14 ms·

Submit Your Claim in the Equifax Breach Settlement

301 points by caymanjim 7y ago

simonsarris 7y ago
It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm surprised it hasn't already.) After all this site links to the law firm JND, but nowhere does JND mention this site. So any of us could have made this site. Use the form below to find out if your information was impacted and if you are a class member. Last Name _______ Last 6 Digits of Social Security Number ________
- Zombieball 7y ago
  A security researcher setup a similar domain with a phishing page. Equifax made the mistake of linking to his page rather than their own on twitter!!! https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/business/equifax-fake-website.amp.html https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/busin...
- jwp23 7y ago
  Your comment inspired me to take a look. I compared the SSL certificate and the whois information to equifax.com. The settlement site uses a different company for the certificate. The settlement site uses Starfield Technologies vs DigiCert for equifax.com. The settlement site uses GoDaddy for their DNS vs UltraDNS for equifax.com. It's not impossible that a division in the company or a different law firm uses different SSL certificate provider and DNS provider, but it may point to some caution. Edit: As another commenter pointed out, this site is linked to from the FTC site about the breach.
  - ocdtrekkie 7y ago
    Being linked to from the FTC isn't a safe bet. Bear in mind Equifax sent people to a fake Equifax website before: https://money.cnn.com/2017/09/20/technology/business/equifax-fake-site-twitter-phishing/index.html https://money.cnn.com/2017/09/20/technology/business/equifax...
  - deleted 7y ago
    [deleted]
  - simonsarris 7y ago
    Yeah its totally legit, its just funny to think about. I expect it to happen someday. This site is using godaddy presumably because the law firm also does, though they do use different certs!
  - azernik 7y ago
    You're assuming that this site is run by Equifax; it is not. It is run by a "Settlement Administrator", a third-party entrusted by the court to handle the money and record-keeping associated with a class-action settlement. This is to avoid possible manipulation of the settlement by the defendant.
  - devcpp 7y ago
    Why compare it to Equifax? I'd just assume it's an unrelated malicious opportunist. I'd rather compare it to JND to have evidence towards proving that it's legit. Anyway it is legit since it's mentioned on the FTC site.
    - jwp23 7y ago
      I made a faulty assumption. As others have pointed out, the settlement site is run by a third party.
    - niij 7y ago
      At this point I'd consider the government more competent than Equifax.
  - mandevil 7y ago
    Legally, the settlement administrator must be totally independent from Equifax, so comparing their hosting providers, cert providers, etc. you'd only expect them to match by random chance.
- moonlighter 7y ago
  Here's the "official" page on the ftc.gov site, which has links to the settlement site in the FAQ section. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
- acomjean 7y ago
  Update. I tried a different last name and told I wasn't eligible, so thats good. >I just entered "Smith" and 6 digits. (Not real) I was eligible.
  - ocdtrekkie 7y ago
    Arguably, your best bet for this kind of test is a very blatantly fake name, like "Zxzxzx". It's entirely possible that there is someone with the last name Smith (since it's very common) who also has those six digits at the end of their SSN.
    - acomjean 7y ago
      Good point.. I tried "potter" and I got Not eligible. So either I'm a great last digit guesser (Though I'm usually not lucky in things like gambling....) I'll update my original comment.
      - ocdtrekkie 7y ago
        It may not be so much a great guess as a statistical likelihood! In 2000, there were over 2.3 million Smiths in the United States: https://blogs.ancestry.com/cm/smith-a-short-history-of-americas-most-popular-surname/ https://blogs.ancestry.com/cm/smith-a-short-history-of-ameri... (This number has likely grown roughly alongside our population, so let's use 2000 numbers for this.) In 2000, we had 281 million people in the US, which means 0.8% of Americans have the last name Smith. If we assume every possible SSN could be handed out, a trailing six digit entry could have anywhere up to 999 possible SSNs, so you're firing out a shotgun with a pretty big number of potential targets each time you guess an SSN.
- astura 7y ago
  Its somewhat of an unsolved problem, there's all sorts of these kind of sites that are legitimate but look really suspicious, like they could be phishing sites. Examples: https://www.annualcreditreport.com/ https://www.annualcreditreport.com/ https://www.optoutprescreen.com/ https://www.optoutprescreen.com/ You can tell these two are legit because they are listed on official government sites: https://www.ftc.gov/faq/consumer-protection/get-my-free-credit-report https://www.ftc.gov/faq/consumer-protection/get-my-free-cred... https://www.consumer.ftc.gov/articles/0262-stopping-unsolicited-mail-phone-calls-and-email https://www.consumer.ftc.gov/articles/0262-stopping-unsolici... However, I can see how some people wouldn't think to go through .gov sites and there's really nothing stopping me from registering a phishing site with a similar domain and hosting it in Russia or something to confuse people into using mine rather than the official one. I think freecreditscore.com has been confused with annualcreditreport.com in the past. Freecreditscore.com is owned by Experian now and it actually does offer a real free no strings attached credit score NOW, but in the past it used to be one of those sites that tricked you into signing up for a subscription. Then, of course, there was the Equifax data breach site that totally looked like a phishing site.
  - rhizome 7y ago
    It's only a problem if the authority is obscured by an unrelated domain name. If the page was a location on a site with known authority, or a subdomain, it could be validated much more easily. Unfortunately, vanity gets in the way.
    - astura 7y ago
      Its not just vanity though, in these two cases "the authority" is the industry as a whole, thus many "authorities." For example: >OptOutPrescreen.com is a joint venture among Equifax Information Services, LLC, Experian Information Solutions, Inc., Innovis Data Solutions, Inc., and TransUnion, LLC (collectively the "Consumer Credit Reporting Companies"). >[annualcreditreport.com] is maintained by Central Source, LLC. Central Source, LLC is sponsored by Equifax, Experian and TransUnion so you have a single site where you can ask for all three of your free credit reports.
