Live data from Hacker News

Equifax Faces Multibillion-Dollar Lawsuit Over Hack

bloomberg.com

371–380 of 670 posts

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#371
post #194

Earlier quoted context omitted.

To be fair, class action suits aren't really about recovering damages for the class members. Or at least, not entirely. That was exactly what they were supposed to be about. The way it usually works out, however, is that the lawyers don't really negotiate on the same side of the table as the class and the class members end up with very little. The lawyers, however, get their fees. That's why everybody gets pissed abo…

>That was exactly what they were supposed to be about. No, they really aren't, because as the parent says class actions are appropriate where the harm to each individual class member is small, but the small harm is spread out to many people. You as an individual were not harmed much, so you as an individual would not collect much even if you went it alone and recovered 100%. Litigation doesn't (generally) yield more…

>pursue your own individual case with the lawyer(s) of your choosing

Fewer people than most realize are actually able to do this. Good lawyers don't generally take contingency cases, and if the case is even remotely involved, fees quickly reach to six figures.

Perhaps worse is the stress. Once initiated, you have virtually no control over the process, and it can take over your life. The motions and counter-motions, delays and hearings will wear you down. If the adversary is much better-funded, then they can make it nearly unbearable.

The legal system is not what most people imagine, especially those who flippantly threaten to sue. You have to go through an action (or be close to someone who is) to really get that. Engaging is stressful and costly and, unless you're a combative type with deep pockets who just loves to fight, you'll likely feel like you lost, no matter the outcome.

This, as much as anything, is why class actions are so prevalent.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#372
post #260

So let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of the adult american population. Then the executives sold their stock a day before they announced the hack to the public. Besides the troubling fact that you still use social security and credit card numbers as any form of reliable authentication, how aren't th…

No amount of governmental regulations can solve the current date breach trends. Even government's own intel agencies got hacked too. No organization is immune to data breaches. It's a matter of time and effort. A lot of us here are engineers and coders. It's our responsibility to design better architecture, security conscious protocols and write securer softwares. And it's up to all of us (regardless which country yo…

You can't stop breaches, but there are minimum things you can do that help.

1. Collect the minimum amount of information you actually need

2. Hash and salt the data you store

3. Tell the people the truth about what happened to their data within a reasonable time

These are all things that can potentially be enforced.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#374

Earlier quoted context omitted.

Why would people need new SSNs? It was the credit industry that misused them as combination of unique identifier and authenticator, and that is not the SSA's responsibility to fix. The government even tried to curb misuse of the SSN, but it was not binding on private entities, and they just ignored it. The solution, whatever it is, does not include anyone continuing to pretend that the SSN is now or has ever been sui…

> other than for tracking government benefits managed by the SSA, and possibly also for tax filings with the IRS ... and all of the other government benefits, programs, or mandated activities, many (all?) of which demand your SSN. Are you even sure that the credit industry, i.e. banks, originally misused SSNs? I wouldn't be surprised if they were required , by the government, to use them, precisely because it is the…

> I wouldn't be surprised if they were required, by the government, to use them, precisely because it is the closest thing to an official "unique identifier".

I read something somewhere else (maybe on a different HN thread, maybe here?) that this was changed in 2000 for something called "red flag laws", IIRC.

So yeah - it is required.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#375
post #160
post #30

It's a sign of how awful Equifax is that I find myself rooting for the lawfirms in this case. I really hope they win, and that they get the full $70 billion, and that it's enough to shutter Equifax permanently. What a win that would be! Also it would serve as a nice cautionary tale to companies that infosec matters. That insurance for data breaches matters. Because right now, it's too easy for them to not care. It's…

Yes, what a win it would be to simply transfer ownership of Equifax from one party to another in the event of bankruptcy. The business itself would continue and nothing would change.

If you wipe out the investors, they will start demanding security before investing in a company. And, if you wipe out the stock, you also wipe out big chunks of the compensation of the CEO, CFO, CTO, etc.

Until this starts hitting important people in the wallet, nothing will change.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#376
post #284

Earlier quoted context omitted.

