This is horrendously bad.
Cybersecurity Incident Involving Consumer Information
71–80 of 551 posts
Re: Cybersecurity Incident Involving Consumer Information
#72Earlier quoted context omitted.
I really wish they would issue something like this. Or put a smartcard in my driver's license (I'm sure there are privacy implications to this though).
Even the level of standardization proposed for Real ID was met with enormous push back. The long term solution is to figure out how to make financial companies feel the pain of fraudulent accounts. Like maybe when they open an account without doing a sufficient level of verification they should have to pay the victim of the fraud $5000 (in addition to covering any damages they cause).
Plus stronger regulation of how data is stored. Personal information is valuable - banks have security requirements, why not institutions like this?
Re: Cybersecurity Incident Involving Consumer Information
#73It makes me wonder how they set up their security infrastructure. Were the hackers able to freely access their HSMs? Do they not monitor access?
Would be nice if some form of RCA is made public.
Re: Cybersecurity Incident Involving Consumer Information
#74Too big to punish?
Re: Cybersecurity Incident Involving Consumer Information
#75Earlier quoted context omitted.
I think you are missing something. Here's what's needed to initiate your TransUnion freeze: To set up a security freeze with TransUnion, please visit our online form. You should be prepared with the following types of information: 1. Your full name, including middle initial and suffix, such as Jr., Sr. II, III 2. Social Security Number 3. Date of birth 4. Current address 5. All addresses where you have lived during t…
Equifax can handle its internal management and operations however it wants. Externally, though, I want Equifax to have to pay a fine for every individual whose information was compromised. Identity theft can easily cause five figures worth of damage, so $10k per individual would be fair. Maybe as a warning shot we could lower this to... $1k? $100? That's the only way to properly align incentives so companies will pro…
I expect managers to go to jail, in addition to a financial kneecap that forces other companies to vigilantly pressure their management for security.
Well, maybe not expect. This is America... I expect infuriating golden parachutes. But I certainly hope for criminal charges and jail time.
Re: Cybersecurity Incident Involving Consumer Information
#76I strongly encourage anyone in the US to put a full credit security freeze on all three credit agencies. When a credit freeze is in place, you still have access to all of your existing loan accounts and whatnot (e.g. credit cards), but lenders cannot access your credit to open new accounts unless you want them to. It's not difficult nor expensive to do, and the freeze lasts until you decide to revoke it. Whenever you…
Dilemma: spend $30 on credit freezes or put $30 into bitcoins?
Re: Cybersecurity Incident Involving Consumer Information
#77Earlier quoted context omitted.
I think you are missing something. Here's what's needed to initiate your TransUnion freeze: To set up a security freeze with TransUnion, please visit our online form. You should be prepared with the following types of information: 1. Your full name, including middle initial and suffix, such as Jr., Sr. II, III 2. Social Security Number 3. Date of birth 4. Current address 5. All addresses where you have lived during t…
Equifax can handle its internal management and operations however it wants. Externally, though, I want Equifax to have to pay a fine for every individual whose information was compromised. Identity theft can easily cause five figures worth of damage, so $10k per individual would be fair. Maybe as a warning shot we could lower this to... $1k? $100? That's the only way to properly align incentives so companies will pro…
This thing called "Identity Theft" does cause damage, but it's important to remember that if fraudsters trick a bank into thinking they are you, it is the bank's fault for failing to properly verify it was actually you. Doing so would cost them more money and it is much easier to do cursory checks instead.
No doubt fraudsters impersonating you is a hassle and you must spend some time and money dealing with it if you are targeted, but do not lose sight of why it happens and who is ultimately responsible.
Re: Cybersecurity Incident Involving Consumer Information
#78> approximately 143 million U.S. consumers. This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US social security number when significant exposure happens (this would be the 4th or 5th time in 24 months my data has been exposed). Assuming legislation passed that allowed you to cancel an exposed SSN and get a new one, what would it take for that to happen?…
Requiring better proof of identity would create friction to consumer credit transactions.
Re: Cybersecurity Incident Involving Consumer Information
#79> approximately 143 million U.S. consumers. This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US social security number when significant exposure happens (this would be the 4th or 5th time in 24 months my data has been exposed). Assuming legislation passed that allowed you to cancel an exposed SSN and get a new one, what would it take for that to happen?…
I think the true error in process is that a SSN is considered to be a secret, unique ID, and many (many!) institutions allow you to use it as a proof of identity. It's short, guessable, would fail all of their own password requirements, and yet somehow it gets a free pass. I just consider my SSN to be public, and move about my digital life with that assumption. I don't go plastering it on walls, but if I encounter a…
You're right it was never meant to be a unique identifier, we need a national identification card, link to a video about it.
Re: Cybersecurity Incident Involving Consumer Information
#80Earlier quoted context omitted.
Why do you think Equifax (or Home Depot, or Target) is any less of a victim here?
I leave my home with a house sitter. The house sitter throws a kegger, and his guests cause six figures worth of property damage, including stealing the house sitter's laptop. Who are all the criminal parties here?
[deleted]