Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity Incident Involving Consumer Information

investor.equifax.com

Post reply on HN
Print view View original

271–280 of 551 posts

Re: Cybersecurity Incident Involving Consumer Information

#271

Post by Thriptic »

nkcmr wrote: post #155
courtewing wrote: post #6

I strongly encourage anyone in the US to put a full credit security freeze on all three credit agencies. When a credit freeze is in place, you still have access to all of your existing loan accounts and whatnot (e.g. credit cards), but lenders cannot access your credit to open new accounts unless you want them to. It's not difficult nor expensive to do, and the freeze lasts until you decide to revoke it. Whenever you…

Wow. Equifax's Credit Freeze line is just dead. Must be getting slammed right now.

Their signup process for the credit freeze involves entering your SSN which is not obscured at all. It's increasingly obvious how this could have happened -_-

Re: Cybersecurity Incident Involving Consumer Information

#272

Post by scarmig »

hysan wrote: post #206
scarmig wrote: post #37

Earlier quoted context omitted.

Equifax can handle its internal management and operations however it wants. Externally, though, I want Equifax to have to pay a fine for every individual whose information was compromised. Identity theft can easily cause five figures worth of damage, so $10k per individual would be fair. Maybe as a warning shot we could lower this to... $1k? $100? That's the only way to properly align incentives so companies will pro…

$1k, $100, that's far too low in my opinion even for a warning shot. As someone who has had their info leaked by two universities before, both of whom subsequently paid for multiple years of credit/fraud protection, the sheer pain and stress of having random credit cards frozen and need to be replaced is worth far more than that dollar amount of my time. This is potentially messing with people's livelihoods with long…

$100 per each individual would be 14 billion dollars... Which would definitely put Equifax out of business.

Re: Cybersecurity Incident Involving Consumer Information

#273

Post by roywiggins »

cespare wrote: post #116
mcshicks wrote: post #101

Earlier quoted context omitted.

You get a unique long pin code when you freeze the account. You need that to unfreeze it. There is some "recovery" procedure, I think you need a notary or something

And that unique long pin definitely isn't stored in plaintext in the next column over in their database, right?

At least it's only in one database, and not all of them, like SSNs are...

Re: Cybersecurity Incident Involving Consumer Information

#274

Post by ceejayoz »

andirk wrote: post #23
provost wrote: post #2

> approximately 143 million U.S. consumers. This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US social security number when significant exposure happens (this would be the 4th or 5th time in 24 months my data has been exposed). Assuming legislation passed that allowed you to cancel an exposed SSN and get a new one, what would it take for that to happen?…

I believe you CAN change your SSN https://faq.ssa.gov/link/portal/34011/34019/article/3789/can... . Especially if you have "cultural objections to certain numbers".

You can, but in very specific cases. The "cultural objections" bit requires documentation from a legitimate religious organization - you can't just say 123-45-6789 is the mark of Satan.

Re: Cybersecurity Incident Involving Consumer Information

#275

Post by xur17 »

maxerickson wrote: post #35
knowuh wrote: post #30

> Credit reporting agencies are one of the greatest/worst rackets in the modern financial system Can someone notify me when the class action has been initiated?

If you want to win big, initiate it. Members of the class are likely to get something stupid like free credit monitoring from Equifax.

How would one initiate this? Contact a lawyer?

Re: Cybersecurity Incident Involving Consumer Information

#277

Post by dionidium »

comex wrote: post #120
arikr wrote: post #107

Hm, I tried using their tool to see if I've been impacted: https://www.equifaxsecurity2017.com/potential-impact/ Which says it would tell me if I'm likely impacted, but instead it just gives a date where I can enroll in some free product, but no info on whether I'm likely compromised. Anyone have a workaround? This is important to anyone that wants to identify if they've been "pwned."

I got the same page, but then I tried putting in a fake name and got: > Thank You > Based on the information provided, we believe that your personal information was not impacted by this incident. So if you just get the enrollment date, I think that means you’re affected.

I don't think so:

"Regardless of whether your information may have been impacted, we will provide you the option to enroll in TrustedID Premier. You will receive an enrollment date."

Re: Cybersecurity Incident Involving Consumer Information

#278

Post by pow_pp_-1_v »

mattmanser wrote: post #259
matthewmacleod wrote: post #243

Earlier quoted context omitted.

You just put the money in an account, pay the capital off every month, lose a little bit of interest and in 2 years you have a shiny credit rating even though it means zilch. I don’t really get that - doesn’t it mean that the person who took a loan is relatively responsible and was able to pay their loan back on time? Any system can be gamed, but I don’t get the impression that credit agencies are attempting to elimi…

For £100 you get a shiny credit rating for no risk. That'll get you a mortgage for £100,000s. In the 60s/70s it was about knowing your bank manager, so he knew you'd be able to pay. I appreciate that it probably benefited a certain type of person, but the new system probably has the same prejudices built in. Now it's all about the ephemeral and easily game-able credit score. Until a few years ago you would get negati…

> In the 60s/70s it was about knowing your bank manager, so he knew you'd be able to pay.

You do recognize how terribly inefficient that is, right? In this day and age its all about scale. Expecting a bank manger to have financial profile of all the clients using his firm is impractical.

For all it's faults, the credit reporting agencies are providing a service. It's not perfect and I think it's best they could do with the information available to them. I expect they will improve their score though once they start incorporating signals from social media and other sources.

Re: Cybersecurity Incident Involving Consumer Information

#279

Post by yborg »

felippee wrote: post #223
guelo wrote: post #202

By enrolling in the free "Identity Theft Protection" you waive your right to "PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR OTHER REPRESENTATIVE ACTION" https://trustedidpremier.com/static/terms What a scam!

How can they prove it was me who waived that right if the data used to identify me was breached by them and potentially publicly available? The snake is eating it's own tail here...

Great point.

In my case, after entering the information on the "Potential Impact" page, it immediately informed me I was enrolled without actually informing me whether or not I was impacted! It basically looks like Equifax used their massive fuckup to generate business for a service they own that by its nature incentivizes them to have poor security to encourage people to stay subscribed!

Given the number of incidents that have at this point affected nearly every person in at least the US, what value does the data held by the big 3 have? Almost anyone can claim that any information held by Equifax now was the result of fraud.

And how does Equifax prove that data wasn't modified in their systems by an intruder?

Re: Cybersecurity Incident Involving Consumer Information

#280

Post by quuquuquu »

ge96 wrote: post #84

>The company said that it discovered the intrusion on July 29 Why is this posted now?

Those consultants and experts need a month of pay to be called in to "brainstorm a response", of course :)

And the response is great. "Please give us your SSN and last name, so that we can check to see if we exposed your info to being stolen ^.^

BRB TIME TO SELL ALL MY STOCK

THANK U FOR UR PATRONAGE LOL ^.^"

Post reply on HN