4 ms·

The data has never surfaced. I have to wonder if anybody who claims they had direct identity theft because of the breach automatically loses their claim. http

by basch 7y ago

The data has never surfaced. I have to wonder if anybody who claims they had direct identity theft because of the breach automatically loses their claim. https://www.cnbc.com/2019/02/13/equifax-mystery-where-is-the-data.html https://www.cnbc.com/2019/02/13/equifax-mystery-where-is-the... It's interesting that most coverage of the incident ignores that detail. I guess people really dont like to hear it because it doesnt fit their narrative. Whatever this interest.com article is, it has very little value. It reads like seo spam. It doesn't discuss any of the developments in the last three weeks, such as Chicago, Indiana, Massachusetts all working out settlements.

MattGaiser 7y ago
I'm surprised to just be learning that it was probably a governmental cyberattack.
- basch 7y ago
  Like I said, it doesn't fit the narrative of "data collectors = bad", it doesn't create the right emotional response, it doesnt help people hate equifax more, so it gets suppressed and immediately downvoted, on any forum. Equifax can both be negligent and immoral AND not have caused any systemic identify thefts (that we know of, yet) from the event. I do think "a foreign government got the data on me" drastically shifts what the future threat from the exposure is, which should also change the settlement that was made under the pretense of them leaking data to traditional identity thieves or a black market.
  - martey 7y ago
    > Like I said, it doesn't fit the narrative of "data collectors = bad", it doesn't create the right emotional response, it doesnt help people hate equifax more, so it gets suppressed and immediately downvoted, on any forum. Have you considered that this might be caused by blind spots in your own news consumption? For example, you previously linked to an article from 2019 that suggest the breach might have been a governmental attack, but you seem to have ignored the fact that 4 PLA members were indicted in February. There was widespread news coverage about this, including multiple submissions on this very forum. https://news.ycombinator.com/item?id=22289826 https://news.ycombinator.com/item?id=22289826 does not look like it was "suppressed and immediately downvoted".
- empath75 7y ago
  China at this point has an amazing blackmail database — just correlate credit information with LinkedIn and Facebook data, and it’s trivial to find people with clearances or access to corporate secrets that you can get leverage on. Combine that with their attempted purchase of Grindr and other dating apps and you see a pattern.
akersten 7y ago
To be clear, are you saying that in order for a data breach to be considered legitimate, the plundered data needs to be released publicly?
- basch 7y ago
  no, i dont think i said that.
  - akersten 7y ago
    Presuming you do think it is a legitimate data breach then, why did you suggest that victims should lose their claim to having been caught up in it? Do you not think their (and probably your, if you're American) position of anxiety and their personal information being used nefariously is worthy of being made right? The data does not need to "surface" for it to have been used to steal someone's identity.
    - ksk 7y ago
      I think the point OP was making that if the data hasn't surfaced, then you cannot confirm if a particular case of identity theft has been caused by the breach.
      - akersten 7y ago
        That's a fair line of thought, but their comment was: data hasn't surfaced -> can't know where an identity theft came from -> Equifax petitioners lose their right to the settlement When the reality is: Equifax agreed to pay a settlement -> Equifax has not yet paid yet (and whether the material surfaces or not was not a stipulation of the settlement that they agreed to)
        basch 7y ago
        >data hasn't surfaced What it really comes down to, is if "data hasn't surfaced" means "we dont know if the data was used" or if "data hasn't surfaced" is something you can prove hasnt happened. It's the difference between "we dont know" or "we know your identity theft wasnt related to this."
bogomipz 7y ago
So in your "narrative" do social security numbers and other sensitive personal details have some sort of expiration date where if they don't "surface" within a certain time frame they are no longer useable?
- basch 7y ago
  if they never surface, are they usable? if they are used by a government but not to steal, how do you quantify the damage?
  - bogomipz 7y ago
    What an absurd implication. Just because something doesn't end up in a massive file dump on the dark web doesn't somehow mean it's not usable. Quite the opposite its actually too valuable to dump on the dark web.

by basch 7y ago

MattGaiser 7y ago

I'm surprised to just be learning that it was probably a governmental cyberattack.

basch 7y ago
Like I said, it doesn't fit the narrative of "data collectors = bad", it doesn't create the right emotional response, it doesnt help people hate equifax more, so it gets suppressed and immediately downvoted, on any forum. Equifax can both be negligent and immoral AND not have caused any systemic identify thefts (that we know of, yet) from the event. I do think "a foreign government got the data on me" drastically shifts what the future threat from the exposure is, which should also change the settlement that was made under the pretense of them leaking data to traditional identity thieves or a black market.
- martey 7y ago
  > Like I said, it doesn't fit the narrative of "data collectors = bad", it doesn't create the right emotional response, it doesnt help people hate equifax more, so it gets suppressed and immediately downvoted, on any forum. Have you considered that this might be caused by blind spots in your own news consumption? For example, you previously linked to an article from 2019 that suggest the breach might have been a governmental attack, but you seem to have ignored the fact that 4 PLA members were indicted in February. There was widespread news coverage about this, including multiple submissions on this very forum. https://news.ycombinator.com/item?id=22289826 https://news.ycombinator.com/item?id=22289826 does not look like it was "suppressed and immediately downvoted".
empath75 7y ago
China at this point has an amazing blackmail database — just correlate credit information with LinkedIn and Facebook data, and it’s trivial to find people with clearances or access to corporate secrets that you can get leverage on. Combine that with their attempted purchase of Grindr and other dating apps and you see a pattern.

akersten 7y ago

To be clear, are you saying that in order for a data breach to be considered legitimate, the plundered data needs to be released publicly?

basch 7y ago
no, i dont think i said that.
- akersten 7y ago
  Presuming you do think it is a legitimate data breach then, why did you suggest that victims should lose their claim to having been caught up in it? Do you not think their (and probably your, if you're American) position of anxiety and their personal information being used nefariously is worthy of being made right? The data does not need to "surface" for it to have been used to steal someone's identity.
  - ksk 7y ago
    I think the point OP was making that if the data hasn't surfaced, then you cannot confirm if a particular case of identity theft has been caused by the breach.
    - akersten 7y ago
      That's a fair line of thought, but their comment was: data hasn't surfaced -> can't know where an identity theft came from -> Equifax petitioners lose their right to the settlement When the reality is: Equifax agreed to pay a settlement -> Equifax has not yet paid yet (and whether the material surfaces or not was not a stipulation of the settlement that they agreed to)
      - basch 7y ago
        >data hasn't surfaced What it really comes down to, is if "data hasn't surfaced" means "we dont know if the data was used" or if "data hasn't surfaced" is something you can prove hasnt happened. It's the difference between "we dont know" or "we know your identity theft wasnt related to this."

bogomipz 7y ago

So in your "narrative" do social security numbers and other sensitive personal details have some sort of expiration date where if they don't "surface" within a certain time frame they are no longer useable?

basch 7y ago
if they never surface, are they usable? if they are used by a government but not to steal, how do you quantify the damage?
- bogomipz 7y ago
  What an absurd implication. Just because something doesn't end up in a massive file dump on the dark web doesn't somehow mean it's not usable. Quite the opposite its actually too valuable to dump on the dark web.