Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Crime Privacy Security

Experian Breached, 15 Million T-Mobile Customer's Data Exposed 161

New submitter Yuuki! writes: The Washington Post reports that T-Mobile's Credit Partner, Experian, has been breached revealing names, addresses, Social Security numbers, birth dates and driver's license and passport numbers for any customer who has applied for device financing or even services from T-Mobile which required a credit check. Both parties were quick to point out that no no credit card or banking data was stolen as part of the attack. The attack started back in September 2013 and was only just discovered on September 16, 2015. Both Experian and T-Mobile have posted statements on their websites and Experian is offering credit for two free years of identity resolution services and credit monitoring in the wake of the breach.
This discussion has been archived. No new comments can be posted.

Experian Breached, 15 Million T-Mobile Customer's Data Exposed

Comments Filter:
  • Two Free Years! (Score:5, Insightful)

    by Anonymous Coward on Friday October 02, 2015 @07:18AM (#50643509)

    Two free years of credit monitoring after the bad guys had two free years of access! Great work, Experian!

    • I just want to know if the credit monitoring is going to be through Experian [experian.com]? Also do I get to decide when the credit monitoring starts as I already have a couple of other services monitoring my credit and I don't think I need another concurrent one. It would be nice if these things stacked instead of ran concurrent.
      • by Anonymous Coward
        All told, I have 17,300 years of credit monitoring due to various corporate negligence.
        There's no way they're going to steal my identity again!
        • I'm puzzled at one blurb in the synopsis...PASSPORT numbers?

          WTF would they have passport numbers for a T-Mobile phone?!?

          It seems strange they'd even have a slot to store US passport numbers, considering that the vast majority of US citizens don't have or need a passport, eh?

          That just struck me as odd that they'd have this stored associated with a mobile phone credit application.

          • They have this thing where they demand a second form of ID - they ask for a driver's license number, or a passport number. I protested and they settled for a student ID number, which in hindsight was a smart move.

    • Re:Two Free Years! (Score:5, Insightful)

      by CaptainLard ( 1902452 ) on Friday October 02, 2015 @08:28AM (#50643905)

      I currently have 3 separate free credit monitoring services from prior breaches in other companies. I'm confident that I'll have perpetual free credit monitoring since the credit monitoring lobby is now rich enough to force congress to maintain the status quo.

    • Two free years of credit monitoring after the bad guys had two free years of access! Great work, Experian!

      I read their offer as "This is not the incompetence you're looking for [youtube.com]; we're still relevant; no-one's worth may be judged without our say-so! dammit!!"

    • I'm sure if we protest enough, they'll also give us a coupon for 20% off at Bed, Bath, and Beyond
  • Honestly, this has the unfortunate, identical taste of the latest school shooting.

    What a shame, but nothing will really change once this is all hashed out.

    • by jedidiah ( 1196 )

      ...there won't even be the same sort of mass outrage associated with this. Only a few geeks will even notice or pay attention. Making it even less likely that anything will change.

      • ...there won't even be the same sort of mass outrage associated with this. Only a few geeks will even notice or pay attention. Making it even less likely that anything will change.

        Quite right. Even now (as millions of hard-earned credit ratings are threatened) the school shooting, the Vatican's elaboration on the Pope meeting Ms. Davis, and latest thing Trump said are bigger news stories.

        • by lgw ( 121541 )

          I can at least understand the shooting becoming the top story for a while (if it bleeds it leads), but it's obvious how far the news media has fallen when "the Pope is Catholic" is headline news.

  • Thank God my Credit Card numbers weren't breached, because those are impossible to cancel and replace. I'm so thankful it was only my Passport number, Driver's License number, social security number, full legal name, birth date, and address that were stolen, because those are a snap to cancel and replace.

  • inadequate (Score:5, Insightful)

    by harvey the nerd ( 582806 ) on Friday October 02, 2015 @07:21AM (#50643533)
    They need to make more reparations than that, as actual remedy, compensation and punitive damages with a positive, non govt funding goal.

