Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax Faces Multibillion-Dollar Lawsuit Over Hack

bloomberg.com

Post reply on HN
Print view View original

331–340 of 670 posts

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#331

Post by cm2187 »

matthewmcg wrote: post #314
outoftacos wrote: post #301

Earlier quoted context omitted.

I am still unsure as to how any of the credit bureaus exist legally at all, I never consented to having all my eggs in those three vulnerable baskets. Why is this my problem all of a sudden? I get that consumer protections in the US are not very strong, but this just seems like a shady cartel in cahoots with the banks/insurance companies. Please tell me I'm grossly misunderstanding something here.

It's a historical fluke. Credit bureaus trace back to agencies that compiled third-party reports on the creditworthiness of business persons. So long as the information collected is accurate (and not defamatory), this type of activity is protected under the first amendment. See the first segment of this episode of the Backstory podcast for a retelling of how these early agencies worked: http://backstoryradio.org/show…

But then what happens if that information becomes inaccurate? (if your credit report shows credit events that aren't yours as a result of a fraud). Doesn't it become a form of defamation?

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#332

Post by danblick »

From a security standpoint, it seems like there's a problem treating everyone's social security number as if it's some kind of secret key.

Has there been any real discussion about alternatives to the present system? How else could authentication work for opening a bank account?

I imagine that the present system survives (1) because of inertia, and (2) because it doesn't require much infrastructure and so it's relatively cheap.

Maybe the next step is something like putting a chip into driver's licenses and ID cards nationwide?

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#333

Post by cm2187 »

Justsignedup wrote: post #279
sillysaurus3 wrote: post #271

How likely is it that Equifax will face any real trouble from this breach? Will this be one of the first cases where security negligence causes real harm to a company? Or will it turn out to be another slap on the wrist?

Slap on the wrist, guaranteed: - potentially every one of the 143M people are going to have some sort of trouble - WORST CASE equifax shuts down, but that doesn't matter. too late. - if everyone was to win a lawsuit for everything equifax is worth, they'd get maybe $100 minus lawyer fees. And worse, now we have a financial system dependent on 2 companies. Making a 3rd isn't an easy matter. ::shrug::

If the insider dealing allegations are founded, jail time.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#334

Post by ams6110 »

larrykwg wrote: post #245

So let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of the adult american population. Then the executives sold their stock a day before they announced the hack to the public. Besides the troubling fact that you still use social security and credit card numbers as any form of reliable authentication, how aren't th…

At least they aren't "too big to fail" since there are two other major credit bureaus doing basically the same thing they do.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#335

Post by desireco42 »

devy wrote: post #269
orf wrote: post #263

Earlier quoted context omitted.

Sure, in a fantasy land. If you where to hold the management criminally responsible for their lack of investment in IT, security etc you might see increased investment. The very fact that all this data was accessed from their public site is very troubling. What's the chances this is a basic SQL injection issue? What's the chances they didn't invest in security at all?

> If you where (sic) to hold the management criminally responsible for their lack of investment in IT, security etc you might see increased investment. What makes you think lack of investment in IT & security is the main reason they get hacked? Vice versa, NSA has virtually unlimited (let's just say unlimited means tens of billion dollars) budget invested in IT and security. They have the top resources there too. Do…

NSA has leaks, that is different, these guys were actually negligent with your and my data, probably underpaid their developers, didn't listen to them, didn't have proper security protocols etc, etc.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#337

Post by daveheq »

devy wrote: post #260
larrykwg wrote: post #245

So let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of the adult american population. Then the executives sold their stock a day before they announced the hack to the public. Besides the troubling fact that you still use social security and credit card numbers as any form of reliable authentication, how aren't th…

No amount of governmental regulations can solve the current date breach trends. Even government's own intel agencies got hacked too. No organization is immune to data breaches. It's a matter of time and effort. A lot of us here are engineers and coders. It's our responsibility to design better architecture, security conscious protocols and write securer softwares. And it's up to all of us (regardless which country yo…

Equifax had engineers and coders building their hackable site, at the direction of Equifax, within the scope of the law (unless we discover they broke security regulations). Having regulations with suitable punishments gives the company an incentive to build the site securely, and it would have been skin flecks off their back to do it, but their profit motive and lack of legal incentive meant they didn't care to.

If you're really so terrified of the government that you're against security regulations for the website of one of the largest credit card information collectors in America, then you deserved to be hacked too.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#338

Post by Zigurd »

aresant wrote: post #305
larrykwg wrote: post #245

So let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of the adult american population. Then the executives sold their stock a day before they announced the hack to the public. Besides the troubling fact that you still use social security and credit card numbers as any form of reliable authentication, how aren't th…

"Then the executives sold their stock a day before they announced the hack to the public." Selling stock the day before the news makes these guys seem like absolute criminals, but (a) it's not what happened and (b) the soundbyte doesn't represent what is likely the case. The reality: - Breach happened between March - July 2017 - Breach detected July 29th (A Saturday) - Executives sold stock August 1 (A Tuesday) - Bre…

Brazenness is already in evidence: Equifax's management thinks offering one measly year of credit monitoring, which will inevitably lead to huge sales of such a service, is an adequate response. What makes you think they are not at least as brazen about their stock positions in Equifax?

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#339

Post by madez »

eduren wrote: post #9

>In the complaint filed in Portland, Ore., federal court, users alleged Equifax was negligent in failing to protect consumer data, choosing to save money instead of spending on technical safeguards that could have stopped the attack. Doesn't "users" imply that we had a choice in the matter? As if we're Equifax's customers? I feel more like we're victims in this case.

This is why data protection laws are needed. Data about a person needs to belong to the person. This would prevent these large collections without consent.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#340

Post by cletus »

Ok, so credit reporting agency collects sensitive personal and financial data on basically every adult American, loses it to a bunch of criminals and now I have to deal with the consequences?

I looked into credit freezes yesterday. This is really a total scam. You have to _call_ each of the three agencies and pay a fee ($5 to $10) each time. If you need to unfreeze your report to make a legitimate credit application you have to call each of them twice (once to unfreeze and another to freeze) paying fees every time.

Now if you're a paying member (paying a minimum of $15/month to each agency) you can just lock and unlock your credit file on a mobile app (well, three mobile apps and I'm not sure all three support this). It's amazing how convenient things get once they're already extorting you for "credit protection".

This shouldn't even be legal.

Also, if a fraudster defrauds a financial institution with your personally identifiable details, it should be an issue between the agency and the financial institution as you were not a party to this loan. The reporting agency saying you were should be slander.

Financial institutions should be interested in consumers having an easy ability to lock their credit files as it would decrease the number of fraudulent credit applications.

So why can't I have a mobile app (or three) for free that allows me to easily lock and unlock my file or, better yet, to vet every inquiry and approve it or not?

Post reply on HN