4 ms·

At this point I'm willing to bet that every single American -- including the Amish -- have been part of at least one major data breach. And for everyone on HN.

by mikece 3y ago

At this point I'm willing to bet that every single American -- including the Amish -- have been part of at least one major data breach. And for everyone on HN... probably at least ten.

fatnoah 3y ago
I've been part of four or five breaches. My favorite part is the complete lack of value in the mitigations for me. I was part of the OPM data breach, and the data included was literally everything, since it was everything collected as part of my application for a security clearance. A result of that was 10 years of credit monitoring, so every new breach's offer of 12 or 24 months of monitoring is useless. Until there are statutory damages for data breaches, and even steeper ones for failure to report breaches, companies aren't going to properly safeguard data.
- phatskat 3y ago
  > statutory damages for data breaches, and even steeper ones for failure to report breaches If say an engineer becomes aware of a breech, would going public if their company didn’t do so within the legal timeframes to report be covered by whistleblower protections?
bonton89 3y ago
My understanding is about everyone in America (and bizarrely a lot of people in Europe) got f'ed by the Equifax breech already.
- flutas 3y ago
  TBH, I know of at least one other breach that everyone got hit by too...afaik it was never made public though. It's been a while since I was told the story, so bear with me. It was Experian. They shipped tape backups of essentially their entire consumer credit DB, unencrypted, via UPS. UPS truck got robbed at gunpoint, only one package stolen... EDIT: Transunion -> Experian
  - michaelcampbell 3y ago
    Back when people got physical checks for payroll, I worked at a company that did this, and gave physical stubs to those of use who did direct deposit which was still kind of new. Biweekly, the person handing them out would take them home to sort by floor/area/whatever to ease their work the next day. You guessed it, one day their car was stolen, with ALL of our checks/stubs in them. And our SSN's were printed on them too. We were given a year of credit monitoring at the credit unions, paid for by the company. And they stopped printing the SSN's on them.
  - shnock 3y ago
    Could you please share some online references or sources for this? "It was never made public" - do you mean to imply that this is otherwise unverifiable
    - ffpip 3y ago
      Might be this - https://www.nytimes.com/2005/06/07/business/personal-data-for-39-million-lost-in-transit.html https://www.nytimes.com/2005/06/07/business/personal-data-fo... First result for "experian ups truck stolen"

by mikece 3y ago

At this point I'm willing to bet that every single American -- including the Amish -- have been part of at least one major data breach. And for everyone on HN... probably at least ten.

fatnoah 3y ago

I've been part of four or five breaches. My favorite part is the complete lack of value in the mitigations for me. I was part of the OPM data breach, and the data included was literally everything, since it was everything collected as part of my application for a security clearance. A result of that was 10 years of credit monitoring, so every new breach's offer of 12 or 24 months of monitoring is useless. Until there are statutory damages for data breaches, and even steeper ones for failure to report breaches, companies aren't going to properly safeguard data.

phatskat 3y ago
> statutory damages for data breaches, and even steeper ones for failure to report breaches If say an engineer becomes aware of a breech, would going public if their company didn’t do so within the legal timeframes to report be covered by whistleblower protections?

bonton89 3y ago

My understanding is about everyone in America (and bizarrely a lot of people in Europe) got f'ed by the Equifax breech already.

flutas 3y ago
TBH, I know of at least one other breach that everyone got hit by too...afaik it was never made public though. It's been a while since I was told the story, so bear with me. It was Experian. They shipped tape backups of essentially their entire consumer credit DB, unencrypted, via UPS. UPS truck got robbed at gunpoint, only one package stolen... EDIT: Transunion -> Experian
- michaelcampbell 3y ago
  Back when people got physical checks for payroll, I worked at a company that did this, and gave physical stubs to those of use who did direct deposit which was still kind of new. Biweekly, the person handing them out would take them home to sort by floor/area/whatever to ease their work the next day. You guessed it, one day their car was stolen, with ALL of our checks/stubs in them. And our SSN's were printed on them too. We were given a year of credit monitoring at the credit unions, paid for by the company. And they stopped printing the SSN's on them.
- shnock 3y ago
  Could you please share some online references or sources for this? "It was never made public" - do you mean to imply that this is otherwise unverifiable
  - ffpip 3y ago
    Might be this - https://www.nytimes.com/2005/06/07/business/personal-data-for-39-million-lost-in-transit.html https://www.nytimes.com/2005/06/07/business/personal-data-fo... First result for "experian ups truck stolen"