    In corporatese, "I'm sorry" are empty words with no meaning without restitution and money.
    • Re:inadequate (Score:5, Insightful)

      by gstoddart ( 321705 ) on Friday October 02, 2015 @07:40AM (#50643629) Homepage

      And as long as they have no legal liability for keeping this stuff safe, an insincere "I'm sorry" is all you will ever get. If corporations can hold your private data and have no consequences for having shit security, they will continue to do so.

      For a credit agency to store that much personally identifying information and be hacked tells me that agencies like this need to have some pretty severe penalties for shit like this ... because they have pretty much everything required to steal your identify.

      If we're going to entrust this data to these entities, we should sure as hell make certain we can actually trust them with it. And I would say that Experian has more or less demonstrated themselves to be incompetent to hold this information.

      It really is time to stop letting companies treat this as "their" data, and realize they have an obligation to safeguard our data, and to be legally responsible when they fail to do so.

      • How about sourcing the credit / identity from something other than the data elements that keep getting stolen - and I'm not delusional enough to suggest biometric data.
        • by HiThere ( 15173 )

          But what are you suggesting?

          The problem is, if they can transmit the validating information, it can be stored and copied...and thus lost. That's the real reason all biometrics are an inherently bad idea.

    • There is no remedy for laziness/ineptness. Anything done will probably be short term due to management priorities changing over time. Experian has been advertising their credit monitoring services on TV in the US. A bit ironic, I think.
  • Identity Theft (Score:5, Informative)

    by Jason Levine ( 196982 ) on Friday October 02, 2015 @07:23AM (#50643537) Homepage

    As an identity theft victim, let me say that "no credit card or banking data was stolen" means nothing. With name, address, SSN, and birth date compromised (as well as driver's license and passport numbers), anyone can now open new lines of credit in the names of any of the 15 million people whose information was accessed. And the two years of "credit monitoring" will do almost nothing. Fraud alerts won't either - those are voluntary.

    My recommendation if you are one of the 15 million people is to freeze your credit [ftc.gov]. This will stop ANYONE from opening a new line of credit under your name unless you first thaw your credit file. It's a royal pain in the rear when you need to do things like refinance a loan, but it's better than having a collections agency banging down your door because you owe $5,000 on a credit card that "you" opened.

    • Re:Identity Theft (Score:5, Interesting)

      by gtall ( 79522 ) on Friday October 02, 2015 @07:36AM (#50643601)

      I second this advice, I did this several years ago. It should be noted, however, that the three credit record agencies cannot prevent someone from getting credit in your name. The system relies on the intuition, and it is only that, that any self-respecting credit issuing entity will require a credit record (and a good one, at that) before issuing credit. If Joe's Bank and Bait Shop wants to issue someone a credit card in your name and doesn't give a flying rat's ass about your credit history, they are free to do this.

      There is no national system to prevent credit from being authorized in your name, even to aliens from other worlds.

      • Re:Identity Theft (Score:4, Interesting)

        by drinkypoo ( 153816 ) <martin.espinoza@gmail.com> on Friday October 02, 2015 @07:41AM (#50643631) Homepage Journal

        It should be noted, however, that the three credit record agencies cannot prevent someone from getting credit in your name.

        Yep. A shady car dealer in Nevada City gave an illegal with my SSN written on a check cashing card credit in my name, and now it's on my credit report. The whole idea that this can even happen is proof that the system is broken. I shouldn't have to appear to fight this, no court should have granted a judgement on the basis of a CHECK MART card with my SSN written on it in pen.

        • Yours isn't the scenario we're talking about. If your credit record were frozen, they wouldn't be able to pull a report and thus wouldn't be able to put a ding on it. If you did freeze it and they let some random person put this on it, you should be suing that credit agency for libel.
      • by cdrudge ( 68377 )

        It should be noted, however, that the three credit record agencies cannot prevent someone from getting credit in your name.And apparently for 15m people, at least one of the three credit record agencies may be assisting others getting credit in your name...

      • There is no national system to prevent credit from being authorized in your name, even to aliens from other worlds.

