Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Submit Your Claim in the Equifax Breach Settlement

equifaxbreachsettlement.com

Post reply on HN
Print view View original

11–20 of 210 posts

Re: Submit Your Claim in the Equifax Breach Settlement

#11

Post by acomjean »

simonsarris wrote: post #2

It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm surprised it hasn't already.) After all this site links to the law firm JND, but nowhere does JND mention this site. So any of us could have made this site. Use the form below to find out if your information was impacted and if you are a class member. Last Name _…

Update. I tried a different last name and told I wasn't eligible, so thats good.

>I just entered "Smith" and 6 digits. (Not real) I was eligible.

Re: Submit Your Claim in the Equifax Breach Settlement

#12

Post by simonsarris »

jwp23 wrote: post #7
simonsarris wrote: post #2

It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm surprised it hasn't already.) After all this site links to the law firm JND, but nowhere does JND mention this site. So any of us could have made this site. Use the form below to find out if your information was impacted and if you are a class member. Last Name _…

Your comment inspired me to take a look. I compared the SSL certificate and the whois information to equifax.com. The settlement site uses a different company for the certificate. The settlement site uses Starfield Technologies vs DigiCert for equifax.com. The settlement site uses GoDaddy for their DNS vs UltraDNS for equifax.com. It's not impossible that a division in the company or a different law firm uses differe…

Yeah its totally legit, its just funny to think about. I expect it to happen someday.

This site is using godaddy presumably because the law firm also does, though they do use different certs!

Re: Submit Your Claim in the Equifax Breach Settlement

#13

Post by astura »

simonsarris wrote: post #2

It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm surprised it hasn't already.) After all this site links to the law firm JND, but nowhere does JND mention this site. So any of us could have made this site. Use the form below to find out if your information was impacted and if you are a class member. Last Name _…

Its somewhat of an unsolved problem, there's all sorts of these kind of sites that are legitimate but look really suspicious, like they could be phishing sites. Examples:

https://www.annualcreditreport.com/

https://www.optoutprescreen.com/

You can tell these two are legit because they are listed on official government sites:

https://www.ftc.gov/faq/consumer-protection/get-my-free-cred...

https://www.consumer.ftc.gov/articles/0262-stopping-unsolici...

However, I can see how some people wouldn't think to go through .gov sites and there's really nothing stopping me from registering a phishing site with a similar domain and hosting it in Russia or something to confuse people into using mine rather than the official one.

I think freecreditscore.com has been confused with annualcreditreport.com in the past. Freecreditscore.com is owned by Experian now and it actually does offer a real free no strings attached credit score NOW, but in the past it used to be one of those sites that tricked you into signing up for a subscription.

Then, of course, there was the Equifax data breach site that totally looked like a phishing site.

Re: Submit Your Claim in the Equifax Breach Settlement

#14

Post by Zombieball »

simonsarris wrote: post #2

It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm surprised it hasn't already.) After all this site links to the law firm JND, but nowhere does JND mention this site. So any of us could have made this site. Use the form below to find out if your information was impacted and if you are a class member. Last Name _…

A security researcher setup a similar domain with a phishing page. Equifax made the mistake of linking to his page rather than their own on twitter!!!

https://www.google.ca/amp/s/www.nytimes.com/2017/09/20/busin...

Re: Submit Your Claim in the Equifax Breach Settlement

#15

Post by ocdtrekkie »

acomjean wrote: post #11
simonsarris wrote: post #2

It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm surprised it hasn't already.) After all this site links to the law firm JND, but nowhere does JND mention this site. So any of us could have made this site. Use the form below to find out if your information was impacted and if you are a class member. Last Name _…

Update. I tried a different last name and told I wasn't eligible, so thats good. >I just entered "Smith" and 6 digits. (Not real) I was eligible.

Arguably, your best bet for this kind of test is a very blatantly fake name, like "Zxzxzx". It's entirely possible that there is someone with the last name Smith (since it's very common) who also has those six digits at the end of their SSN.

Re: Submit Your Claim in the Equifax Breach Settlement

#16

Post by acomjean »

ocdtrekkie wrote: post #15
acomjean wrote: post #11

Earlier quoted context omitted.

Update. I tried a different last name and told I wasn't eligible, so thats good. >I just entered "Smith" and 6 digits. (Not real) I was eligible.

Arguably, your best bet for this kind of test is a very blatantly fake name, like "Zxzxzx". It's entirely possible that there is someone with the last name Smith (since it's very common) who also has those six digits at the end of their SSN.

Good point.. I tried "potter" and I got Not eligible.

So either I'm a great last digit guesser (Though I'm usually not lucky in things like gambling....) I'll update my original comment.

Re: Submit Your Claim in the Equifax Breach Settlement

#17

Post by azernik »

jwp23 wrote: post #7
simonsarris wrote: post #2

It would become a legendary case study if this site turned out to be an information phishing site. (This one is legit but I expect it to happen someday. I'm surprised it hasn't already.) After all this site links to the law firm JND, but nowhere does JND mention this site. So any of us could have made this site. Use the form below to find out if your information was impacted and if you are a class member. Last Name _…

Your comment inspired me to take a look. I compared the SSL certificate and the whois information to equifax.com. The settlement site uses a different company for the certificate. The settlement site uses Starfield Technologies vs DigiCert for equifax.com. The settlement site uses GoDaddy for their DNS vs UltraDNS for equifax.com. It's not impossible that a division in the company or a different law firm uses differe…

You're assuming that this site is run by Equifax; it is not. It is run by a "Settlement Administrator", a third-party entrusted by the court to handle the money and record-keeping associated with a class-action settlement. This is to avoid possible manipulation of the settlement by the defendant.

Re: Submit Your Claim in the Equifax Breach Settlement

#18

Post by jbredeche »

If this breach affected 147M people (which is what I can find from various articles), and $700M was set aside (before attorney fees), and most claims will be $125, that's only ~4M people who will get $125.

Are they expecting very few people to file claims? Or what am I missing?

Post reply on HN