18 ms·

Identity thieves bypassed Experian security to view credit reports

475 points by picture 4y ago

ncphil 4y ago
Huh. So basically these guys got access to stuff that thousands of companies and governments who subscribe to Experian already have, but didn't pay for it. Color me outraged.
agency 4y ago
I’m not surprised in the least bit. I keep my credit locked constantly since I’ve had my SSN leaked multiple times (by US government agencies). Every time I go to unfreeze it when I apply for credit at least one of the big 3 credit reporting agencies lets me unfreeze it without specifying the PIN I had to create when freezing. If there was any justice these companies would get the corporate death penalty.
- Loughla 4y ago
  I froze mine years ago when the first leak of my SS# happened thanks to one of the stupid credit agencies. I was happy and secure in the knowledge that it was locked until I had to unlock it the first time. The password I set didn't work, as they had apparently changed the log-in system with no alert (also, now the stupid log-in sends us spam e-mail that we can't opt out of). I called them. I had my account unlocked, and the phone representative even gave me my own SS# within three minutes of being on the phone, and by answering questions that were publicly available information. It's an absolute fucking train wreck and I wish the system as a whole and the credit companies in particular were destroyed.
  - Terretta 4y ago
    > … and by answering questions that were publicly available information. The 3 questions fraud check system everyone uses to performatively pretend to ensure you are who you are, can only draw the questions it asks from — guess what — publicly available information. It's illogical on its face. // After identity theft, it gets worse, as thieves' fraudulent or real data will enter public records under your identity key, and now you can't pass your own check.
- JumpCrisscross 4y ago
  > these companies would get the corporate death penalty Would suggest replacing this in your vocabulary with “fines,” “license revocation” or “criminal penalties.” Corporate death penalties, i.e. judicial dissolution or charter revocations, while a good slogan, don’t make a lot of legal sense. As a result, I’ve found it in practice used to segregate activism and turnout operations (who like it) from rule and lawmaking influence (where it’s not a serious concept). Massive fines, equal to market cap, or absolute liability, e.g. a $10k + legal expenses minimum owed to each person whose data leaked irrespective of actual damages, for example, are more specific and actually actionable.
  - nine_k 4y ago
    I understand "corporate death penalty" as a dissolution of the corporation, likely with some cool down time for the execs found guilty when they cannot work as execs. No violence should be involved. Large layoffs resulting from that won't be pleasant one bit though.
    - fragmede 4y ago
      [flagged]
      - jazzyjackson 4y ago
        I would suppose whoever is being forced to terminate their employees is doing so under the threat of state violence (men with guns), but the employees being fired are not being threatened with any force, they're just losing their job.
      - bastawhiz 4y ago
        If I start a company with the express purpose of having it commit crimes, it will be shut down and everyone employed will be fired. That's not on the government, that's on me, the employer. So then where is the line that we draw that says how badly a company needs to behave or how many crimes it needs to commit to justify it being dissolved? We should not tolerate crime for the sake of the livelihoods of the henchmen. "The death star is bad, but think of how many people would be unemployed if we stopped them" is exactly the argument they want you to make.
- rootusrootus 4y ago
  PINs for freezes seems to be a thing of the past. I recently unfroze all of my credit reports momentarily so they could be accessed, and none of the big three asked for the PIN. They each have their own login and as soon as you authenticate to that, you're good.
SketchySeaBeast 4y ago
Every single report like this serves to make me feel sick and angry. These organizations are responsible for so much data that can literally ruin lives and they can't be bothered to think through their solutions. It's not but should be criminal.
- asah 4y ago
  Specifically, personal penalties for the exec teams. Do this once, and they'll take 10x the level of care going forward.
  - pwg 4y ago
    > personal penalties for the exec teams. Yes, but the penalties have to be such that the exec does not simply view it as "cost of doing business" and mark it down as a business expense.
    - asah 4y ago
      good point - also can't be covered by an insurance policy or reimbursement or pay increase or special bonus. I guess we're arguing for non-financial penalties...
    - thefurdrake 4y ago
      5% of their investment of the company per offense.
- bobkazamakis 4y ago
  If security doesn't impact their bottom line, it's just another beautiful salary for the C suite to parachute off of.
surume 4y ago
This isn't the first time that a major Credit Bureau has had a data leak, is it? Wasn't there a huge one a few years back?
- berkle4455 4y ago
  Experian and Equifax have security leaks all the time yeah
  - surume 4y ago
    "Identity thieves have been exploiting a glaring security weakness in the website of Experian" Shouldn't Experian have been thoroughly audited by the gov't after the last major data breach? The above sounds pretty out in the open, no?
    - lesuorac 4y ago
      > Shouldn't Experian have been thoroughly audited by the gov't after the last major data breach? That sounds pretty unconstitutional. Why would the USG audit a private company for security?
      - AlotOfReading 4y ago
        It seems like it'd be a national security issue at the very least. Those databases also contain an up-to-date financial picture of government employees holding security clearances. Even if clearance holders are nominally supposed to remain above-board and unsusceptible, I'm willing to bet that enough data mining would allow decent targeting. The DoD is already monitoring those employee's credit reports, so clearly there must be something actionable in them and it's quite likely they miss something.
      - thefurdrake 4y ago
        Which part of the Constitution is violated by the government scanning a website's publicly-available, advertised resources on the clearnet?
deleted 4y ago
[deleted]
charles_f 4y ago