        Agreed; indeed both my immediate neighbours were recently granted credit and they're gelatinous CO2-respiring life-forms from out of town. Curiously, I've been repeatedly turned down, despite paying-off every one (of fifteen credit records) loan, hp agreement etc. with only two missed payments since my credit history began.

        I'm more interested in their ability to perform their core task of deter

    • Re:Identity Theft (Score:5, Insightful)

      by mrchaotica ( 681592 ) * on Friday October 02, 2015 @08:41AM (#50643989)

      My recommendation if you are one of the 15 million people is to freeze your credit.

      You know the best part? The best part is that in order to do that, you get to PAY A FEE TO THE SAME GODDAMN FUCKERS WHO LOST THE INFORMATION IN THE FIRST PLACE!

      1. Step 1: Collect everyone's personal information
      2. Step 2: Lose said information, forcing the victims to freeze their credit
      3. Step 3: Charge the victims $5-10 each to do that freeze, and another $5-10 each time each victim needs to thaw or re-freeze it, forever
      4. Step 4: profit, over and over again!

      (There is no "..." step; this is actually Experian's business plan!)

      • Don't forget that you need to pay each of the three major credit agencies. Also, if you're married and applying for a loan, your spouse and you need to pay separately. If my wife and I want to thaw our credit, it costs us $30. Awhile back there was a bill in Congress that would have made it free to freeze your credit, but the credit agencies, credit card companies, etc all lobbied against it. They see frozen credit as lowered profits (since you can't open new lines of credit on a whim). The rash of ide

    • by Alumoi ( 1321661 )

      With name, address, SSN, and birth date compromised (as well as driver's license and passport numbers), anyone can now open new lines of credit in the names of any of the 15 million people whose information was accessed.

      And that's why in backworld countries you are required to provide some government issued photo ID when you open a bank account. Just saying.

  • 8ts (Score:1, Offtopic)

    Experian Breached, 15 Million T-Mobile Customer's Data Exposed

    The apostrophe should go after the 's'.

  • Experian (Score:5, Interesting)

    by internerdj ( 1319281 ) on Friday October 02, 2015 @07:36AM (#50643605)
    One of the three major credit rating services? I'm a little bit impressed that this breach was limited to only everyone who has ever applied for T-Mobile service.
    • Re: (Score:3, Insightful)

      by jhecht ( 143058 )
      How do we know it WAS limited to people who applied for T-Mobile service? It took Experian two years to find the breach in the first place.
    • It wasn't limited to T-Mobile customers, although those accounts were the majority of what was stolen from Experian.
  • Fuck You, Experian (Score:5, Insightful)

    by drinkypoo ( 153816 ) <martin.espinoza@gmail.com> on Friday October 02, 2015 @07:39AM (#50643619) Homepage Journal

    Guess what they're not giving you? Your actual credit report. You just get the abbreviated version, so you can't actually look it over and see if this generally corrupt industry is fucking you. They will, however, sell you your credit report at a special members-only price. So what's happened here basically is that Experian is getting free advertising and T-Mobile is going to get off without punishment.

    Fuck you Experian, and fuck you T-Mobile.

    I already said fuck T-Mobile since they cancelled the PAYG plans I've been using, but fuck them twice now.

    Are there ANY US mobile providers from whom I can buy a PAYG SIM which are not total fucks?

    • by swb ( 14022 ) on Friday October 02, 2015 @08:07AM (#50643763)

      None of this should be surprising. The credit reporting services are in business to please their customers, the credit issuers. People who apply for credit are part of the product.

      I would even go so far as to argue that the credit reporting agencies have an incentive to make your credit report as bad as possible, since the worse the report, the higher the interest rate you get charged for borrowing money. And the good news for creditors is that it doesn't force them to be more competitive, since they're all competing against the same view of your creditworthiness. Erring on the side of reduced creditworthiness lets creditors charge a higher interest rate for a risk that isn't elevated.