- caymanjim 7y ago
  I got this site link directly from the FTC's settlement announcement, or I would have worried about that myself. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
- _bxg1 7y ago
  The FTC - verified on Twitter - tweeted the URL. That chain of trust is good enough for me.
- partiallypro 7y ago
  The site didn't ask for my social
  - bdcravens 7y ago
    It asks for the SSN (last 6 digits) on the eligibility page, not the claim page: https://eligibility.equifaxbreachsettlement.com/en/eligibility https://eligibility.equifaxbreachsettlement.com/en/eligibili...
- jcsnv 7y ago
  I was wondering this as well, but the link came from the FTC's site: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
- chpwssn 7y ago
  You think they would have learned since the breach. Right after the breach was disclosed they made their information page equifaxsecurity2017.com. It had the same prompt for last name and last digits of the visitor's SSN. Then just said something along the lines of ~"Thanks for the information, we'll have more details later".
- espeed 7y ago
  Search for "Copyright © 2019 JND. All rights reserved" -- there are a ton of sites of the same form.
- dwild 7y ago
  In Quebec we recently had a massive information leak from Desjardins, a credit union used by most of the population. It didn't take long for people to receive phishing SMS trying to get information from people. It's not exactly the same, but work the same way.
- foxc 7y ago
  how do you know it links back to JND?
- Vordimous 7y ago
  I put in bogus name and social. It said i was affected by the incident. So.... Probably phishing.
deleted 7y ago
[deleted]
toomuchtodo 7y ago
Reddit thread with detailed information on claim submittal [1]. [1] https://www.reddit.com/r/personalfinance/comments/ch9tcj/claims_are_now_being_accepted_for_the_2017/ https://www.reddit.com/r/personalfinance/comments/ch9tcj/cla...
deleted 7y ago
[deleted]
aaronmid 7y ago
https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq... It's mentioned in the FTC site.
jbredeche 7y ago
If this breach affected 147M people (which is what I can find from various articles), and $700M was set aside (before attorney fees), and most claims will be $125, that's only ~4M people who will get $125. Are they expecting very few people to file claims? Or what am I missing?
- scld 7y ago
  Perhaps they are counting on a certain number using their free credit monitoring, as that's the other option on the site.
  - bdcravens 7y ago
    It's also the default, so some will just click through
- TallGuyShort 7y ago
  It sounds to me like they'll give you free credit monitoring, UNLESS YOU ALREADY HAD CREDIT MONITORING, then they'll give you $125. Most people don't have credit monitoring, I think. Personally, I've found the free credit monitoring that they gave me pretty useless. I get an email regularly telling me my score changed. I have to go log in and find out I went up 2 points because of an algorithm change. Thanks for looking out, Equifax! Then I go to a dealer and they pull my credit and it's dramatically higher than what Equifax has been telling me. The whole system seems silly to me.
  - krastanov 7y ago
    It is either-or, not both. If you want the money you have to promise you have credit monitoring from somewhere else. Credit Karma (for example) counts as free credit monitoring and you can easily make an account before making the claim. Many credit cards come with monitoring too.
    - markholmes 7y ago
      I believe NerdWallet counts as well.
lr 7y ago
They can keep the $125 (although, I wish I could direct it to a charity). I don't want to submit all of this information to an entity who's data security is probably worse (hard to believe) than Equifax!
- ModernMech 7y ago
  I'm sure they have it all already.
  - astura 7y ago
    Of course they do, they have to verify you're a member of the class.
- olyjohn 7y ago
  Exactly... and what about the losses that I may suffer in the future from this? If I take the $125 now, am I no longer entitled to free identity restoration? The effects of this are going to last longer than the class action suit. It's just a huge waste of time for everybody except the lawyers.
- deleted 7y ago
  [deleted]
intrasight 7y ago
Hmm - I had to disable uBlock Origin on that site in order to submit a claim. Hate it when that happens.
- caymanjim 7y ago
  I didn't. But I haven't tweaked my uBlock settings, so maybe mine is more permissive.
- sh-run 7y ago
  Do you have custom rules enabled? I'm running the default uBlock Origin (version 1.18.6) on Firefox (60.8.0esr - company machine) and didn't have any problems. uBlock reports that it blocked seven requests to four domains (ads-twitter.com, bing.com, facebook.net and googletagmanager.com)
discreditable 7y ago
It's turbo BS that you're not entitled to cash payout unless you already have a credit monitoring service.
- TAForObvReasons 7y ago
  The theoretical argument is that you should only be compensated for damages and incurred costs. If your information is leaked but no one used it, arguably there are no demonstrable damages. If you didn't purchase credit monitoring, you didn't incur any costs.
- powerset 7y ago
  I wonder what counts as a credit monitoring service. Can I choose what service I use? ...Can I monitor it myself?
  - floatingatoll 7y ago
    There are two reasonable answers, ignoring whatever is specified in the legalese which of course takes precedence: 1) It must be a third party service that you have entered into a business arrangement with, where the arrangement in clear and specific terms provides you with credit monitoring. 2) It must hold up in a court of law if challenged. That second one is the anti-loophole provision of law, and protects against the kind of loopholes people try to find to get around the clear intent of the requirement. You can choose to use any service that would hold up in a court of law. There are no clear answers on whether "any" service would. Time established, diversity of customers, active or inactive business, frequency of credit report inspection; all could be factors in a judicial evaluation of whether you complied with the terms or not. Capital One? Yes, they plausibly do offer credit monitoring as a service. Joe Bloe's Credit Woes? Entirely possible, if they've been around a while and can demonstrate that they pull credit reports on a regular basis and audit them in some manner. Can you monitor it yourself? Only if you already operate a credit monitoring business. Otherwise, it'll fail the plausible test, and you lose your $125 + lawyer fees + risk angering a judge.
