Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

gizmodo.com

Post reply on HN
Print view View original

61–70 of 99 posts

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#61

Post by _jal »

r00fus wrote: post #47
mzs wrote: post #43

Earlier quoted context omitted.

Something similar happened to me years ago. In the process I sent a tar-ball. He replied with, "Please resend the attachment as industry standard ZIPFILE."

At least for that one, it can ostensibly explained by "In Windows tar isn't supported". But a security director being suspicious of PGP encryption is a sign of a know-nothing in a position of power.

...A security director blustering about "I will not be sold to or scammed!" is another clear demonstration of clue-deficiency.

I mean, come on - do they also ask strangers to hold their wallet?

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#62

Post by _jal »

itswednesday wrote: post #57
victorkab wrote: post #56

Hey Hacker News, I am Victor, the CTO of Truework ( https://www.truework.com ), a startup providing an alternative to Equifax / TheWorkNumber. We are working to change the way employment & income information is shared by employers with a more privacy focused approach where you, as an employee, decide if you want to give the information with the requester. I started this company after I found out that Equifax shared m…

Does Equifax actually have my employment and income information? I thought it was just credit reports, etc

This is probably what you're looking for:

https://twocents.lifehacker.com/how-to-review-and-dispute-th...

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#63

Post by victorkab »

itswednesday wrote: post #57
victorkab wrote: post #56

Hey Hacker News, I am Victor, the CTO of Truework ( https://www.truework.com ), a startup providing an alternative to Equifax / TheWorkNumber. We are working to change the way employment & income information is shared by employers with a more privacy focused approach where you, as an employee, decide if you want to give the information with the requester. I started this company after I found out that Equifax shared m…

Does Equifax actually have my employment and income information? I thought it was just credit reports, etc

Yes Equifax has accumulated employment and income information through their purchase of The Work Number (https://en.wikipedia.org/wiki/The_Work_Number) in 2007. They have 200 million of employment records and likely a higher multiple of paychecks.

They have a large share of the fortune 500 companies in the US. If you have worked for a large firm in the past, it's likely that every single one of your paycheck is somewhere in their database.

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#64

Post by astura »

ufo wrote: post #26
duxup wrote: post #6

I recall someone who was a security director at Panera Bread (a US based fast casual restaurant). Was confused and upset when a security researcher contacted them and asked to exchange a PGP key ... I suspect he straight up didn't understand what the request for a key meant or possibly even the issue as it was a very obvious issue and they did nothing about it until it hit the press. His previous job... at Equifax. O…

The initial email exchange is indeed a sight to see, so I transcribed the text in the image: --------- Hello Mike et al Thank you for making yourself available. There is a security vulnerability on the delivery.panerabread.com website that exposes sensitive information belonging to every customer who has signed for an account to order Panera Bread once. This shows the customer's full name, email address, phone number…

!!!

That's a very nasty response to an incredibly polite email.

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#65

Post by TheHegemon »

inflatableDodo wrote: post #59
toomuchtodo wrote: post #21

Earlier quoted context omitted.

How do people so dangerously incompetent get hired into these roles? Edit: My question and the replies are incredibly depressing as an infosec practitioner.

Hairstyle, height and chin shape.

This would be funny if it wasn't so depressingly true.

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#66

Post by DoreenMichele »

WrtCdEvrydy wrote: post #25
toomuchtodo wrote: post #21

Earlier quoted context omitted.

How do people so dangerously incompetent get hired into these roles? Edit: My question and the replies are incredibly depressing as an infosec practitioner.

"Experience"

One day, my son was ranting about some guy who, in my son's opinion, was the death of multiple cool projects. He was like "I don't know how he keeps getting hired! He destroys everything he touches!"

And I told him "His resume lists multiple cool projects that he worked on."

(Facepalming ensued.)

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#67

Post by sjg007 »

hello_newman wrote: post #37
toomuchtodo wrote: post #11

Anyone have a current status on how to effectively sue Equifax for data exposed?

Last year, I tried to sue them in Small Claims court (in California) using this as a guide: https://blog.legalist.com/i-won-8-000-from-equifax-in-small-... . For me, it was unsuccessful. They sent out a representative and we argued away from a judge (forget the term used) and I decided not to see the judge because if I argued before him and lost, I would be "unable" to bring it before a judge again. I've heard of thi…

Usually in front of the judge in small claims nobody is allowed a lawyer. You could argue that you now need unlimited credit monitoring on all credit reporting agencies. The most likely outcome is that they would agree to this. Honestly, I think Congress should just mandate that they be required to have free monitoring, free locks, free reports... basically any personal inquiry should be free.

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#68

Post by sjg007 »

victorkab wrote: post #63
itswednesday wrote: post #57

Earlier quoted context omitted.

Does Equifax actually have my employment and income information? I thought it was just credit reports, etc

Yes Equifax has accumulated employment and income information through their purchase of The Work Number ( https://en.wikipedia.org/wiki/The_Work_Number ) in 2007. They have 200 million of employment records and likely a higher multiple of paychecks. They have a large share of the fortune 500 companies in the US. If you have worked for a large firm in the past, it's likely that every single one of your paycheck is som…

Huh.. that sounds illegal.

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#69

Post by inflatableDodo »

TheHegemon wrote: post #65
inflatableDodo wrote: post #59

Earlier quoted context omitted.

Hairstyle, height and chin shape.

This would be funny if it wasn't so depressingly true.

We are perhaps being too cynical, it isn't quite that straight forward. I hear you also need to wear the right tie and buy the correct pair of expensive shoes.

Re: Moody’s downgraded Equifax from “stable” to “negative” due to cybersecurity

#70

Post by perfmode »

ufo wrote: post #26
duxup wrote: post #6

I recall someone who was a security director at Panera Bread (a US based fast casual restaurant). Was confused and upset when a security researcher contacted them and asked to exchange a PGP key ... I suspect he straight up didn't understand what the request for a key meant or possibly even the issue as it was a very obvious issue and they did nothing about it until it hit the press. His previous job... at Equifax. O…

The initial email exchange is indeed a sight to see, so I transcribed the text in the image: --------- Hello Mike et al Thank you for making yourself available. There is a security vulnerability on the delivery.panerabread.com website that exposes sensitive information belonging to every customer who has signed for an account to order Panera Bread once. This shows the customer's full name, email address, phone number…

who does Mike report to?
Post reply on HN