7 ms·
Hackers threatening to publish a stolen sanctions and financial crimes watchlist
- ghostpepper 3y agoIt’s an interesting perspective for the LSEG to say (paraphrasing) “we maintain a sensitive database that we gave to a third party (presumably with some amount of vetting, since the data is sensitive) and that third party did not adequately secure it, therefore this is not a security lapse on our part” I’m not sure if I buy it.
- lazide 3y agoPass-the-buck is the oldest game in the book.
- meragrin_ 3y agoIf the hackers phished the customers of the third-party and used their accounts to scrape the information in some way, would you consider that a security lapse on LSEG's part?
- hardlianotion 3y agoI was going to make this point. It is of course a breach of security on their part. If a company believes that the data they collect is sensitive, then they need to take great care about the partners they share information with, including their capacity to protect it - it's a matter of common sense that the easiest places to breach will be the places suffering the data leak.
- Havoc 3y agoBit of a nothingburger. The whole point of world-check as a service is that you can access it. This is not exactly info locked away in a vault. Sucks for them as a business and perhaps some interesting connections/stats can be gleaned from having the whole thing as a unit for analysis...but meh.
- pseingatl 3y agoIs there some reason why these records should not be public? Making them public would lead both to greater accuracy and their more widespread use keeps criminals out of the financial systems.
- kube-system 3y agoThis is a list made up of other lists, and some of those lists, like sanctions lists, are public. e.g.: https://ofac.treasury.gov/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists https://ofac.treasury.gov/specially-designated-nationals-and... > their more widespread use keeps criminals out of the financial systems. Governments already have solved this by requiring banks to use lists like these (or similar subsets of these) where desired.
- psychlops 3y agoI'm not seeing a problem with them going public either. The article even states that there are innocent people on the list. It would be nice to know so they can contest and clear their data off the list.
- kube-system 3y ago> It would be nice to know so they can contest and clear their data off the list. That can be done here: https://www.lseg.com/en/risk-intelligence/screening-solutions/world-check-kyc-screening/about/am-i-listed-on-world-check https://www.lseg.com/en/risk-intelligence/screening-solution...
- lazide 3y agoOnly if you know you're on it and why though, right?
- kube-system 3y agoThat's the case whether or not it's public.
- mrangle 3y ago"Hackers" want to publicly snitch on those with supposed "links" to financial crime and sanctions. Not convictions nor actual sanctions, but links. Like the same brand of hacker that is all in on bitcoin, anarchy, etc? Hackers are shaming agents in service of the State Department now? Sell us another one. People should not be de-personed because a bank thinks that they are risky. The population, in general, needs to stop pretending that anonymous "hackers" are legitimate justice advocates instead of the likely state actors that they are. Unless they want anything of the sort to be co-opted and then utilized against them.
- nradov 3y agoHackers come in many different flavors. It's entirely possible that this group is state sponsored. Would that really change anything? I don't see anyone seriously claiming that leaking this data would deliver any sort of legitimate justice.
- mrangle 3y agoMy point was that it should change public support for their intended data release. Because no one should be ok with the State anonymously doxxing uncharged targets, let alone people who are merely on lists as being known to have "links". I assume that such an action would be to create both leverage and punishment, outside of what legal constraints would otherwise allow. The nature of democracy is such that the government can't punish individual citizens via stealth practices, and the citizenry can't be ok with it. Generally speaking, this type of thing would have been vetted by a journalist. Who would have acted as the final release valve, after verifying that the source was legitimate and not, for example, the government itself. While keeping the source confidential, and vetting the information for the ethics and justification for its release. But today it would be foolish to trust most journalists with that process. And so the public are left with the judgement as to the possible motivations, identities, and probable legitimacy of the actions of anonymous sources who, for whatever reason, aren't first releasing to journalists. Backstops removed, such an action represents a lot of social risk and begs questions.
- nimbius 3y ago
- PeterStuer 3y agoA Worldcheck sub gives you access to all the lists. How is this "hacking"?
- kube-system 3y agoThis part: > illegally obtained from the third party’s system
- pc86 3y agoThat makes it theft but doesn't make it hacking.
- kube-system 3y agoLegally speaking, in many/most places, taking any data you're not supposed to take from a computer system is 'hacking'. This is a story about a hacking group that took data they're not supposed to have. I don't see many scenarios in which it wouldn't qualify.
- PeterStuer 3y agoI've integrated worldcheck for AML in financial service companies. Just like any other consultant doing this type of work, I could have walked out the door with a full copy of the DB on my laptop or a USB stick any time I wanted. Doing that might have made me a 'pirate' or a thief, but rest assured no 'hacking' would have been involved.
- kube-system 3y agoThe data was stolen by a hacking group, not employees
- justinclift 3y agoThat's what's claimed. Could be an insider job instead though.
- Rickasaurus 3y agoWe used WorldCheck data at my last startup, it was the best in the business at the time. High quality groomed data, well tagged, with an actual timeline for each entity that explains why they're in there. Absolute top notch.
- pc86 3y agoYeah if you don't care about the false positives I'm sure it was great.
- somelamer567 3y agoTo use the World-Check datafile, you need decent tooling to go with it. You can either build your own, or use theirs. That said, it’s only as good as the analysts using the tools as well as the consultants configuring it. It’s a hard problem. Source: worked as a developer on World-Check One for ten years.
- fullspectrumdev 3y agoFrom reviewing my own record there - it contained some factual errors. Friends reported the same.
- faserx 3y agoso what's the big deal? (barely) every bank in the world has access to the world check database and there is no "secret data" in it. Just a collection of public records...
- dcan 3y agoI wouldn’t consider passport, social security, or bank account numbers “public records”.
- faserx 3y agoUnless it is a different subscription, I've never seen such information in the worldcheck database.
- SushiHippie 3y agoFrom TFA: > The data varies by record. The database contains names, passport numbers, Social Security numbers, online crypto account identifiers and bank account numbers, and more.
- fullspectrumdev 3y agoOh, I’m in that database! You might be also - if you are EU based, send them a request under GDPR.
- BeFlatXIII 3y ago> financially motivated criminal hacking group Sad! This information should be published because it's in the public's interest, not because someone didn't pay up.
- barfbagginus 3y agoPublish the list! I wanna show people I'm on it! You're not paranoid if they're actually after ya!