- bluetidepro 7y ago
  If you have any basic credit card, you probably have credit monitoring. It's included with most cards. Like, for example, my basic free Capital One card comes with free credit monitoring with CreditWise, which counts for this context.
gesman 7y ago
equifaxbreachsettlement.com Registered anonymously with GoDaddy for 1 year. This is scam
- oxguy3 7y ago
  The FTC disagrees: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
- zadkey 7y ago
  It is officially linked from the FTC.gov website. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq... So I strongly doubt it is a scam.
  - groovybits 7y ago
    This is official, but remember what happened when we assumed that links from official sources were official. Healthy paranoia :)
- bdcravens 7y ago
  Every domain I register is registered with WHOIS protection as well.
rdl 7y ago
This is the first time I've seen cash vs. the useless credit monitoring as a compensation offer.
- caymanjim 7y ago
  You can only claim the $125 cash if you affirm that you're already paying for credit monitoring. While I don't expect anyone to confirm your claim, you do have to sign your name to a legal document stating as much. You can make additional compensation claims if you suffered actual damage or spent time dealing with the breach, but as I could not honestly claim such, I don't know what that part of the process entails.
  - scottydelta 7y ago
    but this is stupid. Individuals keeping an eye on their credit history and every change should be counted as credit monitoring.
  - rdl 7y ago
    Already have credit monitoring due to one of the infinity of other breaches.
  - themeiguoren 7y ago
    Many services offer credit monitoring for free, eg credit cards, CreditKarma. You don’t need to be paying for it to be eligible for the cash payout.
soulofmischief 7y ago
I don't want money. I don't want free service. I don't want any compensation. I want Equifax as a company to be dissolved for incompetency with private data, and I want a way to legally opt out of other such companies collecting and aggregating private data about me.
- scottydelta 7y ago
  > I want a way to legally opt out of other such companies collecting and aggregating private data about me. this is what I want too at the end of the day.
- kd5bjo 7y ago
  Move to Europe and then send them a GDPR request?
- git-pull 7y ago
  > I want a way to legally opt out of other such companies collecting and aggregating private data about me. Compare a desire to legally opt out (after checking a box, agreeing to a privacy policy you never read, having your data from 10 years ago - with a chain of custody/dispersal that's probably untenable, if not impossible, to map by now - synthesized by a third party) to GDPR's concept of consent: "The key point is that all consent must be opt-in consent, ie a positive action or indication – there is no such thing as ‘opt-out consent’. Failure to opt out is not consent as it does not involve a clear affirmative act. You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way. All of these methods also involve ambiguity – and for consent to be valid it must be both unambiguous and affirmative. It must be clear that the individual deliberately and actively chose to consent." Source: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
  - reificator 7y ago
    Yes opt in is obviously better for the end user[0], but don't let perfect be the enemy of good here. We don't have opt out yet. [0]: Until opt in becomes mandatory for use of critical services like having a bank account or paying your power bill.
hnruss 7y ago
My anti-virus software flags the "File a Claim" page as a phishing site.
eloff 7y ago
What can Canadians do?
dccoolgai 7y ago
5-second glance at the the stuff in the <head> shows pixels for: Google Ads, Facebook, Twitter, a bunch of other slimy stuff. What the actual F. Who does that? Edit: also, no content security policy, no subresource integrity for 3rd party scripts. Is there such a thing as filing a class action against the party handling the class action? This is downright irresponsible. Edit: I see a couple of the 3rd party scripts have integrity, but most don't.
- cddotdotslash 7y ago
  I'm pretty sure you don't have a legal claim against a site because it doesn't use subresource integrity. Three quarters of the internet could be sued. Now if the company handling the claims _also_ loses your data, then maybe you'd have a shot at a case.
- webninja 7y ago
  What he’s saying is that even if www.equifaxbreachsettlement.com isn’t using the 5 digits of your SSN for nefarious purposes, Google Ads, Facebook, Twitter, and other slimy companies are collecting this data. Even if FB, Twitter, Google et al aren’t using this data, it might be available to marketers who use these Ad platforms. Please correct me if my explanation of the parent comment is wrong here.
jmount 7y ago
Just another way to submit your PII to a bound to be leaked repository.
mNovak 7y ago
Some tips: Note that many free credit monitoring services exist, and most credit cards nowadays have this feature available. These qualify you for the $125 payout. Up to 10 hours effort ($250) can be claimed without documentation, for time spent battling or preventing ID theft. Preventing is probably key here, and could cover a lot of activities.
- ceejayoz 7y ago
  > Preventing is probably key here, and could cover a lot of activities. Yup. Reading news about the breach. Researching credit monitoring options. etc.
- lotsofpulp 7y ago
  The $125 and $250 come from a maximum fund of $31M each, so there is almost no chance anyone will get $125 or $250.
rednerrus 7y ago
CreditKarma offers free credit monitoring.
lkrubner 7y ago
