6 ms·

> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of

• itopaloglu83 6mo ago
  [flagged]
  • john_strinlai 6mo ago
    did you just want an excuse to say "microslop" or what is the relevance of your comment to either the article or the comment you are replying to?
  • add-sub-mul-div 6mo ago
    hackernews.txt
• throwup238 6mo ago
  Wait, you don’t even get a month of free credit monitoring?
  • gus_massa 6mo ago
    I'm not sure about France, but here in Argentina all this info is assumed to be public. If you want a credit at a bank or shop, they ask for a physical copy of the national ID [1], probably a photocopy too, an electricity or water bill and perhaps other paperwork that is hard to get (verified phone number???). [1] Do you want my number? It's inside this list: for i in range(1E9): print (i)
    • deleted 6mo ago
      [deleted]
    • Traubenfuchs 6mo ago
      If you are that unconcerned, why do you not provide us with your information right here and now?
    • deleted 6mo ago
      [deleted]
    • vladvasiliu 6mo ago
      It's supposed to be identifying information here. Usually, you can just send copies of those documents, which means that if you're looking to impersonate someone, you can easily produce fakes. And since everyone and their grandmother asks for these, people don't bat an eye and send them. The coup de grace of security in France is signatures, though. Now, since you can't produce a physical signature over the internet, they'll ask for your phone number and send you a text with a code. Once you've entered it on their web form, you've proved undoubtedly you are who you say you are.
      • prmoustache 6mo ago
        Physical signature are as useless anyway. We could just mark an X and it would be exactly the same. It only proves that some anoynmous person had a pen and was not afraid to use it.
        • hk__2 6mo ago
          You usually register a copy of your signature when you get an ID card or a bank account, so no it’s no like an X; you’d have to actually sign like the person you’re trying to impersonate.
          • gus_massa 6mo ago
            Once I had a problem in the bank because in the registration card I had a small space (.5x3cm (1/4x1 inches?)), so my real signature was different.
  • tcgv 6mo ago
    My full name, phone number, and address were leaked by TAP Air Portugal about five years ago, along with the details of my parents who were on the same booking. Since then, my dad has been targeted by those types of scams where a fraudster impersonates me to ask for money. I never received a notification from TAP; I only found out a year later through my Google One security feature. I certainly didn't get an apology—much less a free travel ticket!
    • VadimPR 6mo ago
      I'm dissatisfied about the TAP leak as well! I was affected, and like you, didn't even receive a notification - nevermind compensation for having leaked my personal data to the dark web enabling all sorts of shenanigans that make my personal life difficult.
      • nunobrito 6mo ago
        About 2 million portuguese there. Basically all active portuguese adults that have enough financial conditions to travel by airplane. It was a fantastic leak, based from an excel file asked by a marketing department which forgot it inside a shared folder on the hacked (private) server. There was far more info there than just that, also included the details of employees and more interesting if they were on medical leave. Curiously enough many of those employees were family members from politicians and well-known people. Some of those in long term sick leave were receiving a monthly salary while conducting live shows on festivals during the summer. Nothing happened on the news. They all went silent about this case.
        • lostlogin 6mo ago
          It’s scams all the way down.
    • tiagod 6mo ago
      That TAP data was leaked on a tor hidden service, in multiple files, and download was extremely slow on the days following the leak. One of the files was much smaller, and my friend had the bad luck to have his data in that one. His phone was spammed so incessantly he had to change his number almost immediately.
  • sofixa 6mo ago
    There is no such thing in France (or most countries for that matter). It's a pretty absurd system that gamifies and profits off heuristics, and results in a Kafkaesque nightmare where you can't get a job, rent a place or get a loan because of an arbitrary value assigned by a company with a profit motive. One that has no incentive to get things right or even get the right person. How things work in France is much simpler and better. When you apply for a loan, the lender checks with Banque de France (national bank) if you have outstanding debts and if you've defaulted on any debts in the past 5 years. That's it, that and your proof of revenue is all they need.
  • dboreham 6mo ago
    Fairly sure this is an ironic comment. (Credit monitoring is the useless thing companies give people in the US when their information is leaked -- everyone in the industry knows it's laughably unrelated to private information disclosure).
  • Thaxll 6mo ago
    The credit system is not the same in Europe, first of all there is no such thing as credit rating and what not. People don't have credit card like the one in US and Canada. The vast majority use a debit card.
