Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity Incident Involving Consumer Information

investor.equifax.com

Post reply on HN
Print view View original

41–50 of 551 posts

Re: Cybersecurity Incident Involving Consumer Information

#41

Post by cdubzzz »

toomuchtodo wrote: post #33
cdubzzz wrote: post #14

Earlier quoted context omitted.

I recently did this and highly recommend IdentityTheft.gov for assistance. It has tons of great resources/guidance for dealing with identity theft and other credit issues. https://www.identitytheft.gov/

This will make a great addition to the /r/personalfinance wiki! Thanks for posting it!

Happy to help! I was really surprised how well the site works. A bit more about my experience here in case it could also be useful (though the post is admittedly a bit scatter brained): https://chrxs.net/articles/2017/03/23/responding-to-identity...

Re: Cybersecurity Incident Involving Consumer Information

#42

Post by dragonwriter »

shubb wrote: post #4
provost wrote: post #2

> approximately 143 million U.S. consumers. This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US social security number when significant exposure happens (this would be the 4th or 5th time in 24 months my data has been exposed). Assuming legislation passed that allowed you to cancel an exposed SSN and get a new one, what would it take for that to happen?…

It sounds like ssn is not fit for purpose. If the gov is going to issue a 'secret number ' why not a 2fa device?

The SSN is not issued by government as a secret number, but a necessarily-shared number between you, government agencies, employers, financial institutions, and many other parties.

The error is that many of the parties with which it must be shared treat it (for authentication purposes) as if it were a shared secret between that party and you (though they often don't do so for security purposes—and, as they often must share it with certain third parties, sometimes cannot do so) even though it is known to be a widely-shared non-secret.

Re: Cybersecurity Incident Involving Consumer Information

#43

Post by wavefunction »

g051051 wrote: post #20
cjhanks wrote: post #9

Is anyone being punished for all of the massive security breaches which appear to be happening on a nearly daily basis?

Well, they try to find and convict the hackers, of course. Or did you mean the companies like Equifax, or Target, or Home Depot that are the victims of the break-ins?

They may have meant the actual victims, in this case 146,000,00 Americans.

Re: Cybersecurity Incident Involving Consumer Information

#44

Post by toomuchtodo »

scarmig wrote: post #37
TravelTechGuy wrote: post #25

Earlier quoted context omitted.

I think you are missing something. Here's what's needed to initiate your TransUnion freeze: To set up a security freeze with TransUnion, please visit our online form. You should be prepared with the following types of information: 1. Your full name, including middle initial and suffix, such as Jr., Sr. II, III 2. Social Security Number 3. Date of birth 4. Current address 5. All addresses where you have lived during t…

Equifax can handle its internal management and operations however it wants. Externally, though, I want Equifax to have to pay a fine for every individual whose information was compromised. Identity theft can easily cause five figures worth of damage, so $10k per individual would be fair. Maybe as a warning shot we could lower this to... $1k? $100? That's the only way to properly align incentives so companies will pro…

I would not doubt a class action lawsuit results from this, and I'd be very surprised if Elizabeth Warren didn't pursue congressional action against them (although not officers of the company unfortunately).

Re: Cybersecurity Incident Involving Consumer Information

#45

Post by Thriptic »

andirk wrote: post #34

Oddly, on their website equifax.com , they offer a solution to see if your identity is stolen by using a website created today called equifaxsecurity2017.com , which then offers the solution to 'enroll' which sends you to a website created a week ago called trustedidpremier.com . At which point you are to enter your identity information. Um.

Unverified cert too -_-

Re: Cybersecurity Incident Involving Consumer Information

#46

Post by TravelTechGuy »

deadmetheny wrote: post #39
TravelTechGuy wrote: post #25

Earlier quoted context omitted.

I think you are missing something. Here's what's needed to initiate your TransUnion freeze: To set up a security freeze with TransUnion, please visit our online form. You should be prepared with the following types of information: 1. Your full name, including middle initial and suffix, such as Jr., Sr. II, III 2. Social Security Number 3. Date of birth 4. Current address 5. All addresses where you have lived during t…

>Preferably with their jobs That's not nearly enough, considering the reach and impact this could potentially have. These people need to be getting life prison sentences before security is finally taken seriously enough by executives.

It's high time we had an equivalent law to Sarbanes-Oxley for security.

S-O made sure that when a C-level type guy signs a report, he knows his ass is on the line in case an illegal transaction just occur under his nose. If your company deals with PII, I want that data to be treated as important, if not more important, then company's funds. If you lose it, and you had any say in security (or lack thereof), you should do time.

Re: Cybersecurity Incident Involving Consumer Information

#47

Post by g051051 »

cjhanks wrote: post #29
g051051 wrote: post #20

Earlier quoted context omitted.

Well, they try to find and convict the hackers, of course. Or did you mean the companies like Equifax, or Target, or Home Depot that are the victims of the break-ins?

I mean the companies like Equifax. Is there nothing illegal about being careless enough to leak this much important information to hackers? I personally think they should be held accountable.

Accountable for what? That they're a target for hackers, who managed to break into their network? How is that careless? There's no such thing as perfect security.

Re: Cybersecurity Incident Involving Consumer Information

#48

Post by rocqua »

shubb wrote: post #4
provost wrote: post #2

> approximately 143 million U.S. consumers. This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US social security number when significant exposure happens (this would be the 4th or 5th time in 24 months my data has been exposed). Assuming legislation passed that allowed you to cancel an exposed SSN and get a new one, what would it take for that to happen?…

It sounds like ssn is not fit for purpose. If the gov is going to issue a 'secret number ' why not a 2fa device?

SSNs were expressly intended not to be used as identification or authentication. Thing is, there was not alternative that people were guaranteed to have. I get it on principle, we don't like government giving us tracking numbers. It just seems totally impractical not to have this though.

Re: Cybersecurity Incident Involving Consumer Information

#49

Post by tombrossman »

ceejayoz wrote: post #12

> Equifax has established a dedicated website, www.equifaxsecurity2017.com, to help consumers determine if their information has been potentially impacted and to sign up for credit file monitoring and identity theft protection. Really? "We lost your info. Sign up for our credit monitoring service!"

I note that equifaxsecurity2018.com is already registered, but equifaxsecurity2019.com is available.

Re: Cybersecurity Incident Involving Consumer Information

#50

Post by jack8daniels2 »

andirk wrote: post #34

Oddly, on their website equifax.com , they offer a solution to see if your identity is stolen by using a website created today called equifaxsecurity2017.com , which then offers the solution to 'enroll' which sends you to a website created a week ago called trustedidpremier.com . At which point you are to enter your identity information. Um.

And trustedidpremier.com was registered a week ago. https://whois.domaintools.com/trustedidpremier.com
Post reply on HN