I'm feeling a bit cynical, and I wonder if this will bring real changes? I happen to have a good friend at ReliaQuest, so I know that, after the data theft, Equifax hired ReliaQuest, and has slowly expanded that contract, giving more and more responsibility to ReliaQuest. My friend is an awesome engineer and ReliaQuest is a very good outfit, but still, I'm frustrated by the idea that the CEO of Equifax can simply outsource security and then not think about it any more. For companies that hold people's most sensitive data, I'd like the top person to be obsessed with security 24 hours a day. I wrote about this previously: "If a company handles people’s sensitive financial data, then I would like the CEO to be the type of person who wakes up in the morning thinking about security, goes to sleep at night thinking about security, and never has security far from their mind during the day. So to hire a security company, and then act as if security is a solved problem, is troubling. There are many other ways for a company to be hacked. Social engineering is a danger, and most company hacks are inside jobs. Hiring a firm such as ReliaQuest does not protect you from having one of your own employees steal data and sell it to the Russians. Protecting against internal attacks requires hard thinking by the top leadership of the company. The job can not be outsourced." http://www.smashcompany.com/business/if-a-company-is-serious-about-security-then-who-in-the-company-is-serious-about-security http://www.smashcompany.com/business/if-a-company-is-serious...
- trollied 7y ago
  No. A CEO runs every aspect of a business. While it might be a bad call outsourcing everything, they obviously want expertise rather than having to either rely on their current team that fucked up (which would be viewed as negative), or take some time to hire new people. Hiring new people takes time & isn’t reactionary. Everyone will want them to be seen to be doing something. Hiring an external company is possibly the best short term thing they could do.
deleted 7y ago
[deleted]
jammygit 7y ago
By comparison, here's somebody who sued them in small claims court and won $8000: https://blog.legalist.com/i-won-8-000-from-equifax-in-small-claims-court-heres-how-you-can-too-f0ce6925c079?gi=6cf7765790c2 https://blog.legalist.com/i-won-8-000-from-equifax-in-small-... an update about winning the appeal afterwards (edit: apparently they got it reduced to $5500): https://blog.legalist.com/i-fought-equifaxs-lawyer-in-court-and-won-here-s-how-a16930c53af3 https://blog.legalist.com/i-fought-equifaxs-lawyer-in-court-...
- cbau 7y ago
  Really interesting! Does submitting a claim here prevent you from suing Equifax in small claims court? It seems possible that a $5000 may be worth my time.
  - scott00 7y ago
    Not only does submitting a claim prevent you from suing Equifax, the only way to preserve your right to sue is to actively exclude yourself from the settlement. See FAQs 19 and 23. 19: https://www.equifaxbreachsettlement.com/faq#q-19 https://www.equifaxbreachsettlement.com/faq#q-19 23: https://www.equifaxbreachsettlement.com/faq#q-23 https://www.equifaxbreachsettlement.com/faq#q-23
    - jammygit 7y ago
      That can’t be legally binding
      - kube-system 7y ago
        It appears that rule 23 of the Federal Rules of Civil Procedure binds even unnamed parties of a class action suit, unless they exclude themselves from an eligible suit. https://civilprocedure.uslegal.com/class-action/binding-nature-of-class-actions/ https://civilprocedure.uslegal.com/class-action/binding-natu...
      - astura 7y ago
Muuuchem 7y ago
How do I know if I get something from this?
gouggoug 7y ago
And to file a claim I have to submit all my personal information over again; Oh the irony...
ausjke 7y ago
what's lost? my SSN/name/address/phone? or what? what is exactly lost? if SSN/birthdate/name is gone, then anyone can fake me online, apply credit card under my name. am I missing something? what was stolen from me? so yes I can say I worried for 10+ hours and Equifax will pay me $250 no questions asked, but this is not exactly what I want to have.
non-prophet 7y ago
I completed the request with specified damages from the breach. I recently received a letter saying my claim was denied as I had "failed to mail the documentation," however, there was no notice on the webform that I completed that required mailing the documentation.
thedudeabides5 7y ago
Is this spam on HN?
OkGoDoIt 7y ago
“Class Counsel will ask the Court to award them attorneys’ fees of up to $77,500,000 and reimbursement for costs and expenses up to $3,000,000 to be paid from the Consumer Restitution Fund.” The lawyers are the real winner here.
powellbu 7y ago
My ex wife completely denied cheating until i showed him prove of it,i showed him prove of his chats with different girls he was chatting on Instagram,thanks to sparrohacker (AT) gmail for spying open his phone getting all his deleted messages and have access to all his social media,facebook,twitter,Instagram..contact him via Whatsapp: +971 58 628 4498 Call or Text him on: +1 (978) 4340953
Adrian144 7y ago
Contact Cyberhack005 @gmail . COM or text message on: +1502-378-7817 for any sort of hack service These are professional group of hackers with decades of experience They penetrate all websites databases without traces ...Their services are guarantee, with their untraceable Penetration software, They deliver their service within 24-48 hours. They offer the following service -Clears bad Driving -Tracking Locations of Victims -They do Crediting of account with credit card no upfront -SPYWARE FOR ALL SOCIAL MEDIA CONVERSATIONS -Western Union MTCN and Moneygram hack -Itune card hacking -Removal of old credit score -University grades changing -Erase criminal records hack -Facebook hack -Twitters hack -email accounts hack -Grade Changes hack -Website crashed hack -server crashed hack -Skype hack -Databases hack -Word Press Blogs hack -Individual computers hack -Control devices remotely hack -Burner Numbers hack -Verified Paypal Accounts hack -Any social media account hack -Android & iPhone Hack -Text message interception hack -email interception hack - credit card for free online transactions -Untraceable Ip etc. -Help Sign up to ILLUMINATI and get famous faster -Increases Youtube subscribers,likes and views and also instagram followers -Account money multiplication -Loading of bitcoin without any upfront -Unlimited Blank Atm Card and Credit card for 2 years -Loading Bank account you will never regret any of their services. Thank me later
Adrian144 7y ago
Not sure why everyone's giving such bad reviews. Had gotten pre-approvals many times. I did my due diligence and built up my credit to get into the range of their "minimum requirement". with the assistance of a credit expert which I contact (captainspyhacker2 @gmailCOM or +1502-378-7817) to helped me fixed my credit. He helped me pay off my CC debt and improved my scores to 780 in a couple of days Applied, got approved, Took less than a week for the whole process, with funds directly sent to my checking. I had benefited a lot from Captain spy service as I'm presently writing this message in my new house at Texas Thanks Captain!