> you simply change the last part of the URL from “/acr/oow/” to “/acr/report,” and the site would display the consumer’s full credit report. Oh wow, that's one of the dumbest security hole I've seen so far. That means you're either authenticated in the first screen, or the second assumes that you are whom you say you are if you lend on it. There's a clear lack of ethics from whomever built that, whom either didn't care, or didn't know enough know enough to excuse themselves from building it and ask for assistance. I mean, this is not your regular system. Everyone is in there, not that they have much of a choice, and it's their most sensitive data, that you decide you're up to the task to protect. I'm all for learning from your mistakes and I'm the first one to screw up once in a while, and to admit that I am not a security expert. But the size of this combined with how freaking dumb this issue is... This is most likely gross negligence. In most of other industries where people call themselves engineers, you would be putting your own professional reputation on the line when deciding you're up to the task. Then you would get in front of am ethics commission and likely get your license suspended or revoked.
- vinceguidry 4y ago
  It's nineties-level internet security. Stuff like that was the bread and butter of security researchers of that era.
  - contingencies 4y ago
    Closely related period fail: /receipt/<sequential-receipt-number-here>.pdf = all customers full booking history and personal data for all time.
  - NovemberWhiskey 4y ago
    I mean, sure, but nothing has changed since: "Broken Access Control" is still #1 on the OWASP Top Ten for 2021.
- xnorswap 4y ago
  It's just a classic IDOR, it's very easy to fall into with some frameworks. If you look, you see it everywhere. When stack-exchange rolled out their CV feature they had a similar thing which leaked everyone's email address regardless of the public profile visibility or whether they had even used the CV feature.
seanw444 4y ago
Why everything is tied to our SSN, I don't understand. Why we allow private companies to manage our US social credit score, I don't know either. There are a lot of things we've done here that make no sense.
- ncphil 4y ago
  ... because back in the 70s it was decided that disclosure (a/k/a "transparency") was all we'd ask of private companies (with exceptions, as in, some companies aren't even expected to disclose). Who do you think _actually owns_ the U.S. Congress anyway?
- jmclnx 4y ago
  The main reason is "the mark of the devil", every time the US Federal Gov. wanted to issues ID Cards, that came up. Just look at the "Real ID" issues, but that is still not a useful ID for everyone. Also if you look at your Social Security Card, it states "Not to be used for identification". But Companies, Univ and everyone ignored that because they wanted a Unique Number. Not may people realize the SSN is recycled as people die off. I wish the US Gov would sue all Companies and Orgs that used the SSN for ID purposes for trillions and return that amount to people with Social Security Numbers.
  - catiopatio 4y ago
    No, the issue isn’t religious irrationality — it’s understanding the inherent dangers of a mandatory government identification system and not wanting one. Unfortunately, we have several anyway, but that’s no reason to accept a universal inescapable federal ID that we would never be able to roll back. > I wish the US Gov would sue all Companies and Orgs that used the SSN for ID purposes for trillions and return that amount to people with Social Security Numbers. At least on that we agree. The SSN bas become a poor, backdoor replacement for federal identification documents — which is exactly what people were worried would happen, and why they received the sop of “not for identification”. That didn’t last long: https://www.nytimes.com/1998/07/26/weekinreview/the-nation-not-for-identification-purposes-just-kidding.html https://www.nytimes.com/1998/07/26/weekinreview/the-nation-n...
landemva 4y ago
The credit bureaus are moving in to work/payroll verification by hoovering payroll data that US companies voluntarily give to them. They sell access to data to people verifying income for loan application, and law offices, and child support services. I got job offer and told recruiter to put in writing that my payroll data will not be released without a court subpoena. Am waiting on response from recruiter. My outlook is that HR does not care about employees if they purposefully leak this info. Those concerned may want to ask their HR about payroll data sharing. https://www.experian.com/consumer-information/employment-income-verification-services https://www.experian.com/consumer-information/employment-inc... https://theworknumber.com https://theworknumber.com
- josephcsible 4y ago
  > I got job offer and told recruiter to put in writing that my payroll data will not be released without a court subpoena. Doesn't this kind of demand usually just result in you not getting the job?
  - dwardu 4y ago
    It would be a bullet dodged if so
  - nkrisc 4y ago
    Yeah, probably more often than not. But if you've got in-demand skills and can afford to be choosy, then go for it if it's important to you.
  - landemva 4y ago
    Not all companies give out payroll data. Better to learn now if finance/HR doesn't protect their employees and to decline the offer. Lack of qualified applicants ... or people have had enough. I do not consent.
- starwind 4y ago
  You can freeze the worknumber so people running background checks can't get information. When I changed jobs the company ran a background check and they kinda freaked out cause they couldn't get anything out of this database. I loved it.
sofixa 4y ago
It's interesting seeing the American credit model malfunction so badly so often (massive data leaks, crappy gaming of the system - even today i read on HN not to pay off your mortgage if you don't have any other loans or it might tank your credit score). As with a couple of other things, it's basically the only developed country with this model (useless for-profit middlemen for no good reason), it really sucks for the average consumer, yet there is no actual change coming. Why? Is it American exceptionalism refusing to acknowledge that there are better ways used elsewhere? Is it free market "absolutism" hoping the market will fix itself?
- jollyllama 4y ago
  It's not really malfunctioning, in my opinion. It's more or less designed to violate individual privacy and offer as many people access as efficiently as possible. Neither free market absolutism nor exceptionalism are the reason that it's designed this way. At least, not in the way that I think you mean it. Rather, it's because the current economy of the USA is an inflationary credit economy. It's a very un-free market; a great example is education. The government subsidizes loans which drive up the price, and put people in debt so that they are more desperate to take jobs.
  - deleted 4y ago
    [deleted]
  - lesuorac 4y ago
