Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity Incident Involving Consumer Information

investor.equifax.com

Post reply on HN
Print view View original

31–40 of 551 posts

Re: Cybersecurity Incident Involving Consumer Information

#31

Post by maxerickson »

xur17 wrote: post #10
shubb wrote: post #4

Earlier quoted context omitted.

It sounds like ssn is not fit for purpose. If the gov is going to issue a 'secret number ' why not a 2fa device?

I really wish they would issue something like this. Or put a smartcard in my driver's license (I'm sure there are privacy implications to this though).

Even the level of standardization proposed for Real ID was met with enormous push back.

The long term solution is to figure out how to make financial companies feel the pain of fraudulent accounts. Like maybe when they open an account without doing a sufficient level of verification they should have to pay the victim of the fraud $5000 (in addition to covering any damages they cause).

Re: Cybersecurity Incident Involving Consumer Information

#32

Post by KekDemaga »

ceejayoz wrote: post #12

> Equifax has established a dedicated website, www.equifaxsecurity2017.com, to help consumers determine if their information has been potentially impacted and to sign up for credit file monitoring and identity theft protection. Really? "We lost your info. Sign up for our credit monitoring service!"

"We lost 100 million plus social security numbers, give us your social security number so we can keep you safe"

Re: Cybersecurity Incident Involving Consumer Information

#33

Post by toomuchtodo »

cdubzzz wrote: post #14
courtewing wrote: post #6

I strongly encourage anyone in the US to put a full credit security freeze on all three credit agencies. When a credit freeze is in place, you still have access to all of your existing loan accounts and whatnot (e.g. credit cards), but lenders cannot access your credit to open new accounts unless you want them to. It's not difficult nor expensive to do, and the freeze lasts until you decide to revoke it. Whenever you…

I recently did this and highly recommend IdentityTheft.gov for assistance. It has tons of great resources/guidance for dealing with identity theft and other credit issues. https://www.identitytheft.gov/

This will make a great addition to the /r/personalfinance wiki! Thanks for posting it!

Re: Cybersecurity Incident Involving Consumer Information

#34

Post by andirk »

Oddly, on their website equifax.com , they offer a solution to see if your identity is stolen by using a website created today called equifaxsecurity2017.com , which then offers the solution to 'enroll' which sends you to a website created a week ago called trustedidpremier.com . At which point you are to enter your identity information.

Um.

Re: Cybersecurity Incident Involving Consumer Information

#35

Post by maxerickson »

knowuh wrote: post #30

> Credit reporting agencies are one of the greatest/worst rackets in the modern financial system Can someone notify me when the class action has been initiated?

If you want to win big, initiate it. Members of the class are likely to get something stupid like free credit monitoring from Equifax.

Re: Cybersecurity Incident Involving Consumer Information

#36

Post by alehul »

shubb wrote: post #4
provost wrote: post #2

> approximately 143 million U.S. consumers. This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US social security number when significant exposure happens (this would be the 4th or 5th time in 24 months my data has been exposed). Assuming legislation passed that allowed you to cancel an exposed SSN and get a new one, what would it take for that to happen?…

It sounds like ssn is not fit for purpose. If the gov is going to issue a 'secret number ' why not a 2fa device?

The SSN was never intended as a national ID.

It was originally created alongside the Social Security Administration, to track what individuals put in and what they take out. People only received one upon becoming employed.

Over time, the IRS realized that it could be used as a national ID, and adopted it for that purpose. They encouraged people to obtain one from a young age (even for their newborn children), and it was used to replace the original 'honor system' of 'How many children do you have?' tax discounts; now they'd need to register their child with a SSN.

Companies eventually began piggybacking on the number as a national identifier (due to our lack of one), and voila. We're left with an awfully insecure identification system that shouldn't be an identification system for much in the first place.

For anyone interested in more: https://www.youtube.com/watch?v=Erp8IAUouus, and the sources below the video.

Re: Cybersecurity Incident Involving Consumer Information

#37

Post by scarmig »

TravelTechGuy wrote: post #25
courtewing wrote: post #11

Earlier quoted context omitted.

You have to place the freeze on each of the three credit agencies individually. In most states it's $10 each, but it can vary state to state. https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo... https://www.transunion.com/credit-freeze/place-credit-freeze https://www.experian.com/freeze/center.html

I think you are missing something. Here's what's needed to initiate your TransUnion freeze: To set up a security freeze with TransUnion, please visit our online form. You should be prepared with the following types of information: 1. Your full name, including middle initial and suffix, such as Jr., Sr. II, III 2. Social Security Number 3. Date of birth 4. Current address 5. All addresses where you have lived during t…

Equifax can handle its internal management and operations however it wants.

Externally, though, I want Equifax to have to pay a fine for every individual whose information was compromised. Identity theft can easily cause five figures worth of damage, so $10k per individual would be fair. Maybe as a warning shot we could lower this to... $1k? $100?

That's the only way to properly align incentives so companies will proactively defend against attacks like this.

Re: Cybersecurity Incident Involving Consumer Information

#39

Post by deadmetheny »

TravelTechGuy wrote: post #25
courtewing wrote: post #11

Earlier quoted context omitted.

You have to place the freeze on each of the three credit agencies individually. In most states it's $10 each, but it can vary state to state. https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo... https://www.transunion.com/credit-freeze/place-credit-freeze https://www.experian.com/freeze/center.html

I think you are missing something. Here's what's needed to initiate your TransUnion freeze: To set up a security freeze with TransUnion, please visit our online form. You should be prepared with the following types of information: 1. Your full name, including middle initial and suffix, such as Jr., Sr. II, III 2. Social Security Number 3. Date of birth 4. Current address 5. All addresses where you have lived during t…

>Preferably with their jobs

That's not nearly enough, considering the reach and impact this could potentially have. These people need to be getting life prison sentences before security is finally taken seriously enough by executives.

Re: Cybersecurity Incident Involving Consumer Information

#40

Post by pgrote »

Time for criminal penalties for the management team.

A breach like this will affect thousands of people monetarily and suck time from them they could have used elsewhere. If you've ever dealt with something like this, you know the hours it takes to rectify the damage.

The only way corporations will learn to appreciate data security is when management teams suffer criminal penalties.

Post reply on HN