      My conspiracy minded side says this is why erroneous credit data is hard to remove and why credit reporters want to use non-financial correlates (like driving records) as part of your credit score -- something you can't ever get removed yet makes your credit report look marginally worse, thus making you a more profitable creditor via higher interest rates.

      • by ftobin ( 48814 ) *

        Lenders want to lend. If the credit-worthiness data does not correlate well with ability to repay, lenders cannot efficiently lend and will look for a different service. The number of participants in this space might make this a slow change, but normal market competitiveness has the opportunity to have effect.

        • Lenders want to lend. If the credit-worthiness data does not correlate well with ability to repay, plausible deniability is a perfectly adequate substitute

          FTFY

        • by swb ( 14022 )

          If the credit-worthiness data does not correlate well with ability to repay,

          None of this changes the desire of the lenders to charge more profitable interest rates nor the desire of credit reporting agencies to have their scoring seen as more profitable. Since lenders are inherently risk-averse and profit-oriented, they have an incentive to lend at the interest rate that represents the highest possible risk and highest possible profit.

          There's almost no way for a credit reporter to lose by reporting clients as worse risks than they really are. If a lender has a loan go bad and the

    • Each of the major credit reporting agencies must supply you a complete credit report annually upon request. Come on, this is not new.

      https://annualcreditreport.com... [annualcreditreport.com]

      • Each of the major credit reporting agencies must supply you a complete credit report annually upon request. Come on, this is not new.

        https://annualcreditreport.com... [annualcreditreport.com]

        Technically, that is true. I've got mine in the past this way. But is there a penalty if they do not comply?

        The Credit Agenccies make it a total pain to get the free report, and try to up-sell you crap left and right. I've had them give me "high traffic; try again later" a few times, too.

        I ordered mine, on paper, two months ago. None have yet arrived.

        • Yeah, I ordered one once, I never got it, I didn't bother to try again. It's all just a scam to sell you shit.

    • Are there ANY US mobile providers ... which are not total fucks?

      No.

      There are only varying degrees of total fuckishness and, as far as I can tell, T-Mobile is the best of the bunch. Maybe you can find a trustworthy local MVNO, but even then most of the money you pay them will still be supporting one of the big 4.

    • by msimm ( 580077 )

      Are there ANY US mobile providers from whom I can buy a PAYG SIM which are not total fucks?

      Cricket Wireless (subsidiary of AT&T [wikipedia.org]) and MetroPCS (partnered with T-Mobile [wikipedia.org]) provide pay-as-you go service for both companies.

      I've used both since I bought a off-contract phone and had no problem with either. I settled with Cricket because of coverage where I'm living in central Texas.

  • I sense a disturbance in the Magenta Force, as though millions of teenage girls cried out at once and then, nothing.
    • Geez, the Magenta Mafia downmodding is harsh... But I stand by it, because as we know, Real Men (TM) use Sprint, just to prove they can suffer like Sisyphus and by God take it like men.
    • Does this actually have anything to do with T-Mobile? From the sounds of it, it's Experian that was breached, and the attackers mostly (though not exclusively) took TMo subscriber info. TMo's own security wasn't compromised.

      I suppose you could argue that TMo should have gone with somebody more responsible / secure than Experian, but is there actually any such entity that provides the necessary services? As low as Experian sets the "not complete shit" bar, are the other credit agencies actually any better? T

  • by Anonymous Coward on Friday October 02, 2015 @07:48AM (#50643675)

    One of the best things that can be done to prevent data breaches is require that data be deleted after a certain time. I don't see a good reason why 15 million customers should have their data retained after the credit check is complete. It won't stop breaches, but it would limit their scope. There also needs to be severe penalties for negligent security or failing to notify customers in a timely manner. Better yet, eliminate social security numbers for identification altogether outside of social security and (maybe) tax purposes. And it's no surprise that a credit bureau was attacked. They're gold mines of information waiting to be compromised. I'd like to see particularly strong regulation of these companies. Consumers don't really get to opt in, but this personal information is stored and can be compromised easily. That doesn't seem fair at all to me.