    I mean, a credit report is only useful if it actually tells me about _your_ credit worthiness. Sure, some Elon Musk guy might have enough credit worthiness to make a $44 billion purchase. But are _you_ Elon Musk or just some guy impersonating Elon Musk? Fraud may not be rampant enough currently but if Experian/etc continue to help fraudsters it will just keep getting worse.
- astura 4y ago
  >even today i read on HN not to pay off your mortgage if you don't have any other loans or it might tank your credit score Only when it drops off your report, which is 10 years after you pay it off. If you were so concerned about having a line of credit on your record then open up a credit card and don't use it, no reason to pay thousands of dollars in interest to avoid an abstract fear of "tanking your credit score." >it really sucks for the average consumer, yet there is no actual change coming I am an average consumer. The credit system is great for me! I'm able to demonstrate my responsibility and as a result I'm able to obtain a large amount of credit products at very low cost as well as pay less for insurance. I guess you can argue that the government should be providing this service rather than private companies or there should be more regulations around security, but the system only "really sucks" for people who take out loans and don't repay them.
twobitshifter 4y ago
How much value do the credit agencies add beyond what could be obtained by knowing income, location, number of dependents, and current debt/liabilities? verifying identity is another matter, but I’d expect what you put on the credit application to be the data that explains the defensible reasons to not give a loan, without needing a magic credit score.
- anonymouskimmer 4y ago
  "How much value do the credit agencies add beyond what could be obtained by knowing income, location, number of dependents, and current debt/liabilities?" Theoretically they verify these numbers. Otherwise people would lie. Presumably, in the credit score calculation, they also have actuarial tables that allow calculating the odds of delay or default for each person.
deleted 4y ago
[deleted]
galoisscobi 4y ago
Ugh, annoyingly Experian was the hardest one to do a credit freeze on. A few weeks ago, I was able to easily do a credit freeze on other bureaus but Experian wanted me to call them during business hours so I put it off. It might not help much but I’ll plan on doing the credit freeze with them today.
EricE 4y ago
A reminder that if you haven't frozen your credit with the three credit agencies - it's a great time to do so!
deleted 4y ago
[deleted]
DontchaKnowit 4y ago
Always thought Experian was a disgustingly juicy target and it was just a matter of time before something like this happened
ipython 4y ago
I strongly suspect this was more widely exploited than what's being let on. I have received hundreds of Medicare robocalls where the caller was suspiciously able to suss out a fake dossier - even though street addresses and names would be plausible, but the birthday and SSN were fake. I would definitely investigate this further to see if this knowledge was in the hands of criminals/scammers who were selling access for $$ over the past few years.
tibbon 4y ago
Why isn't there more regulation on these? It seems something that 99.9% of voters would want to get behind. These credit report agencies horde data and then misuse it so frequently. It feels like there needs to be some accountability for misuse of data like this and breaches, especially when there's essentially no way to opt out and still function in society.
- xyst 4y ago
  like the online tax return companies, their lobbyists push for minimal regulation
- int_19h 4y ago
  In a representative democracy, it doesn't matter whether 99% of the voters are behind the issue. What matters is where that issue is in the overall stack ranking of "important" issues, where "important" is defined as "effective for the purposes of winning elections". Basically, when it comes to voting, is this going to be the reason why you vote one way or the other? Or is it going to be the usual cocktail of taxes, abortion, immigration etc? If you have an opinion - no matter how strong - but they already have your vote, why should they care about it?
Phemist 4y ago
Meanwhile, UK Gov project One Login will use cloud services architectured by Experian: https://www.publictechnology.net/articles/news/government-plans-expand-departments%E2%80%99-powers-share-personal-data-support-one-login https://www.publictechnology.net/articles/news/government-pl...
alberth 4y ago
Naive question: what harm can come from someone having your credit record? Companies all the time do hard inquiries to access your credit record. EDIT: don't get me wrong, it's not good this was able to be done. But what's the actual impact though?
- tantalor 4y ago
  Came here to ask this. The article doesn't say why this is a bad thing. At best it implies poor security by the credit agencies might increase the risk that "identity thieves will ruin your financial future" but it doesn't say how access to a credit report will do this. Guessing: something in the report (what exactly?) might make taking out bogus loans easier by selecting the most vulnerable victims (why?)
- downrightmike 4y ago
  Fun one is they buy a motorcycle and insurance and keep charging it to you and you have to fight with the insurance companies to clear the debt.
- mynameisvlad 4y ago
  Identity verification questions are generally based on public records along with the credit report information. Some questions might not be detailed in the report (like how much a specific loan’s monthly payments are) but others would definitely be included, like the name of a creditor on file.
- janalsncm 4y ago
  If the credit record has your SSN, a criminal can pretend to be you and borrow money in your name. Then the bank will come after you for repayment and the credit reporting company will 1) report that you have outstanding debt 2) report on any “missed payments” on this debt 3) lower your credit score because of 1 and 4) share this false info with other credit reporting agencies.
tantalor 4y ago
This is a really poorly written article. It goes on and on about poor security and how much the credit agencies should not be trusted, but it never says why this disclosure is harmful or why anyone should care. To say "identify thieves do this" implies "this is harmful" is a post-hoc fallacy.
- ThaDood 4y ago
  I mean, I might be generalizing here but I think the target audience for Krebs is usually security minded individuals who probably don't need an explanation as to why having your credit information leaked is bad.
- projektfu 4y ago
  At the beginning of the article he mentions that Telegram channels where attackers discuss methods have been sharing the method, as part of their plans to steal money from people. If the red team wants it, it's probably worth their while.
janalsncm 4y ago