301 points by caymanjim 7y ago

It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm surprised it hasn't already.) After all this site links to the law firm JND, but nowhere does JND mention this site. So any of us could have made this site. Use the form below to find out if your information was impacted and if you are a class member. Last Name _______ Last 6 Digits of Social Security Number ________

Zombieball 7y ago
A security researcher setup a similar domain with a phishing page. Equifax made the mistake of linking to his page rather than their own on twitter!!! https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/business/equifax-fake-website.amp.html https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/busin...
jwp23 7y ago
Your comment inspired me to take a look. I compared the SSL certificate and the whois information to equifax.com. The settlement site uses a different company for the certificate. The settlement site uses Starfield Technologies vs DigiCert for equifax.com. The settlement site uses GoDaddy for their DNS vs UltraDNS for equifax.com. It's not impossible that a division in the company or a different law firm uses different SSL certificate provider and DNS provider, but it may point to some caution. Edit: As another commenter pointed out, this site is linked to from the FTC site about the breach.
- ocdtrekkie 7y ago
  Being linked to from the FTC isn't a safe bet. Bear in mind Equifax sent people to a fake Equifax website before: https://money.cnn.com/2017/09/20/technology/business/equifax-fake-site-twitter-phishing/index.html https://money.cnn.com/2017/09/20/technology/business/equifax...
- deleted 7y ago
  [deleted]
- simonsarris 7y ago
  Yeah its totally legit, its just funny to think about. I expect it to happen someday. This site is using godaddy presumably because the law firm also does, though they do use different certs!
- azernik 7y ago
  You're assuming that this site is run by Equifax; it is not. It is run by a "Settlement Administrator", a third-party entrusted by the court to handle the money and record-keeping associated with a class-action settlement. This is to avoid possible manipulation of the settlement by the defendant.
- devcpp 7y ago
  Why compare it to Equifax? I'd just assume it's an unrelated malicious opportunist. I'd rather compare it to JND to have evidence towards proving that it's legit. Anyway it is legit since it's mentioned on the FTC site.
  - jwp23 7y ago
    I made a faulty assumption. As others have pointed out, the settlement site is run by a third party.
  - niij 7y ago
    At this point I'd consider the government more competent than Equifax.
- mandevil 7y ago
  Legally, the settlement administrator must be totally independent from Equifax, so comparing their hosting providers, cert providers, etc. you'd only expect them to match by random chance.
moonlighter 7y ago
Here's the "official" page on the ftc.gov site, which has links to the settlement site in the FAQ section. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
acomjean 7y ago
Update. I tried a different last name and told I wasn't eligible, so thats good. >I just entered "Smith" and 6 digits. (Not real) I was eligible.
- ocdtrekkie 7y ago
  Arguably, your best bet for this kind of test is a very blatantly fake name, like "Zxzxzx". It's entirely possible that there is someone with the last name Smith (since it's very common) who also has those six digits at the end of their SSN.
  - acomjean 7y ago
    Good point.. I tried "potter" and I got Not eligible. So either I'm a great last digit guesser (Though I'm usually not lucky in things like gambling....) I'll update my original comment.
    - ocdtrekkie 7y ago
      It may not be so much a great guess as a statistical likelihood! In 2000, there were over 2.3 million Smiths in the United States: https://blogs.ancestry.com/cm/smith-a-short-history-of-americas-most-popular-surname/ https://blogs.ancestry.com/cm/smith-a-short-history-of-ameri... (This number has likely grown roughly alongside our population, so let's use 2000 numbers for this.) In 2000, we had 281 million people in the US, which means 0.8% of Americans have the last name Smith. If we assume every possible SSN could be handed out, a trailing six digit entry could have anywhere up to 999 possible SSNs, so you're firing out a shotgun with a pretty big number of potential targets each time you guess an SSN.
astura 7y ago
Its somewhat of an unsolved problem, there's all sorts of these kind of sites that are legitimate but look really suspicious, like they could be phishing sites. Examples: https://www.annualcreditreport.com/ https://www.annualcreditreport.com/ https://www.optoutprescreen.com/ https://www.optoutprescreen.com/ You can tell these two are legit because they are listed on official government sites: https://www.ftc.gov/faq/consumer-protection/get-my-free-credit-report https://www.ftc.gov/faq/consumer-protection/get-my-free-cred... https://www.consumer.ftc.gov/articles/0262-stopping-unsolicited-mail-phone-calls-and-email https://www.consumer.ftc.gov/articles/0262-stopping-unsolici... However, I can see how some people wouldn't think to go through .gov sites and there's really nothing stopping me from registering a phishing site with a similar domain and hosting it in Russia or something to confuse people into using mine rather than the official one. I think freecreditscore.com has been confused with annualcreditreport.com in the past. Freecreditscore.com is owned by Experian now and it actually does offer a real free no strings attached credit score NOW, but in the past it used to be one of those sites that tricked you into signing up for a subscription. Then, of course, there was the Equifax data breach site that totally looked like a phishing site.
- rhizome 7y ago
  It's only a problem if the authority is obscured by an unrelated domain name. If the page was a location on a site with known authority, or a subdomain, it could be validated much more easily. Unfortunately, vanity gets in the way.
  - astura 7y ago
    Its not just vanity though, in these two cases "the authority" is the industry as a whole, thus many "authorities." For example: >OptOutPrescreen.com is a joint venture among Equifax Information Services, LLC, Experian Information Solutions, Inc., Innovis Data Solutions, Inc., and TransUnion, LLC (collectively the "Consumer Credit Reporting Companies"). >[annualcreditreport.com] is maintained by Central Source, LLC. Central Source, LLC is sponsored by Equifax, Experian and TransUnion so you have a single site where you can ask for all three of your free credit reports.
caymanjim 7y ago
I got this site link directly from the FTC's settlement announcement, or I would have worried about that myself. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
_bxg1 7y ago
The FTC - verified on Twitter - tweeted the URL. That chain of trust is good enough for me.
partiallypro 7y ago
The site didn't ask for my social
- bdcravens 7y ago
  It asks for the SSN (last 6 digits) on the eligibility page, not the claim page: https://eligibility.equifaxbreachsettlement.com/en/eligibility https://eligibility.equifaxbreachsettlement.com/en/eligibili...
jcsnv 7y ago
I was wondering this as well, but the link came from the FTC's site: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
chpwssn 7y ago
You think they would have learned since the breach. Right after the breach was disclosed they made their information page equifaxsecurity2017.com. It had the same prompt for last name and last digits of the visitor's SSN. Then just said something along the lines of ~"Thanks for the information, we'll have more details later".
espeed 7y ago
Search for "Copyright © 2019 JND. All rights reserved" -- there are a ton of sites of the same form.
dwild 7y ago
In Quebec we recently had a massive information leak from Desjardins, a credit union used by most of the population. It didn't take long for people to receive phishing SMS trying to get information from people. It's not exactly the same, but work the same way.
foxc 7y ago
how do you know it links back to JND?
Vordimous 7y ago
I put in bogus name and social. It said i was affected by the incident. So.... Probably phishing.

