Live data from Hacker News

No matter what, Equifax may tell you you’ve been impacted by the hack

techcrunch.com

101–110 of 157 posts

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#101
post #97
post #93

The reaction here seems pretty over the top to me. Leaking a bunch of private information is bad, I guess. As a former federal employee, my SSN/etc. were leaked in the OPM breach a couple of years ago. So far, it’s hard zero repercussions for me (or anybody else I know). There are many layers of defense mechanisms in place. It’s not like just having some numbers let’s you do whatever you want. The US banking system h…

> If I ever saw an unusual charge on my credit cards, I’d just get it refunded. How much actual harm is going to come out of this? My suspicion is not that much. Fraudulent charges on an existing account is not the concern when someone has your SSN and other high-value information - it's the ability for someone else to open an account in your name that you have no knowledge of.

Okay, so someone opens up a credit card in your name. They either use your address, and you notice because you get the correspondence, or they don't, and you have an easy way of disavowing any attempt at collection by showing the discrepancy in the address.

No doubt these layers of protection will fail for some people. Maybe Equifax should be required to set up a fund to pay out to such people. But it's not apocalyptic like people are making it out to be. OPM leaked the records of about 20 million people a few years ago. So far, there hasn't been any sort of mass-scale impact as a result of that breach.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#102

Here is a crazy alternate theory for you guys, which I think fits all the details we have so far. 1. Equifax was never hacked. 2. Equifax accidentally deleted a substantial portion of their database. 3. Come up with a system to get the information they lost back, via a "have I been pwned?" checker. 3a. If you enter your details and they are not in their database, they assume it is one of the persons they deleted, add…

This is silly, because losing data would be lower outrage, and they might even purchase the data from other agencies so we wouldn't even know it happen.

Also the data that leaked is not the valuable data to them. See how proudly they stated that no core databases were affected? Not giving a damn about us?

What's valuable to them and to banks that use them are the actual information about our credit. If that was compromised that would kill them, because they would lose trust of their real customers (banks).

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#103

I have now placed freezes [1] on my accounts with each of the four agencies. It is perplexing to pay $5-10 to each of these companies that have collected my data without my permission to stop the sale of that data. In particular after they have mismanaged that data and put me at risk. They will probably see a large surge in revenue based on this breach. [1] https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq…

Whats the fourth? I just know of Equifax, Experian, Transunion.

From the New York Times [0]: In the meantime, here’s hoping that this breach is the nudge you need to finally sign up for permanent freezes on your credit files. I’ve used them for years, and here’s how they work. You sign up (and pay some fees, because you knew it wasn’t going to be free to protect data that you didn’t ask these companies to store, right?) at Equifax’s, Experian’s and TransUnion’s websites. Christina Bater, managing director at Barrett Asset Management in New York, suggests freezing your file at the little-known company Innovis, too. Hey, why not?

[0] https://www.nytimes.com/2017/09/08/your-money/identity-theft...

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#104

I have now placed freezes [1] on my accounts with each of the four agencies. It is perplexing to pay $5-10 to each of these companies that have collected my data without my permission to stop the sale of that data. In particular after they have mismanaged that data and put me at risk. They will probably see a large surge in revenue based on this breach. [1] https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq…

Whats the fourth? I just know of Equifax, Experian, Transunion.

https://www.washingtonpost.com/business/economy/five-facts-a...

There are quite a few, actually.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#105
post #57

In Sweden your social security number is public information. What's the reason for it being private in the US? Sounds like a horrible thing to rely on for security anyway.

It is not only the US that is like that. Also in Norway it is considered a secret, and you can get a worrying amount of information about someone just by having their social security number.

My guess that this is misguided and muddled security thinking behind this, and is something that happens when the involved institutions do not have a coherent understanding of information security.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#106
post #20

I will be blunt, and I am very incensed by this. My comments ... https://twitter.com/hpcjoe/status/906549917509980160 This is an extinction level event for Equifax. They need to be disassembled, their stored data destroyed correctly and securely, their negligent officers charged. This isn't an accident. You don't surface 0.134 BILLION bits of PII without some sort of criminal level incompetence. Any organization that…

While I certainly agree in spirit, Equifax is, as has been said elsewhere, unfortunately too big to fail. Too much infrastructure has been built around it.

So, instead of dissolution, I propose two very reasonable remedies that I would consider the absolute minimum in concert with whatever fines and sanctions may be levied:

1. Credit freezes/unfreezes must be offered free in perpetuity. “They cost us money to perform” is not a remotely appropriate objection - offering this for free should be a basic cost of doing business in the credit reporting industry.

2. Affected individuals (everyone, basically) must be granted a minimum of 10 years of credit monitoring following the breach. One year is a free sample you get with a coupon code from a podcast. Furthermore, the service must not auto-renew at the end of the term: send users a security report and let them decide if they want to opt-in to continued monitoring after the term ends.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#107

I have now placed freezes [1] on my accounts with each of the four agencies. It is perplexing to pay $5-10 to each of these companies that have collected my data without my permission to stop the sale of that data. In particular after they have mismanaged that data and put me at risk. They will probably see a large surge in revenue based on this breach. [1] https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq…

Whats the fourth? I just know of Equifax, Experian, Transunion.