    • Does it really matter how long the data is being stored when it's being actively stolen over the course of two fucking years?
    • by ftobin ( 48814 ) *

      One of the best things that can be done to prevent data breaches is require that data be deleted after a certain time. I don't see a good reason why 15 million customers should have their data retained after the credit check is complete.

      Credit scores reasonably include attempts to acquire more credit (which is what most phone contract really are, even if month-to-month), so it wouldn't be possible to delete data after a credit check is complete.

      Note: it is possible escape the credit-check part of the equati

    • The credit bureaus need to keep identifying information on everyone. Otherwise, they couldn't keep credit ratings up to date, and they couldn't even give my score to anyone as they wouldn't know that that was my score.

      It appears that what was leaked was identifying information, which they really have to keep.

      My Social Security number is fine for identifying me. It really, really sucks at verifying that I'm me. The idea that someone who knows the number I am required to tell many different people mus

  • seems every year the thing to do is open a T-Mo account, "buy" an iphone and resell it before it's bricked for not paying the bill
  • Go to all 3 reporting agencies and lock them down. It only takes a little time per agency and will save you years of headaches later. If you need to apply for credit unlocking is just as easy. You can choose a time frame or a specific company to allow through.
    • "Fees vary based on where you live, but commonly range from $5 to $10'

      Wonderful how these Aholes can charge us to freeze our credit, and then charge us to unfreeze it.

  • by Anonymous Coward on Friday October 02, 2015 @08:32AM (#50643931)

    Experian is offer a two year free credit monitoring in connection with the breach of their system. In order to sign up for the two year credit monitoring they require you to provide your full identity; SS number, birth date, etc. Isn't that just the information that was just compromised in their system??? How do they think they can be trusted??? This does not resolve the problem of their lack of network security with sensitive information.

  • Make PII Go Away (Score:4, Insightful)

    by Archwyrm ( 670653 ) on Friday October 02, 2015 @08:38AM (#50643979) Homepage
    It is high time the abuse of the Social Security Number ended. SSNs should be used for one thing: Social Security. Using a single "secret number" is an archaic system that for increasing numbers of people is no longer secret. Let's not forget all your other details which are used to identify you but aren't really that secret (your full name, your birthday, etc).

    This information is used for identifying a person or proving identity so it's an authentication problem. We can do better! We have public key encryption. The government issues you a key pair (say, embedded into a photo ID, which we all have already) and now you can prove your identity without giving someone an irrevocable secret.

    Authentication is also two factor: You have an ID and you know a PIN (or passphrase). If you lose your card, then your identity is not immediately compromised because it is protected by your PIN. This gives you time to have the gov't revoke your old key pair and issue you a new one.

    In the case of the credit bureaus (I think we can all safely assume credit isn't going away any time soon), they associate your credit history with your public key and nothing else. If the key is revoked (by the gov't), then they move your file to the new key. No one can take out credit using the old key. In fact, any attempt could be reported to law enforcement.

    The entire US Department of Defense has been using a system like this for years now and has by and large done away with things like passwords and hand signatures, especially for the things that matter most.

    Is this completely foolproof to prevent someone impersonating you? No, but it is much better than having your SSN and other PII out on some forum where just anyone can use it for nefarious purposes and would be well worth its cost and complexity. The greatest obstacle is the credit bureaus having nothing to gain in actually protecting their "customers'" data because then to whom will they sell credit monitoring?
    • Most people can deal with a number on a piece of paper. Most people are going to have real problems with handling a private key, having it available whenever desired while keeping it secret even if their computer is taken over and not losing it.

      • The key pair is embedded on a chip in your ID. The circuitry does the decryption, so the private key is never exposed to any computer that it is used with. This is also the point of the passphrase/PIN. The chip won't decrypt without it. This is how the smart cards used by DoD function and they double as a military ID (which is supposed to be kept on the owner at all times practical). They really are Idiot Resistant.

        The drawback is that most computers these days do not have a smart card reader. USB would
  • by idontgno ( 624372 ) on Friday October 02, 2015 @08:46AM (#50644031) Journal

    "15 million". Huge number. It usually takes the power of the US Federal Government [wikipedia.org] to screw up this big.

