Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax Faces Multibillion-Dollar Lawsuit Over Hack

bloomberg.com

Post reply on HN
Print view View original

661–670 of 670 posts

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#661

Post by keyboardmonkey »

cliffcrosland wrote: post #467

To be honest, I feel bad for the engineering team at Equifax. The vulnerability that compromised their system was a bug in an open-source Java library, Apache Struts, and security researchers only noticed it a few days ago. It seems that the Equifax team had very little time to react and update their software. In some sense, I feel that more blame should be placed on the engineers who built the highly popular open-so…

so writing your own software is "unproductive" but you also want to put the blame onto the people who made a framework available?... do you want open source to go away? or do you think that companies that protect such valuable information should be spending more on security assurances?

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#663

Post by tpxl »

School-Cotton wrote: post #583
llsf wrote: post #429

Earlier quoted context omitted.

There is no such agencies in lots of countries (e.g. France) and still people get loans. When I came to US, I had to purposely take extra credits/loans to boost my inexistent credit history. Now I am credit worthy thanks to my artificial debt.

I'm not arguing against you, just curious... in France, what prevents people from just applying for loans over and over and never paying them back?

There are other means to determine whether someone is eligible for a loan (wages, collateral, family support...).

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#664

Post by pc86 »

joering2 wrote: post #611
pc86 wrote: post #142

Earlier quoted context omitted.

I think it's unlikely you'll actually be damaged. Any real financial impact would have been reversed by your bank. Maybe a fee or two that two parties argue about who should reimburse your for it, however I can't see stuff like that adding up to $1,000 (or even $100).

You misunderstood how this affects SS #s holders. Its way more serious than just opening up a credit card and disputing it later on. In such situation the bank will reimburse you and close down fake account, but many banks will put negative information on your account just to warn other banks. You have to look at it from bank perspective, not your own. The bank can report: "okay we don't know how and when but someone…

Does this "be warned" flag on someone actually damage them in any way?

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#666

Post by daemin »

maxerickson wrote: post #267
rayiner wrote: post #96

Earlier quoted context omitted.

Probably for good reason. $500 per class member is an insanely high damages estimate. 99.9% of people will suffer zero damages because their identities will not be stolen. Even the ones who do have their identities stolen will likely be made whole by the credit card companies. The real damages here are going to be to the banks and credit card companies that will have to absorb the costs of all the fraud. As to the Ti…

If there are 140 million members then any settlement will be individually quite modest (Equifax has annual income of ~600 million dollars, so multiple years of all of it to get to even $10). It does seem like any penalty for something like this should severely impact the ability of the company to operate though. I suppose a $0 way to penalize them severely would be to force Equifax to allow individuals to opt out of…

But that would also make Equifax's product not that appealing to the companies that would purchase it. So organisations would have to use one of the other agencies as well.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#667

Post by pricechild »

gorbachev wrote: post #650
Chaebixi wrote: post #71

Earlier quoted context omitted.

> I said it elsewhere, but I think the right response is to opt out of the class, and sue for $1000 in small claims court. If ~15% of the class does this, they are out of business, and lawyers don't get a dime of the $1000. IANAL, but can't you only sue for actual damages not hypothetical damages? According to this [1] your identity with SSN is only worth $30 on the black market. To get $1000 out of them you'd probab…

You can sue for anything. They'll have to show up to respond, or you win by default regardless of whether your case is valid or not. This would cost them a fortune.

I cannot believe that is how the court system works in any jurisdiction... are you commenting on the US?

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#668

Post by otakucode »

hedora wrote: post #17

I'd love to see the $70B number pan out (though $500 per person is less than the damages, I think) -- Equifax is a $17B company, and would presumably stop existing if that happened. On the other hand, these things always settle out of court, and Equifax certainly won't settle the suit for more than they're worth. I said it elsewhere, but I think the right response is to opt out of the class, and sue for $1000 in smal…

Toyotas negligent practices with regard to software killed at least 2 people. Their developers did not even have a bug tracking system at all. They followed only 6 of 90+ industry standard recommended practices. They lied about the system using error-checking RAM when it actually did not. None of that was enough to get a court to declare them negligent. Equifax will be fully acquitted. If a computer is involved, companies can get away with literally killing people. This is court precedent.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#669

Post by olivier1664 »

cliffcrosland wrote: post #467

To be honest, I feel bad for the engineering team at Equifax. The vulnerability that compromised their system was a bug in an open-source Java library, Apache Struts, and security researchers only noticed it a few days ago. It seems that the Equifax team had very little time to react and update their software. In some sense, I feel that more blame should be placed on the engineers who built the highly popular open-so…

To sum up your link, the vulnerability is the use of an unsafe deserialization similar to:

    ObjectInputStream ois = new ObjectInputStream(input);
    MyObject obj = (MyObject)ois.readObject();
https://lgtm.com/blog/finding_unsafe_deserialization_with_ql
Post reply on HN