    • jampekka 6mo ago
      In UK there is. :(
      • ifwinterco 6mo ago
        Nothing like america though, lots of people (maybe the majority) cruise through life with 1-2 credit cards and occasionally apply for a mortgage without ever really thinking about their credit rating. Being obsessed or even thinking about your credit rating in the UK is a bit of a minority reddit pursuit not something normal people do. (Of course if you default on stuff you will need to think about it)
    • csnweb 6mo ago
      We do very much have credit rating in Germany, might be very different than the one in the US, don’t know theirs.
    • red-iron-pine 6mo ago
      the credit rating system in Europe is quite different from the one in the United States and varies significantly from country to country. but credit ratings are definitely a thing, they're just not FICO scores. Equafax is still a thing in the UK and Spain, etc.
  • freedomben 6mo ago
    Heh, for real, it's maddening how often this is the "solution" to any breach. It's especially lovely when it comes from multiple companies at the same time, that may or may not have leaked your SSN.
• ge96 6mo ago
  > Nothing really new here sadly Facts at Equifax
• shevy-java 6mo ago
  Not disagreeing with you, but: > These things will never change if the only penalty the company/agency gets is I do not think penalties can prevent these situations. Perhaps they may be less frequent; perhaps people would get more compensation, but ultimately I do not think these can be prevented. The first consideration is why the data has to be stored in the first place. Naturally one can say "the government needs to know who is a citizen and who is not", and I can understand this rationale to some extent, but even then I wonder whether this has to be correct. Perhaps we could have a global society without any requirement to be an identifiable citizen per se. Things such as mandatory age verification-sniffing to never become an issue, because it is not needed and not possible and nobody would have an addiction-need to sniff for that data (we know Meta and co want that data, this is why their lobbyists run rampage via the "but but but somebody protect the children" lie).
• Ales375 6mo ago
  GDPR has solid fines for data breaches, but this doesn't work for government agencies. Just someone else's money going from one government pocket to another. What they need is an automatic firing of the head of the government agency that suffered a breach. No question asked.
  • a34729t 6mo ago
    I'd go for mandatory caning, on CSPAN
  • deleted 6mo ago
    [deleted]
  • selfhoster1312 6mo ago
    It's not just one head though. It's 3 different right-wing administrations (Sarkozy, Hollande, Macron) wanting to make everything digital, fighting against the unions, fighting against the users, and fighting against any common-sense administrator so they can destroy public services, close down local government service branches (La Poste, sécurité sociale, etc). It was always an entire fuck up. There was no way it was anything else than an entire fuck up. The "highest level of security" (ANTS) leak is just the cherry on the top. Time to get the guillotine out of the garage i guess?
    • zorobo 6mo ago
      > It's 3 different right-wing administrations (Sarkozy, Hollande, Macron) So now socialists are right wing? Who isn’t then? Kim Jong Un maybe?
      • deleted 6mo ago
        [deleted]
      • selfhoster1312 6mo ago
        It's hard to say otherwise. They were moderate left in the 80s when they were doing nationalizations and pro-worker reforms. They've embraced free market in the 90s which is arguably not very left-wing. Leaving aside same-sex marriage for a minute, Hollande's rule was well-known for social regressions for workers (Loi travail) and minorities (Déchéance de nationalité, taking 7 year-old children into police custody for thought crimes), and handouts for wealthy elites (CICE). That, and systematically continuing to destroy public services that Sarkozy already harmed. That can hardly be called left-wing in my book... unless you'd like to name left-wing policies introduced under Hollande?
• concinds 6mo ago
  Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive. The way to fix it is to empower one government agency to do aggressive pentesting against every other agency, hospitals, banks, infrastructure, and big corporations, with salaries matching the private sector. Impose a legally-enforced deadline to fix any issues, with a fine (for private actors) or demotion of the guy in charge of infosec (for state agencies). Forget compliance checklists, KPMG "audits" and all that crap, just have government-sponsored hackers trying to get into everything like an attacker would. France seems to have had a ton of government hacks in the past year at various levels, so it's sorely needed.
  • mcmcmc 6mo ago
    > Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive. This is the same as the rogue police problem in the US. What needs to happen is a shift to personal liability for those responsible.
    • signatoremo 6mo ago
      Personal liability? Are you also against no blame culture that is prevalent in the tech world?