    But one thing is not clear from TFA, let alone from the slightly misleading TFS.

    This is an Experian hack, not a T-Mobile hack. What makes any "expert" think the exposure is limited to someone who interacted with T-Mobile? Experian is one of the awful ubiquitous unavoidable facts of life, much like the Government (see above). If you have participated in any non-cash financial transaction, they probably have a file on you.

    What are the particulars of this breach that make it strictly an "Experian interacting with T-Mobile" risk? Experian is huge, and if you're counting on some kind of strict internal data partitioning within the company to restrict the attack area to "T-Mobile applicants" you're too naive to sit with the grown-ups.

    Seriously. Why the fuck isn't this a maximal-sized no-holds-barred every-file-Experian-holds breach?

    • Re: (Score:2, Informative)

      by Anonymous Coward

      Experian partitioned clients apart from one another. The breach hit their T-Mobile systems, which is why they are mentioning it only affects T-Mobile customers. But, you are right not to trust Experian, if it happened to one of their systems it could be happening as we speak to any other of their clients. It could also be happening to any of the other credit partners or banks as well and we'll find out in the coming years. My father used to work for a large bank, he would always tell me stories of breaches

  • Good news everyone! The bad guys only got things like your SSN, which can never be changed and which will haunt you forever, but not the credit card numbers which can easily be replaced and you probably wouldn't be liable for any illicit charges on, anyway.
  • These breaches are a good thing, because they are forcing evolution.

    Something we in IT have always known, is that security cannot be solely applied through obscurity. There will always be opportunity, tools and motivation that expose it.

    This has never translated into other information sensitive disciplines, and right at this moment we have a tremendous amount of fragility in our financial and personal identification infrastructures because there is no concept of authentication.

    That has to change. More of

    • No matter how many times these breaches happen, we won't "evolve" a response because there are big financial companies whose profits rely on accumulating and easily accessing our credit files. Those companies will use their lobbying might to kill any reform bills that even slightly smell like they might slightly inconvenience them in the pursuit of protecting people. They might allow some useless "feel good" legislation to pass, but you can be sure they won't let any consumer protections "evolve" because

  • "T-Mobile's Credit Partner, Experian, has been breached revealing names, addresses, Social Security numbers, birth dates and driver's license and passport numbers"

    What I want to know is - in this day and age - what this data was doing on a server, connected to the Internet in an unencrypted form.
  • I went to the Tmobile site and what happened?

    I got a popup saying "T-Mobile wants to know your location"

    How fucking ironic.

  • It seems to me if it's been going on for 2 years, Experian hasn't been doing the job to secure our data. They should be facing some criminal charges or fines over this. Better yet; they should shut down. This is very gross incompetence. What's the two years going to do? "Oh, someone is using your data. LOL. Sorry." That's pretty much all they're going to do. They're not going to help solve a problem they are responsible for. They need to be held responsible; by someone. 2 days I could understand; 2 years i
  • The Washington Post reports that T-Mobile's Credit Partner, Experian, has been breached revealing names, addresses, Social Security numbers, birth dates, driver's license and passport numbers

    ...

    Both parties were quick to point out that no no credit card or banking data was stolen as part of the attack

    Great, so the banking and credit card data--which would only lead to fraud for which the individual would not be held accountable--wasn't stolen. But all the most valuable data for applying for fake credit and identity theft was! Much harder to fight off fake accounts then fake charges on a valid account.

    This should go beyond just two years of free monitoring... what do I do when someone is out there impersonating me? Hope I have an alibi when they come looking for mr, but that's sort of tough to do

    • This should go beyond just two years of free monitoring... what do I do when someone is out there impersonating me? Hope I have an alibi when they come looking for mr, but that's sort of tough to do when you're a basement dwelling hermit...

