8 ms·

Data from Experian breach found on the internet

134 points by nsomaru 6y ago

iafrikan 6y ago
https://news.ycombinator.com/item?id=24346674 https://news.ycombinator.com/item?id=24346674
iafrikan 6y ago
https://news.ycombinator.com/item?id=24368557 https://news.ycombinator.com/item?id=24368557
- dang 6y ago
  The convention on HN is to link to previous threads only when there are interesting comments there. If readers click on a link like this and don't see that, they'll be disappointed and sometimes come back and downvote the link.
Propaganda_ 6y ago
"Breached data still breached" - The only new thing in this article is that someone was stupid enough to believe Experian when they said the data had been "recovered".
- trollied 6y ago
  Reminds me of this: http://www.27bslash6.com/overdue.html http://www.27bslash6.com/overdue.html Try to pay for something with a spider drawing attached to an email, ask for the drawing back afterwards ;)
forgotmypw17 6y ago
All information will become public on a long enough timeline.
arkadiyt 6y ago
The Experian South Africa CEO has hilariously said [1]: We were not hacked, a clever criminal convinced us to give him our data [1]: https://mybroadband.co.za/news/security/364636-we-were-not-hacked-a-clever-criminal-convinced-us-to-give-him-our-data-experian-sa-ceo.html https://mybroadband.co.za/news/security/364636-we-were-not-h...
- dylan604 6y ago
  Isn't that even worse? Now they would be complicit as they freely gave the data away vs having something stolen. You used the word hilariously. Were you be sarcastic, or did this person mean the statement as a joke?
  - karpierz 6y ago
    I think the "hilarious" part is how disconnected from reality the CEO must be if they think their quote somehow makes the situation better.
- setr 6y ago
  TBH his statement doesn't seem that unreasonable -- he's basically stating that the attacker already had all the knowledge necessary to be "credible" and no different than a normal client. Eg if the attacker already has your phone, email and password, its not really the bank's fault for giving away your financial details -- the game was lost before it even reached the bank.
nathanyz 6y ago
Given the amount of personal data now being held not only by credit companies, but also big tech, it seems like the liability for data breaches needs adjusted. If a companies main asset is their data, that means that you can ascribe a value to each person's data that they hold. If your data is stolen, they should be on the hook for value of that data to each of the people whose data was stolen. They need to stop being able to value the data at the cost of credit protection service on the liability side while booking value significantly higher on their assets ledger. This would encourage them to be much more careful in both protecting the data and mitigating breaches versus the current blase approach.
- londons_explore 6y ago
  Data is a copyable asset. Most other assets are not. Any copyable asset is worth zero as long as any copy is in the hands of someone likely to make more copies.
  - s_dev 6y ago
    >Data is a copyable asset. Most other assets are not. The consent to have that data is not copyable though.
  - rectang 6y ago
    By that reasoning, if a file containing bank passwords leaks, its value is "zero" despite the fact that somebody can now go in and steal from all those accounts with ease. Experian has created a massive liability for all the individuals in the leaked data pool. The amount of damage this leak does to innocent people is staggering.
  - csommers 6y ago
    I didn’t consent to have my passwords or SSN leaked though, so your argument is naive at best, idiotic at worst.
    - rorykoehler 6y ago
      I never consented to a credit scoring company to ever have my data. The first time I found out this was a thing as a teenager really made me think about the world and how it works. I couldn't believe something like this existed.
chromedev 6y ago
Time for my $0.39 check or a year of additional credit monitoring in exchange for my credit history and personal information.
- mkskm 6y ago
  Will this change in California now that there's stricter privacy laws? Looks like the fines are much higher: > - Companies that become victims of data theft or other data security breaches can be ordered in civil class action lawsuits to pay statutory damages between $100 to $750 per California resident and incident, or actual damages, whichever is greater, and any other relief a court deems proper, subject to an option of the California Attorney General's Office to prosecute the company instead of allowing civil suits to be brought against it (Cal. Civ. Code § 1798.150). > - A fine up to $7,500 for each intentional violation and $2,500 for each unintentional violation (Cal. Civ. Code § 1798.155). https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act#Sanctions_and_remedies https://en.wikipedia.org/wiki/California_Consumer_Privacy_Ac...
mkskm 6y ago
Credit bureaus are required to adhere to CCPA now in California. It might be worth making the request to opt out or delete your info: - https://experian.com/ccpa https://experian.com/ccpa - https://www.equifax.com/personal/my-privacy/ https://www.equifax.com/personal/my-privacy/ - https://www.transunion.com/consumer-privacy https://www.transunion.com/consumer-privacy
Stierlitz 6y ago
‘The personal data of millions of South Africans, "stolen" in one of SA's biggest data breaches earlier this year, has been discovered on the internet, despite assurances that the information had been recovered.’ Technically speaking, how do you go about recovering data stored on any amount of copies?