deleted 7y ago

[deleted]

toomuchtodo 7y ago

Reddit thread with detailed information on claim submittal [1]. [1] https://www.reddit.com/r/personalfinance/comments/ch9tcj/claims_are_now_being_accepted_for_the_2017/ https://www.reddit.com/r/personalfinance/comments/ch9tcj/cla...

deleted 7y ago

[deleted]

aaronmid 7y ago

https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq... It's mentioned in the FTC site.

jbredeche 7y ago

If this breach affected 147M people (which is what I can find from various articles), and $700M was set aside (before attorney fees), and most claims will be $125, that's only ~4M people who will get $125. Are they expecting very few people to file claims? Or what am I missing?

scld 7y ago
Perhaps they are counting on a certain number using their free credit monitoring, as that's the other option on the site.
- bdcravens 7y ago
  It's also the default, so some will just click through
TallGuyShort 7y ago
It sounds to me like they'll give you free credit monitoring, UNLESS YOU ALREADY HAD CREDIT MONITORING, then they'll give you $125. Most people don't have credit monitoring, I think. Personally, I've found the free credit monitoring that they gave me pretty useless. I get an email regularly telling me my score changed. I have to go log in and find out I went up 2 points because of an algorithm change. Thanks for looking out, Equifax! Then I go to a dealer and they pull my credit and it's dramatically higher than what Equifax has been telling me. The whole system seems silly to me.
- krastanov 7y ago
  It is either-or, not both. If you want the money you have to promise you have credit monitoring from somewhere else. Credit Karma (for example) counts as free credit monitoring and you can easily make an account before making the claim. Many credit cards come with monitoring too.
  - markholmes 7y ago
    I believe NerdWallet counts as well.

lr 7y ago

They can keep the $125 (although, I wish I could direct it to a charity). I don't want to submit all of this information to an entity who's data security is probably worse (hard to believe) than Equifax!

ModernMech 7y ago
I'm sure they have it all already.
- astura 7y ago
  Of course they do, they have to verify you're a member of the class.
olyjohn 7y ago
Exactly... and what about the losses that I may suffer in the future from this? If I take the $125 now, am I no longer entitled to free identity restoration? The effects of this are going to last longer than the class action suit. It's just a huge waste of time for everybody except the lawyers.
deleted 7y ago
[deleted]

intrasight 7y ago

Hmm - I had to disable uBlock Origin on that site in order to submit a claim. Hate it when that happens.

caymanjim 7y ago
I didn't. But I haven't tweaked my uBlock settings, so maybe mine is more permissive.
sh-run 7y ago
Do you have custom rules enabled? I'm running the default uBlock Origin (version 1.18.6) on Firefox (60.8.0esr - company machine) and didn't have any problems. uBlock reports that it blocked seven requests to four domains (ads-twitter.com, bing.com, facebook.net and googletagmanager.com)

discreditable 7y ago

It's turbo BS that you're not entitled to cash payout unless you already have a credit monitoring service.

TAForObvReasons 7y ago
The theoretical argument is that you should only be compensated for damages and incurred costs. If your information is leaked but no one used it, arguably there are no demonstrable damages. If you didn't purchase credit monitoring, you didn't incur any costs.
powerset 7y ago
I wonder what counts as a credit monitoring service. Can I choose what service I use? ...Can I monitor it myself?
- floatingatoll 7y ago
  There are two reasonable answers, ignoring whatever is specified in the legalese which of course takes precedence: 1) It must be a third party service that you have entered into a business arrangement with, where the arrangement in clear and specific terms provides you with credit monitoring. 2) It must hold up in a court of law if challenged. That second one is the anti-loophole provision of law, and protects against the kind of loopholes people try to find to get around the clear intent of the requirement. You can choose to use any service that would hold up in a court of law. There are no clear answers on whether "any" service would. Time established, diversity of customers, active or inactive business, frequency of credit report inspection; all could be factors in a judicial evaluation of whether you complied with the terms or not. Capital One? Yes, they plausibly do offer credit monitoring as a service. Joe Bloe's Credit Woes? Entirely possible, if they've been around a while and can demonstrate that they pull credit reports on a regular basis and audit them in some manner. Can you monitor it yourself? Only if you already operate a credit monitoring business. Otherwise, it'll fail the plausible test, and you lose your $125 + lawyer fees + risk angering a judge.
bluetidepro 7y ago
If you have any basic credit card, you probably have credit monitoring. It's included with most cards. Like, for example, my basic free Capital One card comes with free credit monitoring with CreditWise, which counts for this context.

