kalalala024 8y agohttp://www.natives.co.uk/videos/ufc-228-live/109132 http://www.natives.co.uk/videos/ufc-228-live/109132
- delinka 8y ago"little fallout" Pfft. They've been required to offer credit account locking and unlocking services without charging individuals for the privilege. That's a serious blow to executive bonuses. Surely they'll all have moved on to other companies with a more encouraging compensation structure, leaving Equifax a shell of its former self.
- godelski 8y agoThat's not really that big of a blow. Unless I'm greatly misunderstanding their business, in which case I'd appreciate it if you enlightened me.
- delinka 8y ago+= "/s"
- draw_down 8y agoCome on
- mrhappyunhappy 8y agoLet's see, 3 billion revenue, 200 mil expense - yeah, a serious blow alright.
- daveheq 8y agoYet we'll keep thinking this is an Equifax problem without realizing it's a systemic problem with companies we rely on ubiquitously with hardly enough regulation above them to prevent them from maximizing exploitation.
- noobermin 8y agoIs this really a surprise? The Trump administration's Justice Department is too busy trying to get voter registration records from NC to investigate voter fraud. They don't have time or interest in things like this.
- vipulved 8y agoA more positive implication is that downstream security has gotten good enough that large breaches like this can’t be systematically exploited for financial gain. Two factor auth seems to be more pervasive, and there’s a host of retrospective security tools in the industry. That said, I have no doubt there’s a vibrant underground market for all this data, and its likely being used in more surgical attacks already, and could, one day, be the basis of a broad attack (once an appropriate attack vector becomes available).
- dv_dt 8y agoA more interesting question is if costs of fighting financial fraud and or identity theft using the stolen credentials has noticeably increased in the past year. I suspect the costs of this are being borne systemically with consumers paying in slightly higher interest rates on loans/credit cards, etc.
- dwd 8y agoWhat I don't see anyone actually asking is who was behind the breach given the sophistication of the attack and the measures they went to to avoid detection. This wasn't the case of a database just sitting in the open that they could access. The actual report makes for better reading than Tech Crunch. https://www.warren.senate.gov/imo/media/doc/2018.09.06%20GAO%20Equifax%20report.pdf https://www.warren.senate.gov/imo/media/doc/2018.09.06%20GAO...
- duxup 8y agoHeck one of the former Equifax guys went to work for Panera Bread (of all places) and didn't even know what a security researcher was telling him when he identified an API that was wide open.... https://www.csoonline.com/article/3268025/security/panera-bread-blew-off-breach-report-for-8-months-leaked-millions-of-customer-records.html https://www.csoonline.com/article/3268025/security/panera-br...
- reilly3000 8y agoIt is so damn difficult to prove substantial damages to be directly attributable to a specific data leak. It isn't right, but it also isn't reasonable to attribute a specific identity theft incident to a specific leak. My data has been compromised by at least 1 dozen corporations in the past 3 years. Whom is to be held accountable if my identity is compromised or my opinion influenced maliciously as a result of a breach? It isn't as it this data has some chain of custody that can show which actor sold it to another and whom used it for a spearfishing campaign. Our secrets are laid bare to whomever has the will to partake of them. Sometimes I wonder why it is considered immutable that human malice is an unstoppable force. I want my kids to live in a world where those who leak data and those that use it to malign others are rare and held accountable in a manner that is truly commensurate with their cost.
- Aeolun 8y agoIt _is_ rare. But that doesn’t mean those who let your data leak should go unpunished. You don’t need to figure out who was the cause of a specific misuse, you just punish the data being leaked in the first place. Though I guess you need to figure out a way for companies not to hide the leak then.
- adiusmus 8y agoPeople who don’t interact with politicians and often don’t vote can’t have an opinion about anything political. They are not in the game. Fortunately this is easy to fix.
- tomohawk 8y agoThis will really only end when the credit rating agencies become irrelevant. Large purchases should be based on ability to pay, which is different than credit rating. You can have a credit rating of zero just because you don't use credit - even though you have plenty of money in the bank. If you are running a business, why not avoid equifax and other credit raters and use a different mechanism? If you are looking to startup a business - doesn't this look like an area that needs disruption?
- paulddraper 8y agoMost loans require both: (1) an ability to pay (payer stubs, tax returns) and (2) a history of paying back loans in the past.
- amarand 8y agoThis is disturbing, but, really, is it surprising? The GOP is in control of all three branches of government in America, and they're always very pro-corporate power. Equifax's data breaches were caused by criminally-insufficient security controls, by a company large enough to know better. They could have secured the data and chose not to. They could have brought in third-party auditors, yet chose to not spend the money. So it's on them. Hopefully, we can hold Equifax accountable at some point, when the politics become a little more consumer-friendly again. Right now, it's almost 100% on the side of corporate rights.
- _Codemonkeyism 8y agoAnd VW has excellent sales.
- Ryantrav17 8y agoI just noticed a past due collections i knew nothing about on my credit report and my score was very low. I called the credit collections company to pay off the debt and help fix my score. The credit collections company said that it’s up to credit bureau. I also contacted Transunion and they said it has been long on my report and nothing can be done. I keep searching online and making inquires but all effort to correct this was proven abortive and i need to do this very fast for me to qualify for a house mortgage. Some weeks ago I came across this credit wizard (EXCELLENT REPAIRS), who many have recommended how he helped them with their credit score. I contacted him and asked if he could help me. He answered boldly yes and explains to me in detail the whole process. We reached to an agreement and i gave him a try and to my greatest surprise he did an amazing job. 3 items were removed including the past due and my score has boost to a high 782. I’m ever grateful to him and want to recommend him for he is reliable, discrete and trust worthy, he will put a smile on your face as he did to mine. You can contact him via his email EXCELLENTREPAIRS@TECHIE.COM. He can also fix a chexsystem report and a DUI report as well. Thanks Ryan.
- siruncledrew 8y agoEquifax has been heavily marketing to banks this new product called InstaTouch, which they want to be a credit card application handler. The feature they advertise the most is "security and risk management for banks". Uhh, no.... clearly they didn't learn from their mistakes and don't care.