The whole concept of “identity theft” is a concoction meant to pass blame on to consumers rather than creditors. If a bank gives away money to a person pretending to be you, that shouldn’t be your problem. The bank screwed up. Your “identity” wasn’t stolen, the bank didn’t do basic due diligence and now they’re looking to pass the blame on to you. https://youtu.be/CS9ptA3Ya9E https://youtu.be/CS9ptA3Ya9E
- shortcake27 4y ago
  I’d be ok with it if my identity was a secret that I needed to guard myself. But it isn’t. My name, DOB, and address are made publicly available by my municipality. My drivers licence can’t be kept secret because the law requires me to carry it on my person, where it’s easily lost or stolen (and also needs to be shared in case of an accident). My passport also can’t be kept secret because every airline and hotel takes a scan of it. There are hundreds if not thousands of copies of my passport, most of which I assume are stored without any security whatsoever. These are physical documents that should only have power when produced physically. It simply shouldn’t be possible to do anything with just the details or a copy, especially not taking out credit in my name or taking over my bank accounts.
twinkletwinkle_ 4y ago
Without going into too much detail, I once encountered an Experian identity verification question on behalf of someone else. This person was an Uber driver making ~$20,000 per year. The question was: "According to our records, you purchased or leased one of the following vehicles in the previous year. Which vehicle do you currently own?" A. Maserati Granturismo B. Ferrari 458 Italia C. Aston Martin Lagonda D. Honda Accord So... 2 Italian supercars, another supercar with only 200 ever produced, or a mass market sedan. Bonus - of the 4 questions, you only needed to answer 1 correctly to pass the check.
gorbachev 4y ago
What's absolutely infuriating about this is that Brian Krebs has sounded the alarm about Experian's horrible security for a very long time, and Experian has done jack shit about their problems. This company needs to be shut down. It's incapable of safeguarding PII in a reasonable way.
- coldcode 4y ago
  Until our government creates a law that makes the credit bureaus have to pay every time their security fails, nothing will happen. They don't have to care and probably laugh at all of us. But politicians are cheap to buy off and nothing changes. I am sure all 3 of them have huge legal teams anxious to slap you silly if you try to sue them.
dboreham 4y ago
Ugh. "Identity Theft" is a term invented by the finance industry to victim-blame when their weak authentication mechanisms are compromised. We should instead talk about "Banks being defrauded by criminals due to lax procedures".
- dragonwriter 4y ago
  > "Identity Theft" is a term invented by the finance industry to victim-blame “Identity Theft” blames to the exploiter, instead of the (possibly negligently) exploitable system; it is shifting blame, but not principally to the victim. > We should instead talk about "Banks being defrauded by criminals due to lax procedures". If we want to focus responsibility on the banks, we should instrad talk about “Banks failing to safeguard customer funds”, or “Banks enabling criminals to steal customer funds.”
  - janalsncm 4y ago
    Just so it’s clear, if person A borrows money from bank B under person C’s name, person C will have to fix the problem. And make no mistake, it’s a huge problem. It will affect person C’s credit score and potentially cause loss of property as bank B will hound person C for their money back. This is in spite of the fact that there may be no relationship between B and C or A and C. And then credit reporting agencies D will happily report the lie from B, that C owes money to B. It’s completely upside down. And good luck getting the local police to fix the issue. https://youtu.be/otU-1Il7GfM https://youtu.be/otU-1Il7GfM
  - supertrope 4y ago
    Yeah. It's burden shifting. It should really be called "weak fraud controls." When one withdraws cash the bank is liable for unauthorized withdrawals so they use 2FA (debit card + PIN) and for larger amounts they check two forms of ID.
SPORTSCRYPO 4y ago
[dead]
smarri 4y ago
"you simply change the last part of the URL from “/acr/oow/” to “/acr/report,” and the site would display the consumer’s full credit report." Unreal.
davidkuennen 4y ago
It still boggles my mind how much you can do with another persons SSN in the US. It's like a password for your life in plain text. Crazy.
li2uR3ce 4y ago
I'm not surprised Experian's security is shit. Equafax proved that there are basically no consequences. Here's some basic free credit monitoring that you probably already had for free.
- janalsncm 4y ago
  I shouldn’t need credit monitoring in the first place. No, banks need to do their own credit monitoring i.e. monitor who they’re giving credit to. And not just that the name is credit worthy, but also that the person asking for the credit actually matches the name. And if they don’t, banks and credit reporters don’t get to slander me until the end of time about patently false debts.
JCM9 4y ago
Can Experian please just go away. This is just the latest example of where they’ve demonstrated themselves wholly unqualified to be handling the sort of data they handle. This is like elementary level security 101 stuff that they messed up here.
sohrob 4y ago
I was a victim of the Experian data breach in 2015 and I now have a lifetime of credit monitoring services to pay for, meanwhile Experian had to pay a fine that amounted to a slap on the wrist.
jimt1234 4y ago
The whole free-annual-credit-report-via-the-web-thing worked great in the beginning. I used it for years. Then, it went to shit. First, it was the barrage of ads for free credit monitoring or whatever. Then, it just stopped working altogether. It's now obvious they're just trying to make it as difficult as possible to get your free annual credit report, which, I think, is supposed to be guaranteed by law. I actually wrote to one of the credit agencies a few years ago (forget which one), attempting to get my free report. Three months later, the agency sent me an insane form to fill out to get the report. They also started mailing me ads, telling me how easy it was to obtain my credit report...if I paid them. Nice.
MichaelPayne 4y ago
It's so important everyone knows that this genius, Albert Vadim can fix your credit for you. I started to have credit at 18. I ran all my credit cards all the way up as I didn't know much about credit. At the time I had collections and all sorts of derogatory reports. I recently made a decision to get things together with the help of Vadimwebhack@gmail.com because I wanted a car. His program worked impressively for my credit and I got a new car. I consider him the best. You can also reach him on WhatsApp +17472252004

