Live data from Hacker News

Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed

bloomberg.com

11–20 of 80 posts

Re: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed

#11
post #7

I think it's good news- if your identity has not been used, there's less chance that it will be, because the data has been already out for that long.

This data will likely surface in the open in a few years, like for most other major leaks.

Re: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed

#12
post #10
post #7

I think it's good news- if your identity has not been used, there's less chance that it will be, because the data has been already out for that long.

I was told they usually aren't used until at least a year after the fact, because this line of reasoning. Not sure how true that is.

I would probably wait at least until everybody's free fraud protection expires, which is usually a year.

Re: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed

#13

I'm sure this looks good for the insider trading news.

> Pros for not prosecuting: The size of the sells were truly negligible for all executives involved, in proportion to how many shares they have and routinely liquidate. The same argument that there were any sells at all would been made regardless of the number of shares. A company that size will always have material non public information. Equifax's OPSEC was horrible all along and a gigantic leak was bound to happen…

A company that size will always have material non public information.

If you're in that position, then wouldn't you make sales regularly on scheduled dates? (say quarterly)

Otherwise theyre asking to get prosecuted, if not for this sale then the next.

Re: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed

#14

Earlier quoted context omitted.

> Pros for not prosecuting: The size of the sells were truly negligible for all executives involved, in proportion to how many shares they have and routinely liquidate. The same argument that there were any sells at all would been made regardless of the number of shares. A company that size will always have material non public information. Equifax's OPSEC was horrible all along and a gigantic leak was bound to happen…

A company that size will always have material non public information. If you're in that position, then wouldn't you make sales regularly on scheduled dates? (say quarterly) Otherwise theyre asking to get prosecuted, if not for this sale then the next.

Right, and these execs did that as well. I mentioned that in the "routinely liquidate" part, but I guess it wasn't clear, they do liquidate shares on a schedule.

Sure, doing anything out of that schedule is always a risk, and doing things on that schedule doesn't mean there isn't insider trading still happening. A successful prosecution under these equities-specific market sanctions will rely on more than that.

Re: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed

#15

Earlier quoted context omitted.

> Pros for not prosecuting: The size of the sells were truly negligible for all executives involved, in proportion to how many shares they have and routinely liquidate. The same argument that there were any sells at all would been made regardless of the number of shares. A company that size will always have material non public information. Equifax's OPSEC was horrible all along and a gigantic leak was bound to happen…

A company that size will always have material non public information. If you're in that position, then wouldn't you make sales regularly on scheduled dates? (say quarterly) Otherwise theyre asking to get prosecuted, if not for this sale then the next.

[deleted]

Re: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed

#16
post #7

I think it's good news- if your identity has not been used, there's less chance that it will be, because the data has been already out for that long.

To red team that line of reasoning: hold on to the hacked data but don't use it, wait till public forgets about it, don't give business/lawmakers a reason to neuter the data, then strike a few years down the line.

Re: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed

#18
IMPORTANT: The date of disclosure is ALSO the date that demand for hacked data explodes.

It's good practice to have a staged-disclosure procedure for leaks of this nature.

For example: your bank should be told to start fine-tuning its anti-fraud capabilities BEFORE the entire world is made aware that you can be defrauded in this particular manner.

Re: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed

#19
> One possible explanation, according to several veteran security experts consulted by Bloomberg, is that the investigation didn’t uncover evidence that data was accessed. Most data breach disclosure laws kick in only once there’s evidence that sensitive personal identifying information like social security numbers and birth dates have been taken.

There was one company (very well known) I know of that was breached, but their logging and general security infrastructure was so poor that they had no direct evidence that customer info was breached, so they didn't have to report the hack. They only found the intrusion due to excessive load the intruders caused on some services.

Customer info was certainly accessed (the attackers where everywhere), it's just there was no record of it as the records they kept where so few and far between.

Part of me thinks it's a pretty clever workaround to such laws.

Post reply on HN