It really isn't genius at all. At least in my state, either party can object to the small claims status by simply sending a letter. Then it moves over to normal court with normal lawyers. Already you are out the small claims filing fee (yes, you have to pay the court to even bring a small claims case). Once in normal court, you would need to hire a lawyer, and they would just find some local representation. At this p…

That is an incredibly pro-corporate anti-individual jurisdiction. Where is this?

I didn't think my state was that unique, so I did a bit of searching and found some interesting gotchas in a few different states:

Alabama: Must file in municipality where the other party (defendant) resides

Alaska: Easy to move to regular court

Arizona: Easy to move to regular court

Delaware: Cannot be used for punitive damages (basically this)

Indiana: Easy to move to regular court (If I am reading it right)

Michigan: Easy to move to regular court

New York: Must file in municipality where the other party (defendant) resides

Oregon: Basically must file in municipality where the other party (defendant) resides. Easy to move to regular court

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#377
post #278

Earlier quoted context omitted.

The non-negotiable choice between allowing them to and being denied service entirely.

It doesn't seem crazy to me that if you ask for someone to loan you money they only do it under the condition that you agree to participate in a system that helps them track your creditworthiness.

It does make sense for lenders to cartelize and force each other to report the creditworthiness-affecting information about their borrowers to one another.

It doesn't make much sense for borrowers, though. But since, by definition, the lenders have the money and the borrowers do not, the borrowers have no real ability to negotiate when lenders get together and do things like that.

But borrowers can vote just as much as lenders can, which is why such behavior is governed by law. So let's not pretend that borrowers somehow agreed to this system in any way. It was forced upon them, and the best they could do about it is pass laws to ensure that lenders at least had to be accurate when reporting, and had to respond reasonably to disputes. Since lenders can lobby and vote, too, borrowers were not able to mandate that the lenders would have much in the way of legal liability when they inevitably get lazy, screw up, and cause real damages to real people.

The law isn't fair; it's just the best compromise that adversarial parties with differing amounts of money, power, and motivation could reach a threshold level of agreement on. It just so happens that a savvy and motivated borrower can completely whitewash their own credit reports for the cost of a few stamps, and maybe some small claims suits, while an ignorant borrower, or one who lacks the time and energy to ride herd on the CRAs, can get completely screwed. It's a numbers game, and the lenders and CRAs can make more money from the latter category than they lose from the former.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#378
post #272

Earlier quoted context omitted.

Won't work. Once companies start gathering private data stored in this DB, it can be compromised and government isn't that great at securing data either. MFA would required everyone having a smart phone or RSA key fobs. SMS/Phone based authentication isn't secure. Only real way to get true identity system is biometrics(Fingerprints,DNA, or Iris) taken at birth. But that will never happen for privacy reasons.

Biometric has its own problems. What's a fingerprint but a password you can't change? Any secret can be stolen, bio or otherwise. The key to robust ongoing identity is not a better shared secret, it's a better way of recovering from theft of shared secrets. One way is to have a big trove of non-secret-but-not-public data, like prevous addresses and employers (which is how the credit bureaus sometimes authenticate peo…

What you explained is what global entry, tsa precheck, and nexus programs are.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#379
post #340

Ok, so credit reporting agency collects sensitive personal and financial data on basically every adult American, loses it to a bunch of criminals and now I have to deal with the consequences? I looked into credit freezes yesterday. This is really a total scam. You have to _call_ each of the three agencies and pay a fee ($5 to $10) each time. If you need to unfreeze your report to make a legitimate credit application…

Corporate charters can be dissolved by the government at any time. Given Equifax ONLY deals in building detailed profiles of every US adult and managed to lose that information to criminals is grounds for terminating their corporation.

At this point, their lack of basic security practices has endangered national security by weakening the banking and credit systems.

On top of that, this company is massively unpopular. Their only purpose is to potentially slander Americans en masse. Make a fucking example out of them so the rest of the finance industry takes notice.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#380
post #354

Earlier quoted context omitted.

hmm i called the 3 mentioned here today and all were free. https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq... Equifax — 1-800-349-9960 Experian — 1‑888‑397‑3742 TransUnion — 1-888-909-8872

What state do you live in? Credit freeze rules vary from state to state.

Is there a wiki page or government list that describes the rules for each state?
Post reply on HN