      I'm an identity theft victim, albeit a lucky one who caught it early before too much damage was done, and it was scary when someone opened a credit card in my name. What's scarier, though, is if a criminal is arrested and gives your name/SSN/DOB. I used to read the blog [blogspot.com]

    • by HiThere ( 15173 )

      The hideous thing is that identity theft doesn't even need to be intentional. My wife got hit with the bill for a MAN who died in a hospital in a different city. They had the same name, but no other similar characteristics. And it STILL took years to fight through. The bank the hospital used sold the debt to a collection agency (well, more than one, actually) who wouldn't even take a death certificate as proof that she wasn't him.

      Say something bad about the financial credit system and I'll believe it wi

      • by Cederic ( 9623 )

        The bank the hospital used sold the debt to a collection agency (well, more than one, actually) who wouldn't even take a death certificate as proof that she wasn't him.

        Why bother to prove it to them? You've told them, they ignored you, what are they going to do next? Absolutely nothing unless they want suing into oblivion.

        • by HiThere ( 15173 )

          Because it goes into your credit history...and to get them to stop calling every half hour. (I exaggerate, but that's what it felt like.)

          • by Cederic ( 9623 )

            If it goes in your credit history, they've told lies about you. Sue them.

            If they keep harassing you, ask the police to arrest them for harassment.

            • by HiThere ( 15173 )

              I don't have a lawyer on retainer, so suing them would have cost me quite a bit. And it did, eventually, get straightened out. (I *was* thinking of suing them before we finally straightened things out, though. But collection agencies are in a different state...if they tell you where they are. They intentionally don't make things easy, as if you just pay them off they win.)

  • Thank God that only things like Social Security numbers were stolen - easily replaceable things like credit card numbers are still safe. Whew!
    • Whenever I talk to my father about my identity theft and subsequent credit freeze, he tells me I should just change my SSN. Apparently, you *can* do that. However, it's not an easy process and I'd need to contact anyone who legitimately* has my SSN to update that. Once again, a criminal can do damage in one hour that the victim will be cleaning up for years.

      * SSNs shouldn't be used as unique identifiers at all so read "legitimately" to mean "they shouldn't need it, it shouldn't be a unique identifier, bu

  • Shit. I guess this might have something to do with a number of places telling me my SS# is either invalid or "has multiple names attached" (Why are multiple names attached to a single number even allowed? I would think it should return an error since there is no legitimate use for multiple names tied to a single number).

    • "there is no legitimate use for multiple names tied to a single number"

      They are called 'aliases'. I have three IRL, all caused by misspellings in the past.

      One on a store credit app, somehow they could not get my five-letter last name correct. Ignats.

      One on a debt collection report for a university in a state I had never set foot in. When I asked for my academic records and diploma in exchange for a $200 bookstore bill, they relented and only called me every three years.

      One on a mortgage app, which to thi

      • Thanks for the explanation, nobody else I have asked has been able to explain to me why there can be multiple names on a single SS#.

        What have you done to try and correct this?

        I went to the social security office and waited in line for ages only for them to tell me that this isn't their department (What?) and they can't help me. The only advice I have received is to file a police report and expect nothing to be done unless this starts seriously affecting my life.

  • How about 2 years of high credit scores.
  • >revealing names, addresses, Social Security numbers, birth dates and driver's license and passport numbers for any customer

    but no credit card numbers or banking data (other than your names, addresses, Social Security numbers, birth dates and driver's license and passport numbers)

    >Experian is offering credit for two free years of identity resolution services and credit monitoring

    Were you really planning on living longer than that?!

  • It's now been 6 years since I've had to pay for credit reports because of all the breaches my data has been involved in.

  • At least, they have a sense of humor about it. "But no credit card numbers were stolen"? Who would need that after they have your SSN, full name, address, birthday, driver's license and PASSPORT NUMBER? That's enough to have any credit card you want. Wait, they don't have a sense of humor, do they? They are not kidding, are they? They really do think this cloud has a silver lining? Oh, what the hell. If the Secretary of State can send emails through an unsecured server, and the IRS has a 6-month's d

"Consider a spherical bear, in simple harmonic motion..." -- Professor in the UCB physics department

Working...