Equifax Breach is Very Possibly the Worst Leak of Personal Info Ever (arstechnica.com) 401
The breach Equifax reported Thursday is very possibly is the most severe of all for a simple reason: the breath-taking amount of highly sensitive data it handed over to criminals. Dan Goodin of ArsTechnica writes: By providing full names, Social Security numbers, birth dates, addresses, and, in some cases, driver license numbers, it provided most of the information banks, insurance companies, and other businesses use to confirm consumers are who they claim to be. The theft, by criminals who exploited a security flaw on the Equifax website, opens the troubling prospect the data is now in the hands of hostile governments, criminal gangs, or both and will remain so indefinitely.
Hacks hitting Yahoo and other sites, by contrast, may have breached more accounts, but the severity of the personal data was generally more limited. And in most cases the damage could be contained by changing a password or getting a new credit card number. What's more, the 143 million US people Equifax said were potentially affected accounts for roughly 44 percent of the population. When children and people without credit histories are removed, the proportion becomes even bigger. That means well more than half of all US residents who rely the most on bank loans and credit cards are now at a significantly higher risk of fraud and will remain so for years to come. Besides being used to take out loans in other people's names, the data could be abused by hostile governments to, say, tease out new information about people with security clearances, especially in light of the 2015 hack on the US Office of Personnel Management, which exposed highly sensitive data on 3.2 million federal employees, both current and retired. Meanwhile, if you accept Equifax's paltry "help" you forfeit the right to sue the company, it has said. In its policy, Equifax also states that it won't be helping its customers fix hack-related problems.
UPDATE (9/9/17): Equifax has now announced that "the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident."
Bloomberg reported on Friday that a class action seeking to represent 143 million consumers has been filed, and it alleges the company didn't spend enough on protecting data. The class-action -- filed by the firm Olsen Daines PC along with Geragos & Geragos, a celebrity law firm known for blockbuster class actions -- will seek as much as $70 billion in damages nationally.
UPDATE (9/9/17): Equifax has now announced that "the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident."
Bloomberg reported on Friday that a class action seeking to represent 143 million consumers has been filed, and it alleges the company didn't spend enough on protecting data. The class-action -- filed by the firm Olsen Daines PC along with Geragos & Geragos, a celebrity law firm known for blockbuster class actions -- will seek as much as $70 billion in damages nationally.
Too late for me (Score:3)
Re: (Score:2)
Yea. That one was worse because the potential to have finger print data as well.
Re: Too late for me (Score:3, Insightful)
Frankly, too late for most of us.
However, the article kind of hints at the problem: these companies all revert to this as identification. And often, the same stupid security questions (seriously, you think someone couldn't figure out my mother's maiden name from a basic search of several sites? Or use most people's Facebook to figure out where they were born or the name of their high school?)
While the proliferation of security bugs is worrisome, with it seems like a new security failure every couple months
Re: (Score:2)
Why bother with the question then, instead of just "what is your backup passphrase"? The answer is because by and large people take the easy way out on that and elect to have a hint to jog their memory. With so many companies all using the same questions, this ends up becoming a viable attack vector.
Those that allow custom questions are doing a better job: if you can give yourself a different hint, not only does that help you use a more diverse range of answers, it also tells you whether the person challe
Re: (Score:2)
Ouch...man, you need to renegotiate....someone is getting WAAAAAY too much of your bill rate for federal IT work with a clearance.
You should be pulling in 6 figures for that.
Re: (Score:3)
But russia hacked the DNC, so impeach Trump!!!!
Seriously, the reaction to these "hacks" is so imbalanced. The OPM hack, while not as large as Equifax, included much more detailed information on subjects. I consider at this point that the information that Equifax has on me is "public." Considering all of the letters I have gotten from the VA, OPM, Target, Home Depot, etc...
Re: (Score:2)
But russia hacked the DNC, so impeach Trump!!!!
Get over yourself. Trump would need to have some complicity with Russia's activity in the election for it to be an impeachment issue. And that's what Robert Mueller is investigating. Let him finish his work. Then it's up to Congress to decide on impeachment.
Re: (Score:3, Funny)
That's it. I'm done with Equifax (Score:5, Funny)
Oh wait.