475 points by picture 4y ago

Huh. So basically these guys got access to stuff that thousands of companies and governments who subscribe to Experian already have, but didn't pay for it. Color me outraged.

agency 4y ago

I’m not surprised in the least bit. I keep my credit locked constantly since I’ve had my SSN leaked multiple times (by US government agencies). Every time I go to unfreeze it when I apply for credit at least one of the big 3 credit reporting agencies lets me unfreeze it without specifying the PIN I had to create when freezing. If there was any justice these companies would get the corporate death penalty.

Loughla 4y ago
I froze mine years ago when the first leak of my SS# happened thanks to one of the stupid credit agencies. I was happy and secure in the knowledge that it was locked until I had to unlock it the first time. The password I set didn't work, as they had apparently changed the log-in system with no alert (also, now the stupid log-in sends us spam e-mail that we can't opt out of). I called them. I had my account unlocked, and the phone representative even gave me my own SS# within three minutes of being on the phone, and by answering questions that were publicly available information. It's an absolute fucking train wreck and I wish the system as a whole and the credit companies in particular were destroyed.
- Terretta 4y ago
  > … and by answering questions that were publicly available information. The 3 questions fraud check system everyone uses to performatively pretend to ensure you are who you are, can only draw the questions it asks from — guess what — publicly available information. It's illogical on its face. // After identity theft, it gets worse, as thieves' fraudulent or real data will enter public records under your identity key, and now you can't pass your own check.
JumpCrisscross 4y ago
> these companies would get the corporate death penalty Would suggest replacing this in your vocabulary with “fines,” “license revocation” or “criminal penalties.” Corporate death penalties, i.e. judicial dissolution or charter revocations, while a good slogan, don’t make a lot of legal sense. As a result, I’ve found it in practice used to segregate activism and turnout operations (who like it) from rule and lawmaking influence (where it’s not a serious concept). Massive fines, equal to market cap, or absolute liability, e.g. a $10k + legal expenses minimum owed to each person whose data leaked irrespective of actual damages, for example, are more specific and actually actionable.
- nine_k 4y ago
  I understand "corporate death penalty" as a dissolution of the corporation, likely with some cool down time for the execs found guilty when they cannot work as execs. No violence should be involved. Large layoffs resulting from that won't be pleasant one bit though.
  - fragmede 4y ago
    [flagged]
    - jazzyjackson 4y ago
      I would suppose whoever is being forced to terminate their employees is doing so under the threat of state violence (men with guns), but the employees being fired are not being threatened with any force, they're just losing their job.
    - bastawhiz 4y ago
      If I start a company with the express purpose of having it commit crimes, it will be shut down and everyone employed will be fired. That's not on the government, that's on me, the employer. So then where is the line that we draw that says how badly a company needs to behave or how many crimes it needs to commit to justify it being dissolved? We should not tolerate crime for the sake of the livelihoods of the henchmen. "The death star is bad, but think of how many people would be unemployed if we stopped them" is exactly the argument they want you to make.
rootusrootus 4y ago
PINs for freezes seems to be a thing of the past. I recently unfroze all of my credit reports momentarily so they could be accessed, and none of the big three asked for the PIN. They each have their own login and as soon as you authenticate to that, you're good.

SketchySeaBeast 4y ago

Every single report like this serves to make me feel sick and angry. These organizations are responsible for so much data that can literally ruin lives and they can't be bothered to think through their solutions. It's not but should be criminal.

asah 4y ago
Specifically, personal penalties for the exec teams. Do this once, and they'll take 10x the level of care going forward.
- pwg 4y ago
  > personal penalties for the exec teams. Yes, but the penalties have to be such that the exec does not simply view it as "cost of doing business" and mark it down as a business expense.
  - asah 4y ago
    good point - also can't be covered by an insurance policy or reimbursement or pay increase or special bonus. I guess we're arguing for non-financial penalties...
  - thefurdrake 4y ago
    5% of their investment of the company per offense.
bobkazamakis 4y ago
If security doesn't impact their bottom line, it's just another beautiful salary for the C suite to parachute off of.

surume 4y ago

This isn't the first time that a major Credit Bureau has had a data leak, is it? Wasn't there a huge one a few years back?

berkle4455 4y ago
Experian and Equifax have security leaks all the time yeah
- surume 4y ago
  "Identity thieves have been exploiting a glaring security weakness in the website of Experian" Shouldn't Experian have been thoroughly audited by the gov't after the last major data breach? The above sounds pretty out in the open, no?
  - lesuorac 4y ago
    > Shouldn't Experian have been thoroughly audited by the gov't after the last major data breach? That sounds pretty unconstitutional. Why would the USG audit a private company for security?
    - AlotOfReading 4y ago
      It seems like it'd be a national security issue at the very least. Those databases also contain an up-to-date financial picture of government employees holding security clearances. Even if clearance holders are nominally supposed to remain above-board and unsusceptible, I'm willing to bet that enough data mining would allow decent targeting. The DoD is already monitoring those employee's credit reports, so clearly there must be something actionable in them and it's quite likely they miss something.
    - thefurdrake 4y ago
      Which part of the Constitution is violated by the government scanning a website's publicly-available, advertised resources on the clearnet?

