Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity Incident Involving Consumer Information

investor.equifax.com

Post reply on HN
Print view View original

421–430 of 551 posts

Re: Cybersecurity Incident Involving Consumer Information

#421

Post by ztjio »

Waterluvian wrote: post #133

The whole concept of these credit agencies infuriates me. I didn't sign up for it. You have a dossier on me that I have no part of. If you F it up, you'd better bend over backwards to make sure it doesn't affect me.

This simply isn't true. The only way these agencies get your SSN associated with your personal info is by your agreement with a bank or similar organization to do so. It always happens with your express approval, even if you are not savvy enough to pay attention to what you're approving.

Re: Cybersecurity Incident Involving Consumer Information

#422

Post by sowbug »

jdironman wrote: post #328
zAy0LfpBZLC8mAC wrote: post #307

Earlier quoted context omitted.

> I see this as you being too strict with your definition of "identity". > We, as people, have multiple identities. We have one with our government, another with our employer, another with our friends, another on pseudonymous websites, etc. Which is not relevant here, as this is not about different sets of attributes pointing to the same body, but about the exact same set of attributes being claimed to only possibly…

So the only way around this is to disregard information about a person other than information that 100% without a doubt identifies that person making a purchase is who they say they are? I am just genuinely curious.

No. It's to accept liability when you make a mistake. If a criminal tricks a bank into giving away money and debiting some random account, the victim is the bank, not whoever happened to own the account.

Re: Cybersecurity Incident Involving Consumer Information

#424

Post by skylark »

mediocrejoker wrote: post #405
courtewing wrote: post #6

I strongly encourage anyone in the US to put a full credit security freeze on all three credit agencies. When a credit freeze is in place, you still have access to all of your existing loan accounts and whatnot (e.g. credit cards), but lenders cannot access your credit to open new accounts unless you want them to. It's not difficult nor expensive to do, and the freeze lasts until you decide to revoke it. Whenever you…

What stops the would-be identity thief from removing the freeze before opening a fraudulent account?

A credit freeze gives you a PIN that they'll ask for before the freeze can be lifted.

Re: Cybersecurity Incident Involving Consumer Information

#425

Post by aptwebapps »

abawany wrote: post #106
scarmig wrote: post #55

Earlier quoted context omitted.

And then I'll get six months of free credit monitoring from Equifax? Oh boy!!1! More seriously, this is a breach big enough that Equifax should honestly no longer exist as a company. So call it $100/incident, and I'm happy. Other agencies would still exist, and, although they're just as terrible, it might get them to kick their asses into high gear to fix their security.

The NYT story states that they are already offering this to affected consumers: https://www.equifaxsecurity2017.com/potential-impact/ .

Did that https work for you? For me it redirects to plain http and then OpenDNS blocks it as a phishing site. Why are they using such a scammy looking domain, anyway? Why not just host it on their main site?

Edit: I'm abroad and just tried through a VPN and it worked. Don't know why I tried without it ...

Re: Cybersecurity Incident Involving Consumer Information

#426

Post by hedora »

Ok everyone: Someone here has enough free time to do this, and then buy an island with the proceeds.

Set up a web page that will automatically opt out of the settlement and file a small claims court suit against them seeking $1K in damages. $1K is lower than actual damage done (in wasted time) for most people. It is also lower than the cost of defending against the suit in court.

~143 million people were impacted, so that's ~ $143B in liability. Their market cap is $17B. Problem solved.

Even better, most victims never consented to doing business with them, so there cannot be any binding arbitration issues to get in the way.

Re: Cybersecurity Incident Involving Consumer Information

#427

Post by sowbug »

njarboe wrote: post #237
jameshart wrote: post #181

Earlier quoted context omitted.

What Alice is the victim of is slander , not fraud or identity theft. The bank lent some money to someone who claimed to be Alice (though the bank only relied on the fact that that person knew Alice's SSN as proof of that fact). Then when the bank didn't get paid back, they told a bunch of credit check bureaus that Alice was a credit risk. This was a lie about Alice, which has a material impact on Alice's reputation.…

This is a great description of what is going on with "identity theft". I don't usually like changing the name of something to try to push an agenda, but calling "identity theft" "bank slander" would be good idea.

You mean slander by banks, not slander of banks. The term you propose is ambiguous.

Re: Cybersecurity Incident Involving Consumer Information

#428

Post by sowbug »

mcbits wrote: post #408
jameshart wrote: post #181

Earlier quoted context omitted.

What Alice is the victim of is slander , not fraud or identity theft. The bank lent some money to someone who claimed to be Alice (though the bank only relied on the fact that that person knew Alice's SSN as proof of that fact). Then when the bank didn't get paid back, they told a bunch of credit check bureaus that Alice was a credit risk. This was a lie about Alice, which has a material impact on Alice's reputation.…

Hmm, I guess you could call it slander if the person and the dossier were perfectly interchangeable. But all the institutions know is that someone has been failing to pay back loans that were issued based on the information in a dossier. After a series of fraudulent loans to "Alice Doe, SSN 123-45-6789" (the file, not the person), when some random shows up at Yet Another State Bank and tries to take out a loan under…

That distinction holds up only if real Alice isn't inconvenienced in any way.

Re: Cybersecurity Incident Involving Consumer Information

#430

Post by jaycroft »

How does it take 16 days to go from buying this domain to getting to public disclosure?

https://www.equifaxsecurity2017.com/

whois: ... Domain Name: equifaxsecurity2017.com Registry Domain ID: 2156034374_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.markmonitor.com Registrar URL: http://www.markmonitor.com Updated Date: 2017-08-25T08:08:31-0700 Creation Date: 2017-08-22T15:07:28-0700 ...

Post reply on HN