Thank you both!

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#108
post #57

In Sweden your social security number is public information. What's the reason for it being private in the US? Sounds like a horrible thing to rely on for security anyway.

To me the fact that the data was hacked represents no real change, as I've viewed the organizations that had access to this information just as adversarial as the crooks who stole it. At least now anybody can pay the price to see, and that means there is no corporate monopoly on the data about us. It's time to face the world of open data and structure ourselves so that it is to our advantage.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#109
post #86
post #45

Earlier quoted context omitted.

Every generation is galvanized by serious injustices. But, it feels like we're far less effective at turning that anger into change; though maybe that's always how it feels at the time. I'm almost sure I once saw a quote from Bill Clinton's press secretary that said something like "We knew that if we could survive the first 5 days of a bad story, it would get dropped." That perspective solidified for me during the Oc…

> we're far less effective at turning that anger into change The anger will become a mob that enacts change when a critical mass of people lose access to food and/or shelter. > what of [Occupy] Occupy was very successful at (re-)introducing class warfare into the public dialog. > First, that people are naïve, and second, what's it going to take to drive people to take un-ignorable action? 3rd, why isn't this anger or…

Oh, you're on the right track... but it's worse than you imagine. Those "leaders" and "organizers" are unimportant. You're familiar with the 'Six Degrees of Kevin Bacon', right? Say you were omnipotent and wanted to make it so that instead of only needing 6 links to get to Mr. Bacon, you needed 15 links on average. And you want to do as little disruption of the network as necessary.

What nodes in the graph of connections would you target? Intuition says go after the nodes with tons of connections to tons of people. Intuition is, as it almost always is, dead wrong. Removing those massively-connected people in a social network is basically useless. They are almost exclusively connected to people who are already connected to one another. They're the center of clusters, and you will almost never route through one in an attempt to find the path to Mr. Bacon.

Instead, what you want to look for are node which bridge clusters. People who are usually not strongly connected to one of the clusters they are associated with, but provide a conduit through which connections can be made. Because they are inherently a bit 'different' from the people in each of the clusters they bridge (few others bridge those two clusters), they tend not to be important figures. They're a member of a biker gang who hangs out with his great aunts knitting circle on Saturdays. They're the ones who facilitate the flow of ideas between groups that never speak to one another otherwise.

So you know who to target... but how many 'bridge' nodes like that do you need to really take out in order to significantly increase the 'distance' between nodes on the graph on average? Disturbingly few. Removing something like 25 nodes from the graph of tens of thousands of performers will make it so you need 15 or more connections on average to get to Mr. Bacon. (The book 'Linked: The New Science of Networks' details the research specifically, its been years since I read it though so I am fuzzy on exact numbers but it was definitely fewer than 30 you needed to remove)

Now, imagine a crazy scenario where you had access to the social graph of a country (somehow!) and knew who was talking to who. And your goal was just to maintain the status quo. Well, what does any large-scale social change require? An idea must spread to large numbers of extremely different, and almost entirely disconnected, groups. Any idea that remains sheltered in one or a few groups will die out of its own accord. A revolution doesn't happen because one minority wills it, there has to be buy-in from a wide array of groups. So remove those bridge nodes. Any widespread social change becomes very nearly impossible.

But what is "removing a node"? I'm not talking about black-bagging a person and dragging them off to some hole or blowing their brains out. Such things are entirely unnecessary and counter-productive. The more significant your action is, the more profound the unintended consequences will be and predicting the outcome quickly becomes intractable. Instead, notice that those bridges are usually connected more strongly to one cluster rather than the other. If their communication became more burdensome to the group they are less connected to... for how long would they persist in fighting to maintain it? If something nutty happened and they had to change their phone number, what're the odds they'll forget to give the new one to the contact in a group they're barely involved in?

You could have very quiet oppression through these means. I expect there would be unintended consequences, and have been trying to figure out for a few ways a good way to detect such changes in a social network, but its just a thing I keep in the back of my head, not something I actively work on. If you've got any ideas, I'd be happy to hear them.

Re: No matter what, Equifax may tell you you’ve been impacted by the hack

#110
post #20

I will be blunt, and I am very incensed by this. My comments ... https://twitter.com/hpcjoe/status/906549917509980160 This is an extinction level event for Equifax. They need to be disassembled, their stored data destroyed correctly and securely, their negligent officers charged. This isn't an accident. You don't surface 0.134 BILLION bits of PII without some sort of criminal level incompetence. Any organization that…

Agreed. At this point, the only sensible thing to do is to assume that Equifax is -- and perhaps has been -- compromised indefinitely. If not by external agents, then by internal incompetence or malfeasance. They've not clearly demonstrated either the intention or the ability to handle this breach in a diligent, professional, ethically sound way. To me, that calls into serious question their ability to embody those qualities in their operations before the breach as well.
Post reply on HN