deleted 4y ago

[deleted]

charles_f 4y ago

> you simply change the last part of the URL from “/acr/oow/” to “/acr/report,” and the site would display the consumer’s full credit report. Oh wow, that's one of the dumbest security hole I've seen so far. That means you're either authenticated in the first screen, or the second assumes that you are whom you say you are if you lend on it. There's a clear lack of ethics from whomever built that, whom either didn't care, or didn't know enough know enough to excuse themselves from building it and ask for assistance. I mean, this is not your regular system. Everyone is in there, not that they have much of a choice, and it's their most sensitive data, that you decide you're up to the task to protect. I'm all for learning from your mistakes and I'm the first one to screw up once in a while, and to admit that I am not a security expert. But the size of this combined with how freaking dumb this issue is... This is most likely gross negligence. In most of other industries where people call themselves engineers, you would be putting your own professional reputation on the line when deciding you're up to the task. Then you would get in front of am ethics commission and likely get your license suspended or revoked.

vinceguidry 4y ago
It's nineties-level internet security. Stuff like that was the bread and butter of security researchers of that era.
- contingencies 4y ago
  Closely related period fail: /receipt/<sequential-receipt-number-here>.pdf = all customers full booking history and personal data for all time.
- NovemberWhiskey 4y ago
  I mean, sure, but nothing has changed since: "Broken Access Control" is still #1 on the OWASP Top Ten for 2021.
xnorswap 4y ago
It's just a classic IDOR, it's very easy to fall into with some frameworks. If you look, you see it everywhere. When stack-exchange rolled out their CV feature they had a similar thing which leaked everyone's email address regardless of the public profile visibility or whether they had even used the CV feature.

seanw444 4y ago

Why everything is tied to our SSN, I don't understand. Why we allow private companies to manage our US social credit score, I don't know either. There are a lot of things we've done here that make no sense.

ncphil 4y ago
... because back in the 70s it was decided that disclosure (a/k/a "transparency") was all we'd ask of private companies (with exceptions, as in, some companies aren't even expected to disclose). Who do you think _actually owns_ the U.S. Congress anyway?
jmclnx 4y ago
The main reason is "the mark of the devil", every time the US Federal Gov. wanted to issues ID Cards, that came up. Just look at the "Real ID" issues, but that is still not a useful ID for everyone. Also if you look at your Social Security Card, it states "Not to be used for identification". But Companies, Univ and everyone ignored that because they wanted a Unique Number. Not may people realize the SSN is recycled as people die off. I wish the US Gov would sue all Companies and Orgs that used the SSN for ID purposes for trillions and return that amount to people with Social Security Numbers.
- catiopatio 4y ago
  No, the issue isn’t religious irrationality — it’s understanding the inherent dangers of a mandatory government identification system and not wanting one. Unfortunately, we have several anyway, but that’s no reason to accept a universal inescapable federal ID that we would never be able to roll back. > I wish the US Gov would sue all Companies and Orgs that used the SSN for ID purposes for trillions and return that amount to people with Social Security Numbers. At least on that we agree. The SSN bas become a poor, backdoor replacement for federal identification documents — which is exactly what people were worried would happen, and why they received the sop of “not for identification”. That didn’t last long: https://www.nytimes.com/1998/07/26/weekinreview/the-nation-not-for-identification-purposes-just-kidding.html https://www.nytimes.com/1998/07/26/weekinreview/the-nation-n...

landemva 4y ago

The credit bureaus are moving in to work/payroll verification by hoovering payroll data that US companies voluntarily give to them. They sell access to data to people verifying income for loan application, and law offices, and child support services. I got job offer and told recruiter to put in writing that my payroll data will not be released without a court subpoena. Am waiting on response from recruiter. My outlook is that HR does not care about employees if they purposefully leak this info. Those concerned may want to ask their HR about payroll data sharing. https://www.experian.com/consumer-information/employment-income-verification-services https://www.experian.com/consumer-information/employment-inc... https://theworknumber.com https://theworknumber.com

josephcsible 4y ago
> I got job offer and told recruiter to put in writing that my payroll data will not be released without a court subpoena. Doesn't this kind of demand usually just result in you not getting the job?
- dwardu 4y ago
  It would be a bullet dodged if so
- nkrisc 4y ago
  Yeah, probably more often than not. But if you've got in-demand skills and can afford to be choosy, then go for it if it's important to you.
- landemva 4y ago
  Not all companies give out payroll data. Better to learn now if finance/HR doesn't protect their employees and to decline the offer. Lack of qualified applicants ... or people have had enough. I do not consent.
starwind 4y ago
You can freeze the worknumber so people running background checks can't get information. When I changed jobs the company ran a background check and they kinda freaked out cause they couldn't get anything out of this database. I loved it.

sofixa 4y ago

It's interesting seeing the American credit model malfunction so badly so often (massive data leaks, crappy gaming of the system - even today i read on HN not to pay off your mortgage if you don't have any other loans or it might tank your credit score). As with a couple of other things, it's basically the only developed country with this model (useless for-profit middlemen for no good reason), it really sucks for the average consumer, yet there is no actual change coming. Why? Is it American exceptionalism refusing to acknowledge that there are better ways used elsewhere? Is it free market "absolutism" hoping the market will fix itself?