gesman 7y ago

equifaxbreachsettlement.com Registered anonymously with GoDaddy for 1 year. This is scam

oxguy3 7y ago
The FTC disagrees: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...
zadkey 7y ago
It is officially linked from the FTC.gov website. https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq... So I strongly doubt it is a scam.
- groovybits 7y ago
  This is official, but remember what happened when we assumed that links from official sources were official. Healthy paranoia :)
bdcravens 7y ago
Every domain I register is registered with WHOIS protection as well.

rdl 7y ago

This is the first time I've seen cash vs. the useless credit monitoring as a compensation offer.

caymanjim 7y ago
You can only claim the $125 cash if you affirm that you're already paying for credit monitoring. While I don't expect anyone to confirm your claim, you do have to sign your name to a legal document stating as much. You can make additional compensation claims if you suffered actual damage or spent time dealing with the breach, but as I could not honestly claim such, I don't know what that part of the process entails.
- scottydelta 7y ago
  but this is stupid. Individuals keeping an eye on their credit history and every change should be counted as credit monitoring.
- rdl 7y ago
  Already have credit monitoring due to one of the infinity of other breaches.
- themeiguoren 7y ago
  Many services offer credit monitoring for free, eg credit cards, CreditKarma. You don’t need to be paying for it to be eligible for the cash payout.

soulofmischief 7y ago

I don't want money. I don't want free service. I don't want any compensation. I want Equifax as a company to be dissolved for incompetency with private data, and I want a way to legally opt out of other such companies collecting and aggregating private data about me.

scottydelta 7y ago
> I want a way to legally opt out of other such companies collecting and aggregating private data about me. this is what I want too at the end of the day.
kd5bjo 7y ago
Move to Europe and then send them a GDPR request?
git-pull 7y ago
> I want a way to legally opt out of other such companies collecting and aggregating private data about me. Compare a desire to legally opt out (after checking a box, agreeing to a privacy policy you never read, having your data from 10 years ago - with a chain of custody/dispersal that's probably untenable, if not impossible, to map by now - synthesized by a third party) to GDPR's concept of consent: "The key point is that all consent must be opt-in consent, ie a positive action or indication – there is no such thing as ‘opt-out consent’. Failure to opt out is not consent as it does not involve a clear affirmative act. You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way. All of these methods also involve ambiguity – and for consent to be valid it must be both unambiguous and affirmative. It must be clear that the individual deliberately and actively chose to consent." Source: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- reificator 7y ago
  Yes opt in is obviously better for the end user[0], but don't let perfect be the enemy of good here. We don't have opt out yet. [0]: Until opt in becomes mandatory for use of critical services like having a bank account or paying your power bill.

hnruss 7y ago

My anti-virus software flags the "File a Claim" page as a phishing site.

eloff 7y ago

What can Canadians do?

dccoolgai 7y ago

5-second glance at the the stuff in the <head> shows pixels for: Google Ads, Facebook, Twitter, a bunch of other slimy stuff. What the actual F. Who does that? Edit: also, no content security policy, no subresource integrity for 3rd party scripts. Is there such a thing as filing a class action against the party handling the class action? This is downright irresponsible. Edit: I see a couple of the 3rd party scripts have integrity, but most don't.

cddotdotslash 7y ago
I'm pretty sure you don't have a legal claim against a site because it doesn't use subresource integrity. Three quarters of the internet could be sued. Now if the company handling the claims _also_ loses your data, then maybe you'd have a shot at a case.
webninja 7y ago
What he’s saying is that even if www.equifaxbreachsettlement.com isn’t using the 5 digits of your SSN for nefarious purposes, Google Ads, Facebook, Twitter, and other slimy companies are collecting this data. Even if FB, Twitter, Google et al aren’t using this data, it might be available to marketers who use these Ad platforms. Please correct me if my explanation of the parent comment is wrong here.

jmount 7y ago

Just another way to submit your PII to a bound to be leaked repository.

mNovak 7y ago

Some tips: Note that many free credit monitoring services exist, and most credit cards nowadays have this feature available. These qualify you for the $125 payout. Up to 10 hours effort ($250) can be claimed without documentation, for time spent battling or preventing ID theft. Preventing is probably key here, and could cover a lot of activities.

ceejayoz 7y ago
> Preventing is probably key here, and could cover a lot of activities. Yup. Reading news about the breach. Researching credit monitoring options. etc.
lotsofpulp 7y ago
The $125 and $250 come from a maximum fund of $31M each, so there is almost no chance anyone will get $125 or $250.

rednerrus 7y ago

CreditKarma offers free credit monitoring.

lkrubner 7y ago

I'm feeling a bit cynical, and I wonder if this will bring real changes? I happen to have a good friend at ReliaQuest, so I know that, after the data theft, Equifax hired ReliaQuest, and has slowly expanded that contract, giving more and more responsibility to ReliaQuest. My friend is an awesome engineer and ReliaQuest is a very good outfit, but still, I'm frustrated by the idea that the CEO of Equifax can simply outsource security and then not think about it any more. For companies that hold people's most sensitive data, I'd like the top person to be obsessed with security 24 hours a day. I wrote about this previously: "If a company handles people’s sensitive financial data, then I would like the CEO to be the type of person who wakes up in the morning thinking about security, goes to sleep at night thinking about security, and never has security far from their mind during the day. So to hire a security company, and then act as if security is a solved problem, is troubling. There are many other ways for a company to be hacked. Social engineering is a danger, and most company hacks are inside jobs. Hiring a firm such as ReliaQuest does not protect you from having one of your own employees steal data and sell it to the Russians. Protecting against internal attacks requires hard thinking by the top leadership of the company. The job can not be outsourced." http://www.smashcompany.com/business/if-a-company-is-serious-about-security-then-who-in-the-company-is-serious-about-security http://www.smashcompany.com/business/if-a-company-is-serious...