134 points by nsomaru 6y ago

iafrikan 6y ago

https://news.ycombinator.com/item?id=24346674 https://news.ycombinator.com/item?id=24346674

iafrikan 6y ago

https://news.ycombinator.com/item?id=24368557 https://news.ycombinator.com/item?id=24368557

dang 6y ago
The convention on HN is to link to previous threads only when there are interesting comments there. If readers click on a link like this and don't see that, they'll be disappointed and sometimes come back and downvote the link.

Propaganda_ 6y ago

"Breached data still breached" - The only new thing in this article is that someone was stupid enough to believe Experian when they said the data had been "recovered".

trollied 6y ago
Reminds me of this: http://www.27bslash6.com/overdue.html http://www.27bslash6.com/overdue.html Try to pay for something with a spider drawing attached to an email, ask for the drawing back afterwards ;)

forgotmypw17 6y ago

All information will become public on a long enough timeline.

arkadiyt 6y ago

The Experian South Africa CEO has hilariously said [1]: We were not hacked, a clever criminal convinced us to give him our data [1]: https://mybroadband.co.za/news/security/364636-we-were-not-hacked-a-clever-criminal-convinced-us-to-give-him-our-data-experian-sa-ceo.html https://mybroadband.co.za/news/security/364636-we-were-not-h...

dylan604 6y ago
Isn't that even worse? Now they would be complicit as they freely gave the data away vs having something stolen. You used the word hilariously. Were you be sarcastic, or did this person mean the statement as a joke?
- karpierz 6y ago
  I think the "hilarious" part is how disconnected from reality the CEO must be if they think their quote somehow makes the situation better.
setr 6y ago
TBH his statement doesn't seem that unreasonable -- he's basically stating that the attacker already had all the knowledge necessary to be "credible" and no different than a normal client. Eg if the attacker already has your phone, email and password, its not really the bank's fault for giving away your financial details -- the game was lost before it even reached the bank.

nathanyz 6y ago

Given the amount of personal data now being held not only by credit companies, but also big tech, it seems like the liability for data breaches needs adjusted. If a companies main asset is their data, that means that you can ascribe a value to each person's data that they hold. If your data is stolen, they should be on the hook for value of that data to each of the people whose data was stolen. They need to stop being able to value the data at the cost of credit protection service on the liability side while booking value significantly higher on their assets ledger. This would encourage them to be much more careful in both protecting the data and mitigating breaches versus the current blase approach.

londons_explore 6y ago
Data is a copyable asset. Most other assets are not. Any copyable asset is worth zero as long as any copy is in the hands of someone likely to make more copies.
- s_dev 6y ago
  >Data is a copyable asset. Most other assets are not. The consent to have that data is not copyable though.
- rectang 6y ago
  By that reasoning, if a file containing bank passwords leaks, its value is "zero" despite the fact that somebody can now go in and steal from all those accounts with ease. Experian has created a massive liability for all the individuals in the leaked data pool. The amount of damage this leak does to innocent people is staggering.
- csommers 6y ago
  I didn’t consent to have my passwords or SSN leaked though, so your argument is naive at best, idiotic at worst.
  - rorykoehler 6y ago
    I never consented to a credit scoring company to ever have my data. The first time I found out this was a thing as a teenager really made me think about the world and how it works. I couldn't believe something like this existed.

chromedev 6y ago

Time for my $0.39 check or a year of additional credit monitoring in exchange for my credit history and personal information.

mkskm 6y ago
Will this change in California now that there's stricter privacy laws? Looks like the fines are much higher: > - Companies that become victims of data theft or other data security breaches can be ordered in civil class action lawsuits to pay statutory damages between $100 to $750 per California resident and incident, or actual damages, whichever is greater, and any other relief a court deems proper, subject to an option of the California Attorney General's Office to prosecute the company instead of allowing civil suits to be brought against it (Cal. Civ. Code § 1798.150). > - A fine up to $7,500 for each intentional violation and $2,500 for each unintentional violation (Cal. Civ. Code § 1798.155). https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act#Sanctions_and_remedies https://en.wikipedia.org/wiki/California_Consumer_Privacy_Ac...

mkskm 6y ago

Credit bureaus are required to adhere to CCPA now in California. It might be worth making the request to opt out or delete your info: - https://experian.com/ccpa https://experian.com/ccpa - https://www.equifax.com/personal/my-privacy/ https://www.equifax.com/personal/my-privacy/ - https://www.transunion.com/consumer-privacy https://www.transunion.com/consumer-privacy

Stierlitz 6y ago

‘The personal data of millions of South Africans, "stolen" in one of SA's biggest data breaches earlier this year, has been discovered on the internet, despite assurances that the information had been recovered.’ Technically speaking, how do you go about recovering data stored on any amount of copies?