jollyllama 4y ago
It's not really malfunctioning, in my opinion. It's more or less designed to violate individual privacy and offer as many people access as efficiently as possible. Neither free market absolutism nor exceptionalism are the reason that it's designed this way. At least, not in the way that I think you mean it. Rather, it's because the current economy of the USA is an inflationary credit economy. It's a very un-free market; a great example is education. The government subsidizes loans which drive up the price, and put people in debt so that they are more desperate to take jobs.
- deleted 4y ago
  [deleted]
- lesuorac 4y ago
  I mean, a credit report is only useful if it actually tells me about _your_ credit worthiness. Sure, some Elon Musk guy might have enough credit worthiness to make a $44 billion purchase. But are _you_ Elon Musk or just some guy impersonating Elon Musk? Fraud may not be rampant enough currently but if Experian/etc continue to help fraudsters it will just keep getting worse.
astura 4y ago
>even today i read on HN not to pay off your mortgage if you don't have any other loans or it might tank your credit score Only when it drops off your report, which is 10 years after you pay it off. If you were so concerned about having a line of credit on your record then open up a credit card and don't use it, no reason to pay thousands of dollars in interest to avoid an abstract fear of "tanking your credit score." >it really sucks for the average consumer, yet there is no actual change coming I am an average consumer. The credit system is great for me! I'm able to demonstrate my responsibility and as a result I'm able to obtain a large amount of credit products at very low cost as well as pay less for insurance. I guess you can argue that the government should be providing this service rather than private companies or there should be more regulations around security, but the system only "really sucks" for people who take out loans and don't repay them.

twobitshifter 4y ago

How much value do the credit agencies add beyond what could be obtained by knowing income, location, number of dependents, and current debt/liabilities? verifying identity is another matter, but I’d expect what you put on the credit application to be the data that explains the defensible reasons to not give a loan, without needing a magic credit score.

anonymouskimmer 4y ago
"How much value do the credit agencies add beyond what could be obtained by knowing income, location, number of dependents, and current debt/liabilities?" Theoretically they verify these numbers. Otherwise people would lie. Presumably, in the credit score calculation, they also have actuarial tables that allow calculating the odds of delay or default for each person.

deleted 4y ago

[deleted]

galoisscobi 4y ago

Ugh, annoyingly Experian was the hardest one to do a credit freeze on. A few weeks ago, I was able to easily do a credit freeze on other bureaus but Experian wanted me to call them during business hours so I put it off. It might not help much but I’ll plan on doing the credit freeze with them today.

EricE 4y ago

A reminder that if you haven't frozen your credit with the three credit agencies - it's a great time to do so!

deleted 4y ago

[deleted]

DontchaKnowit 4y ago

Always thought Experian was a disgustingly juicy target and it was just a matter of time before something like this happened

ipython 4y ago

I strongly suspect this was more widely exploited than what's being let on. I have received hundreds of Medicare robocalls where the caller was suspiciously able to suss out a fake dossier - even though street addresses and names would be plausible, but the birthday and SSN were fake. I would definitely investigate this further to see if this knowledge was in the hands of criminals/scammers who were selling access for $$ over the past few years.

tibbon 4y ago

Why isn't there more regulation on these? It seems something that 99.9% of voters would want to get behind. These credit report agencies horde data and then misuse it so frequently. It feels like there needs to be some accountability for misuse of data like this and breaches, especially when there's essentially no way to opt out and still function in society.

xyst 4y ago
like the online tax return companies, their lobbyists push for minimal regulation
int_19h 4y ago
In a representative democracy, it doesn't matter whether 99% of the voters are behind the issue. What matters is where that issue is in the overall stack ranking of "important" issues, where "important" is defined as "effective for the purposes of winning elections". Basically, when it comes to voting, is this going to be the reason why you vote one way or the other? Or is it going to be the usual cocktail of taxes, abortion, immigration etc? If you have an opinion - no matter how strong - but they already have your vote, why should they care about it?

Phemist 4y ago

Meanwhile, UK Gov project One Login will use cloud services architectured by Experian: https://www.publictechnology.net/articles/news/government-plans-expand-departments%E2%80%99-powers-share-personal-data-support-one-login https://www.publictechnology.net/articles/news/government-pl...

alberth 4y ago

Naive question: what harm can come from someone having your credit record? Companies all the time do hard inquiries to access your credit record. EDIT: don't get me wrong, it's not good this was able to be done. But what's the actual impact though?

tantalor 4y ago
Came here to ask this. The article doesn't say why this is a bad thing. At best it implies poor security by the credit agencies might increase the risk that "identity thieves will ruin your financial future" but it doesn't say how access to a credit report will do this. Guessing: something in the report (what exactly?) might make taking out bogus loans easier by selecting the most vulnerable victims (why?)
downrightmike 4y ago
Fun one is they buy a motorcycle and insurance and keep charging it to you and you have to fight with the insurance companies to clear the debt.
mynameisvlad 4y ago
Identity verification questions are generally based on public records along with the credit report information. Some questions might not be detailed in the report (like how much a specific loan’s monthly payments are) but others would definitely be included, like the name of a creditor on file.
janalsncm 4y ago
If the credit record has your SSN, a criminal can pretend to be you and borrow money in your name. Then the bank will come after you for repayment and the credit reporting company will 1) report that you have outstanding debt 2) report on any “missed payments” on this debt 3) lower your credit score because of 1 and 4) share this false info with other credit reporting agencies.

tantalor 4y ago

This is a really poorly written article. It goes on and on about poor security and how much the credit agencies should not be trusted, but it never says why this disclosure is harmful or why anyone should care. To say "identify thieves do this" implies "this is harmful" is a post-hoc fallacy.

