Cybersecurity Incident Involving Consumer Information • Hacker News Board

Re: Cybersecurity Incident Involving Consumer Information

#101

Post by mcshicks » Thu, Sep 07, 2017, 9:58 PM UTC

Y7ZCQtNo39 wrote: post #94

courtewing wrote: post #6

I strongly encourage anyone in the US to put a full credit security freeze on all three credit agencies. When a credit freeze is in place, you still have access to all of your existing loan accounts and whatnot (e.g. credit cards), but lenders cannot access your credit to open new accounts unless you want them to. It's not difficult nor expensive to do, and the freeze lasts until you decide to revoke it. Whenever you…

So if an identity thief has enough of my information to potentially open a new line of credit, wouldn't they also have enough information to reverse the freeze? In other words, is a freeze enough to stop new accounts from being created?

You get a unique long pin code when you freeze the account. You need that to unfreeze it. There is some "recovery" procedure, I think you need a notary or something

Re: Cybersecurity Incident Involving Consumer Information

#102

Post by 3JPLW » Thu, Sep 07, 2017, 9:58 PM UTC

andirk wrote: post #34

Oddly, on their website equifax.com , they offer a solution to see if your identity is stolen by using a website created today called equifaxsecurity2017.com , which then offers the solution to 'enroll' which sends you to a website created a week ago called trustedidpremier.com . At which point you are to enter your identity information. Um.

Why must the consumer enroll in this? Why is it not automatic? They already pull all the strings with regard to keeping the consumer from taking out and keeping track of legitimate loans. Why must we go out of our way to prevent them from certifying and tracking illegitimate ones?

Re: Cybersecurity Incident Involving Consumer Information

#103

Post by damnfine » Thu, Sep 07, 2017, 9:59 PM UTC

tombrossman wrote: post #77

scarmig wrote: post #37

Earlier quoted context omitted.

Equifax can handle its internal management and operations however it wants. Externally, though, I want Equifax to have to pay a fine for every individual whose information was compromised. Identity theft can easily cause five figures worth of damage, so $10k per individual would be fair. Maybe as a warning shot we could lower this to... $1k? $100? That's the only way to properly align incentives so companies will pro…

This thing called "Identity Theft" does cause damage, but it's important to remember that if fraudsters trick a bank into thinking they are you, it is the bank's fault for failing to properly verify it was actually you. Doing so would cost them more money and it is much easier to do cursory checks instead. No doubt fraudsters impersonating you is a hassle and you must spend some time and money dealing with it if you…

But you still pay the fees from the banks failings, so it really does hurt everyone even when the bank eats it.

Re: Cybersecurity Incident Involving Consumer Information

#104

Post by matthewcford » Thu, Sep 07, 2017, 10:00 PM UTC

Nice for Equifax that this happened before GDPR is enforced and they would have been fined 4 per cent of turnover.

Re: Cybersecurity Incident Involving Consumer Information

#105

Post by Simon_says » Thu, Sep 07, 2017, 10:00 PM UTC

hrehhf wrote: post #93

Suppose Alice is a "victim of identity theft". BigBank gives $10k to Fraudster as a loan, thinking that Alice is the actual recipient. Experian, Transunion and Equifax report this loan as a debt which Alice owes to BigBank. Who is the real victim? The credit reporting agencies want to convince people that the consumer is the victim, and so Alice bears the burden and risk of clearing her name. But it is the credit rep…

This is very clearly what's going on. Fraud is uncommon enough and the cost of fraud to the banks is smaller than the cost of reducing the velocity of money and loan-making, so the problem will never get fixed so long as it depends on the banks to initiate the fix.

Re: Cybersecurity Incident Involving Consumer Information

#106

Post by abawany » Thu, Sep 07, 2017, 10:01 PM UTC

scarmig wrote: post #55

toomuchtodo wrote: post #44

Earlier quoted context omitted.

I would not doubt a class action lawsuit results from this, and I'd be very surprised if Elizabeth Warren didn't pursue congressional action against them (although not officers of the company unfortunately).

And then I'll get six months of free credit monitoring from Equifax? Oh boy!!1! More seriously, this is a breach big enough that Equifax should honestly no longer exist as a company. So call it $100/incident, and I'm happy. Other agencies would still exist, and, although they're just as terrible, it might get them to kick their asses into high gear to fix their security.

The NYT story states that they are already offering this to affected consumers: https://www.equifaxsecurity2017.com/potential-impact/ .

Re: Cybersecurity Incident Involving Consumer Information

#107

Post by arikr » Thu, Sep 07, 2017, 10:01 PM UTC

Hm, I tried using their tool to see if I've been impacted:

https://www.equifaxsecurity2017.com/potential-impact/

Which says it would tell me if I'm likely impacted, but instead it just gives a date where I can enroll in some free product, but no info on whether I'm likely compromised.

Anyone have a workaround? This is important to anyone that wants to identify if they've been "pwned."

Re: Cybersecurity Incident Involving Consumer Information

#108

Post by Balgair » Thu, Sep 07, 2017, 10:01 PM UTC

tyingq wrote: post #3

provost wrote: post #2

> approximately 143 million U.S. consumers. This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US social security number when significant exposure happens (this would be the 4th or 5th time in 24 months my data has been exposed). Assuming legislation passed that allowed you to cancel an exposed SSN and get a new one, what would it take for that to happen?…

So half the US population? Ugh.

It's about 2/3rds of 'working' Americans.

Re: Cybersecurity Incident Involving Consumer Information

#109

Post by QUFB » Thu, Sep 07, 2017, 10:01 PM UTC

tombrossman wrote: post #49

ceejayoz wrote: post #12

> Equifax has established a dedicated website, www.equifaxsecurity2017.com, to help consumers determine if their information has been potentially impacted and to sign up for credit file monitoring and identity theft protection. Really? "We lost your info. Sign up for our credit monitoring service!"

I note that equifaxsecurity2018.com is already registered, but equifaxsecurity2019.com is available.

Not anymore.

Re: Cybersecurity Incident Involving Consumer Information

#110

Post by anigbrowl » Thu, Sep 07, 2017, 10:01 PM UTC

courtewing wrote: post #6

I strongly encourage anyone in the US to put a full credit security freeze on all three credit agencies. When a credit freeze is in place, you still have access to all of your existing loan accounts and whatnot (e.g. credit cards), but lenders cannot access your credit to open new accounts unless you want them to. It's not difficult nor expensive to do, and the freeze lasts until you decide to revoke it. Whenever you…

Why not just shift the presumption of liability (absent verification) to the financial institution instead of the consumer? Loan issuers can hire skilled professionals to do credit verification, so why should consumers bear the risk for their lack of due diligence?