      • arkh 6mo ago
        Someone(s), somewhere, is paid "big bucks" to be in charge. That's the person we should charge. If they cannot be charged for this kind of fuck-ups, then they should not be paid anything for simply rubber-stamping anything going over their desk. A simple machine could do their job.
      • mcmcmc 6mo ago
        If it’s related to compliance? Yeah I think that’s a pretty dangerous culture to have. Compliance requirements need owners who will ensure standards are met. If they don’t do their jobs, then they should face the consequences for the harm they allow.
  • deleted 6mo ago
• xp84 6mo ago
  Hey now, don’t forget the offer of “free credit monitoring for a year” - I feel like at this point I’ve gotten so many of those that if I signed up for them all, I’d have my personal info in twice as many probably-hackable locations as I do already.
• paulddraper 6mo ago
  > if the only penalty the company/agency gets What is the penalty for the government?
  • ornornor 6mo ago
    Elon Musk
• dawnerd 6mo ago
  The problem though is when its from a gov agency it validates previous breach data making it more valuable.
  • dylan604 6mo ago
    Depends. According to DOGE, voter registration databases have people listed as 150 years old or deceased people receiving monthly government checks. Obviously a different govt than TFA, but govt databases are no less prone to inaccurate data. They are still run/managed by humans regardless of the govt in question
    • dawnerd 6mo ago
      That DOGE info was a very small portion of the data and considering who it came from you have to take even that with a grain of salt. There's always going to be inaccuracies in any dataset, no avoiding that.
• rectang 6mo ago
  Seeing another one of these breaches had me returning to look at local-first software. https://lofi.so https://lofi.so I feel like if we're going to make progress in preventing wholesale data breaches it will be through architectural innovations that attack the problem of why a trove of concentrated data needs to exist. Even if the government needs to be a central authority, are there ways to house the data that limit the blast radius? I'm sure there are innumerable arguments why this can't help, but when the mainstream alternative is despair and helplessness, progress will be made in the margins.
• nout 6mo ago
  Or maybe the government should not require companies to KYC you for every little stupid thing or action you do in this world. What happened to requiring only the information that's actually required? Why do I need to be KYCd in the systems when buying banana, ordering delivery, etc. Because of the inevitable breaches and leaks - KYC is the illicit activity. The selling point of KYC was preventing fraud and money laundering. It doesn't actually do that. Search for "largest money laundering settlements" and you will find 5 banks and one crypto scam.
  • MattDaEskimo 6mo ago
    Might be cheaper & safer to buy an identity than use my own.
  • michaelje 6mo ago
    The overreach on access and then storage will be a meaningful issue we will have to reckon with more and more. Companies are acquired, companies die. What happens to your data in 5, 15, 50 years? It doesn’t just disappear. From a few months back: https://mjeggleton.com/blog/your-data-never-dies https://mjeggleton.com/blog/your-data-never-dies
  • traceroute66 6mo ago
    > Or maybe the government should not require companies to KYC you for every little stupid thing Actually.... Say what you like about the French today, but one good thing they have is an electronic service[1] where you can generate single-use KYC ID: - That only discloses minimum information required - For a specific recipient organisation - For a specific duration - For a specific use-case by that organisation More countries should provide this sort of KYC tool. [1]https://france-identite.gouv.fr/usages/le-justificatif-d-identite-a-usage-unique/ https://france-identite.gouv.fr/usages/le-justificatif-d-ide...
    • progval 6mo ago
      It looked great and I wanted to try it, but it doesn't work on the web and my smartphone is rejected with no clear explanation ("missing some security mechanisms"); probably because I'm running LineageOS with MicroG.
• isodev 6mo ago
  With everyone doing online “identity” verifications, all these details and more are already available to data brokers. Persona.. I mean Palantir even has a short video of you from your “liveness check” to go with the scan of your ID.
  • deleted 6mo ago
    [deleted]
• reaperducer 6mo ago
  These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry and that it won’t happen again". So, you want the French government to fine the French government so the French government uses French taxpayer money to pay the French government for the French government's mistake?
  • raron 6mo ago
    You could just jail the CEO or who was responsible for the security at that agency / company.
• SAI_Peregrinus 6mo ago
  And 12 months of credit monitoring to go with the 2346823 months of credit monitoring they already have.
• seydor 6mo ago
  Yeah we are all walking with online targets in our real life. Technology has failed us spectacularly