ThaDood 4y ago
I mean, I might be generalizing here but I think the target audience for Krebs is usually security minded individuals who probably don't need an explanation as to why having your credit information leaked is bad.
projektfu 4y ago
At the beginning of the article he mentions that Telegram channels where attackers discuss methods have been sharing the method, as part of their plans to steal money from people. If the red team wants it, it's probably worth their while.

janalsncm 4y ago

The whole concept of “identity theft” is a concoction meant to pass blame on to consumers rather than creditors. If a bank gives away money to a person pretending to be you, that shouldn’t be your problem. The bank screwed up. Your “identity” wasn’t stolen, the bank didn’t do basic due diligence and now they’re looking to pass the blame on to you. https://youtu.be/CS9ptA3Ya9E https://youtu.be/CS9ptA3Ya9E

shortcake27 4y ago
I’d be ok with it if my identity was a secret that I needed to guard myself. But it isn’t. My name, DOB, and address are made publicly available by my municipality. My drivers licence can’t be kept secret because the law requires me to carry it on my person, where it’s easily lost or stolen (and also needs to be shared in case of an accident). My passport also can’t be kept secret because every airline and hotel takes a scan of it. There are hundreds if not thousands of copies of my passport, most of which I assume are stored without any security whatsoever. These are physical documents that should only have power when produced physically. It simply shouldn’t be possible to do anything with just the details or a copy, especially not taking out credit in my name or taking over my bank accounts.

twinkletwinkle_ 4y ago

Without going into too much detail, I once encountered an Experian identity verification question on behalf of someone else. This person was an Uber driver making ~$20,000 per year. The question was: "According to our records, you purchased or leased one of the following vehicles in the previous year. Which vehicle do you currently own?" A. Maserati Granturismo B. Ferrari 458 Italia C. Aston Martin Lagonda D. Honda Accord So... 2 Italian supercars, another supercar with only 200 ever produced, or a mass market sedan. Bonus - of the 4 questions, you only needed to answer 1 correctly to pass the check.

gorbachev 4y ago

What's absolutely infuriating about this is that Brian Krebs has sounded the alarm about Experian's horrible security for a very long time, and Experian has done jack shit about their problems. This company needs to be shut down. It's incapable of safeguarding PII in a reasonable way.

coldcode 4y ago
Until our government creates a law that makes the credit bureaus have to pay every time their security fails, nothing will happen. They don't have to care and probably laugh at all of us. But politicians are cheap to buy off and nothing changes. I am sure all 3 of them have huge legal teams anxious to slap you silly if you try to sue them.

dboreham 4y ago

Ugh. "Identity Theft" is a term invented by the finance industry to victim-blame when their weak authentication mechanisms are compromised. We should instead talk about "Banks being defrauded by criminals due to lax procedures".

dragonwriter 4y ago
> "Identity Theft" is a term invented by the finance industry to victim-blame “Identity Theft” blames to the exploiter, instead of the (possibly negligently) exploitable system; it is shifting blame, but not principally to the victim. > We should instead talk about "Banks being defrauded by criminals due to lax procedures". If we want to focus responsibility on the banks, we should instrad talk about “Banks failing to safeguard customer funds”, or “Banks enabling criminals to steal customer funds.”
- janalsncm 4y ago
  Just so it’s clear, if person A borrows money from bank B under person C’s name, person C will have to fix the problem. And make no mistake, it’s a huge problem. It will affect person C’s credit score and potentially cause loss of property as bank B will hound person C for their money back. This is in spite of the fact that there may be no relationship between B and C or A and C. And then credit reporting agencies D will happily report the lie from B, that C owes money to B. It’s completely upside down. And good luck getting the local police to fix the issue. https://youtu.be/otU-1Il7GfM https://youtu.be/otU-1Il7GfM
- supertrope 4y ago
  Yeah. It's burden shifting. It should really be called "weak fraud controls." When one withdraws cash the bank is liable for unauthorized withdrawals so they use 2FA (debit card + PIN) and for larger amounts they check two forms of ID.

SPORTSCRYPO 4y ago

[dead]

smarri 4y ago

"you simply change the last part of the URL from “/acr/oow/” to “/acr/report,” and the site would display the consumer’s full credit report." Unreal.

davidkuennen 4y ago

It still boggles my mind how much you can do with another persons SSN in the US. It's like a password for your life in plain text. Crazy.

li2uR3ce 4y ago

I'm not surprised Experian's security is shit. Equafax proved that there are basically no consequences. Here's some basic free credit monitoring that you probably already had for free.

janalsncm 4y ago
I shouldn’t need credit monitoring in the first place. No, banks need to do their own credit monitoring i.e. monitor who they’re giving credit to. And not just that the name is credit worthy, but also that the person asking for the credit actually matches the name. And if they don’t, banks and credit reporters don’t get to slander me until the end of time about patently false debts.

JCM9 4y ago

Can Experian please just go away. This is just the latest example of where they’ve demonstrated themselves wholly unqualified to be handling the sort of data they handle. This is like elementary level security 101 stuff that they messed up here.

sohrob 4y ago

I was a victim of the Experian data breach in 2015 and I now have a lifetime of credit monitoring services to pay for, meanwhile Experian had to pay a fine that amounted to a slap on the wrist.

jimt1234 4y ago

The whole free-annual-credit-report-via-the-web-thing worked great in the beginning. I used it for years. Then, it went to shit. First, it was the barrage of ads for free credit monitoring or whatever. Then, it just stopped working altogether. It's now obvious they're just trying to make it as difficult as possible to get your free annual credit report, which, I think, is supposed to be guaranteed by law. I actually wrote to one of the credit agencies a few years ago (forget which one), attempting to get my free report. Three months later, the agency sent me an insane form to fill out to get the report. They also started mailing me ads, telling me how easy it was to obtain my credit report...if I paid them. Nice.

MichaelPayne 4y ago

It's so important everyone knows that this genius, Albert Vadim can fix your credit for you. I started to have credit at 18. I ran all my credit cards all the way up as I didn't know much about credit. At the time I had collections and all sorts of derogatory reports. I recently made a decision to get things together with the help of Vadimwebhack@gmail.com because I wanted a car. His program worked impressively for my credit and I got a new car. I consider him the best. You can also reach him on WhatsApp +17472252004