Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax securities fraud class action [pdf]

securities.stanford.edu

Post reply on HN
Print view View original

121–130 of 227 posts

Re: Equifax securities fraud class action [pdf]

#121

Post by mateus1 »

RankingMember wrote: post #69

> On August 2, 2017, Equifax notified the FBI of the Data Breach. It also retained legal counsel to guide its investigation into the breach. The same day, Equifax’s legal counsel retained Mandiant to assist in the investigation into the incident. Experts would later note that these steps suggested that Equifax knew that the Data Breach was serious. In the days immediately following the discovery of the Data Breach, G…

Apparently both execs have been cleared of an insider trading charge.

https://gizmodo.com/equifax-investigation-clears-execs-who-d...

Re: Equifax securities fraud class action [pdf]

#122

Post by kjaftaedi »

RankingMember wrote: post #69

> On August 2, 2017, Equifax notified the FBI of the Data Breach. It also retained legal counsel to guide its investigation into the breach. The same day, Equifax’s legal counsel retained Mandiant to assist in the investigation into the incident. Experts would later note that these steps suggested that Equifax knew that the Data Breach was serious. In the days immediately following the discovery of the Data Breach, G…

It's sad how obvious this is. Possibly even more obvious than the insider trading at intel prior to the spectre/meltdown public release.

This will be forever the legacy of Eric Holder, the man who changed the justice department policy to go after smaller 'fines' as settlements instead of prosecuting crimes.. only because of the simple fact that fines are easy to win, and criminal cases can be lost.

Justice is now escapable because it's been deemed "too difficult to pursue"

Re: Equifax securities fraud class action [pdf]

#125

Post by 24gttghh »

LurkersWillLurk wrote: post #117
24gttghh wrote: post #95

Earlier quoted context omitted.

So, the footnotes for the "admin" "admin" (46. Id. ¶ 225 (emphasis omitted) points at footnote 1. Am. Compl. ¶ 3.) claim refer to the amended complaint, paragraph 3? Any idea where this amended complaint is, which most of the early footnotes are referring to?

Here's the Amended Complaint: https://www.courtlistener.com/recap/gov.uscourts.gand.241666...

So bullet point # 225 from that complaint basically says the same as the PDF we're discussing:

>Likewise, Equifax “protected” one of its portals used to manage credit disputes with the username ‘admin’ and password ‘admin.’ This portal allowed access to a vast cache of personal information, including employee names, emails, usernames, passwords, consumer complaint records, and the Argentinian equivalent of Social Security numbers. The portal also granted administrative access allowing intruders to add, delete, or modify records. A November 15, 2017 article in Forbes quoted cybersecurity expert Wes Moehlenbruck, who stated that this was one of many “very grossly negligent security practices” at Equifax. The article continued, “‘Admin/admin’ as a database password is a surefire way to get hacked almost instantly,’ Moehlenbruck says. ‘A production database with this account smells of poor security policy and a lack of due diligence.’

Seems to agree with that GP was saying.

Re: Equifax securities fraud class action [pdf]

#127

Post by elisharobinson »

Spooky23 wrote: post #58
sn41 wrote: post #48

This is quite strong policy. Usually in most sinister incompetent companies, the user name is "admin" and the password is "password". On a serious note: there should be a mandated, periodic, third-party security audit by neutral parties for all entities which deal with user data beyond a certain specified level of sensitivity. It should not be left to their discretion when to run such an audit from their end. Whether…

No way! A sinister big company would use “Pa$$w0rd” to meet complexity requirements!

sinister != competent

Re: Equifax securities fraud class action [pdf]

#128

Post by otterley »

mateus1 wrote: post #121
RankingMember wrote: post #69

> On August 2, 2017, Equifax notified the FBI of the Data Breach. It also retained legal counsel to guide its investigation into the breach. The same day, Equifax’s legal counsel retained Mandiant to assist in the investigation into the incident. Experts would later note that these steps suggested that Equifax knew that the Data Breach was serious. In the days immediately following the discovery of the Data Breach, G…

Apparently both execs have been cleared of an insider trading charge. https://gizmodo.com/equifax-investigation-clears-execs-who-d...

... by their former employer, not the SEC (the enforcing authority here).

Re: Equifax securities fraud class action [pdf]

#129

Post by RankingMember »

mateus1 wrote: post #121
RankingMember wrote: post #69

> On August 2, 2017, Equifax notified the FBI of the Data Breach. It also retained legal counsel to guide its investigation into the breach. The same day, Equifax’s legal counsel retained Mandiant to assist in the investigation into the incident. Experts would later note that these steps suggested that Equifax knew that the Data Breach was serious. In the days immediately following the discovery of the Data Breach, G…

Apparently both execs have been cleared of an insider trading charge. https://gizmodo.com/equifax-investigation-clears-execs-who-d...

Basically "We investigated ourselves and found there was no wrongdoing." As the top comment there notes, they're positing that the director of US Information Security wasn't aware of the data breach until 2 weeks after it was uncovered.

Re: Equifax securities fraud class action [pdf]

#130

Post by elisharobinson »

Legogris wrote: post #23
bouncycastle wrote: post #18

Earlier quoted context omitted.

Colleague #3: "Sounds good to me. We're behind the firewall and the NIC used for Dell iDRAC or HP iLO is on an isolated network unique to the physical datacenter. Remote access for our techs is managed through a secured bridge that requires all sorts of security hoops on our company intranet, and remote access for general internet traffic is not available due to the firewall restrictions. There's no way hackers will…

Colleague #4-20: Build various integrations to database, all with their own ways of storing credentials. Colleague #2: "It's really past due time to change the database password, but first we have to make sure all critical systems can still access the database."

manager: why is it taking so long to deploy a simple cluster. back in my day we could code a whole ...
Post reply on HN