trollied 7y ago
No. A CEO runs every aspect of a business. While it might be a bad call outsourcing everything, they obviously want expertise rather than having to either rely on their current team that fucked up (which would be viewed as negative), or take some time to hire new people. Hiring new people takes time & isn’t reactionary. Everyone will want them to be seen to be doing something. Hiring an external company is possibly the best short term thing they could do.

deleted 7y ago

[deleted]

jammygit 7y ago

By comparison, here's somebody who sued them in small claims court and won $8000: https://blog.legalist.com/i-won-8-000-from-equifax-in-small-claims-court-heres-how-you-can-too-f0ce6925c079?gi=6cf7765790c2 https://blog.legalist.com/i-won-8-000-from-equifax-in-small-... an update about winning the appeal afterwards (edit: apparently they got it reduced to $5500): https://blog.legalist.com/i-fought-equifaxs-lawyer-in-court-and-won-here-s-how-a16930c53af3 https://blog.legalist.com/i-fought-equifaxs-lawyer-in-court-...

cbau 7y ago
Really interesting! Does submitting a claim here prevent you from suing Equifax in small claims court? It seems possible that a $5000 may be worth my time.
- scott00 7y ago
  Not only does submitting a claim prevent you from suing Equifax, the only way to preserve your right to sue is to actively exclude yourself from the settlement. See FAQs 19 and 23. 19: https://www.equifaxbreachsettlement.com/faq#q-19 https://www.equifaxbreachsettlement.com/faq#q-19 23: https://www.equifaxbreachsettlement.com/faq#q-23 https://www.equifaxbreachsettlement.com/faq#q-23
  - jammygit 7y ago
    That can’t be legally binding
    - kube-system 7y ago
      It appears that rule 23 of the Federal Rules of Civil Procedure binds even unnamed parties of a class action suit, unless they exclude themselves from an eligible suit. https://civilprocedure.uslegal.com/class-action/binding-nature-of-class-actions/ https://civilprocedure.uslegal.com/class-action/binding-natu...
    - astura 7y ago

Muuuchem 7y ago

How do I know if I get something from this?

gouggoug 7y ago

And to file a claim I have to submit all my personal information over again; Oh the irony...

ausjke 7y ago

what's lost? my SSN/name/address/phone? or what? what is exactly lost? if SSN/birthdate/name is gone, then anyone can fake me online, apply credit card under my name. am I missing something? what was stolen from me? so yes I can say I worried for 10+ hours and Equifax will pay me $250 no questions asked, but this is not exactly what I want to have.

non-prophet 7y ago

I completed the request with specified damages from the breach. I recently received a letter saying my claim was denied as I had "failed to mail the documentation," however, there was no notice on the webform that I completed that required mailing the documentation.

thedudeabides5 7y ago

Is this spam on HN?

OkGoDoIt 7y ago

“Class Counsel will ask the Court to award them attorneys’ fees of up to $77,500,000 and reimbursement for costs and expenses up to $3,000,000 to be paid from the Consumer Restitution Fund.” The lawyers are the real winner here.

powellbu 7y ago

My ex wife completely denied cheating until i showed him prove of it,i showed him prove of his chats with different girls he was chatting on Instagram,thanks to sparrohacker (AT) gmail for spying open his phone getting all his deleted messages and have access to all his social media,facebook,twitter,Instagram..contact him via Whatsapp: +971 58 628 4498 Call or Text him on: +1 (978) 4340953

Adrian144 7y ago

Contact Cyberhack005 @gmail . COM or text message on: +1502-378-7817 for any sort of hack service These are professional group of hackers with decades of experience They penetrate all websites databases without traces ...Their services are guarantee, with their untraceable Penetration software, They deliver their service within 24-48 hours. They offer the following service -Clears bad Driving -Tracking Locations of Victims -They do Crediting of account with credit card no upfront -SPYWARE FOR ALL SOCIAL MEDIA CONVERSATIONS -Western Union MTCN and Moneygram hack -Itune card hacking -Removal of old credit score -University grades changing -Erase criminal records hack -Facebook hack -Twitters hack -email accounts hack -Grade Changes hack -Website crashed hack -server crashed hack -Skype hack -Databases hack -Word Press Blogs hack -Individual computers hack -Control devices remotely hack -Burner Numbers hack -Verified Paypal Accounts hack -Any social media account hack -Android & iPhone Hack -Text message interception hack -email interception hack - credit card for free online transactions -Untraceable Ip etc. -Help Sign up to ILLUMINATI and get famous faster -Increases Youtube subscribers,likes and views and also instagram followers -Account money multiplication -Loading of bitcoin without any upfront -Unlimited Blank Atm Card and Credit card for 2 years -Loading Bank account you will never regret any of their services. Thank me later

Adrian144 7y ago

Not sure why everyone's giving such bad reviews. Had gotten pre-approvals many times. I did my due diligence and built up my credit to get into the range of their "minimum requirement". with the assistance of a credit expert which I contact (captainspyhacker2 @gmailCOM or +1502-378-7817) to helped me fixed my credit. He helped me pay off my CC debt and improved my scores to 780 in a couple of days Applied, got approved, Took less than a week for the whole process, with funds directly sent to my checking. I had benefited a lot from Captain spy service as I'm presently writing this message in my new house at Texas Thanks Captain!