Re: That's it. I'm done with Equifax (Score:5, Insightful)
Maybe these types of incidents can break down reliance and acceptance of these credit agencies that have established themselves as critical and non-optional services that heavily effect major life events (e.g., home purchaes).
They make money from using our information, provide little benefit to us, and hold almost no accountability when they're wrong but can and often do horribly effect consumers lives based on data they provide--even when it's inaccurate.
Re: (Score:2)
Maybe these types of incidents can break down reliance and acceptance of these credit agencies that have established themselves as critical and non-optional services that heavily effect major life events
But it won't because the institutions that rely on these agencies don't give a damn. They don't lose anything over it. Anything goes wrong and the government will bail them out and leave us holding the bag.
Re: (Score:3, Insightful)
If the government is going to bail them out any time they lose money, their "risk" is exactly zero.
Which is exactly what happens. What are you getting at? Equifax sells snake oil, and make a pretty penny for it. There are suckers at every level.
Re: (Score:2, Insightful)
Re: (Score:2)
I'll push back (Score:5, Insightful)
They make money from using our information, provide little benefit to us...
I'll bite. I agree that, as individuals, it doesn't feel like they provide a benefit. But by providing somewhat-accurate financial history to lending institutions, those lending institutions can more precisely estimate the risk associated with each loan. In doing so, they're able to lend more money, and at lower interest rates, than they'd be able to do otherwise.
I'm not arguing that there aren't loads of ways that Equifax et al could improve their business habits. Of course there are. But without these agencies, lenders would have a more difficult time gauging credit-worthiness, and that would mean it would be harder and more expensive for each of us to get a loan. And that, my friend, is the "benefit" provided to us.
Re: (Score:2)
Re: (Score:2)
You're not using credit enough.
Re: (Score:2)
If you have credit card debt or auto loan debt, or student debt, or basically anything other than a proper mortgage or business debt (tied to an LLC, not you individually), you're seen as a leech.
Re: (Score:3)
I'm not sure about your case, but at one point I investigated why my credit score wasn't higher. In my case, the issue was basically that I didn't have enough credit cards. Part of the calculation involves the total amount of credit you have available.
If you and I have the same income, same debt, and have made all the same payments, you might imagine that our credit scores would be the same. However, if I have 3 credit cards with a total credit line of $10k available to me, and you have 5 credit cards w
You are not the customer (Score:3, Interesting)
And getting rid of the credit agencies won't have the effect most people seem to think it will. Lenders won't magically assume everyone is credit-worthy if there's no way to check people's credit. They're going to assume everyone is not credit-worthy. In other words, getting rid of credit reports won't make it easier for people with poor credit t
Re: (Score:3)
getting rid of the credit agencies won't have the effect most people seem to think it will.
Correct, yourself included.
Lenders won't magically assume everyone is credit-worthy if there's no way to check people's credit. They're going to assume everyone is not credit-worthy.
No! Most lenders won't make any assumptions at all they will do what was traditionally done they will determine if you have connections in the community, check into your reputation with past lenders and maybe even your pastor, get documentation from you about your income, its sources, etc, maybe drive past your house to see what your expenses really look like...
Slow, painful, and expensive as that process may be the would do because not lending means they don't make any money!
Unless you can prove you have enough money in the bank to cover the loan or collateral.
Ag
Re: That's it. I'm done with Equifax (Score:4, Informative)
One way to protect yourself (to a certain degree) is to put a lock on your personal information with each of the three credit-reporting companies (Experian, Equifax, and TransUnion.) That way, nobody can access your information unless you lift the lock, either selectively, or for a finite period of time. Some of the agencies charge money (typically $10) for such a lock, or to lift it temporarily, but it's worth it IMHO.
Re: (Score:3)
One way to protect yourself (to a certain degree) is to put a lock on your personal information with each of the three credit-reporting companies (Experian, Equifax, and TransUnion.) That way, nobody can access your information unless you lift the lock, either selectively, or for a finite period of time. Some of the agencies charge money (typically $10) for such a lock, or to lift it temporarily, but it's worth it IMHO.
It was... If someone now has every piece of information that Equifax has for you, they can probably lift the lock, as well.
Give it time. (Score:5, Insightful)
Equifax Breach is Very Possibly the Worst Leak of Personal Info Ever so far.
Re: (Score:2)
Equifax Breach is Very Possibly the Worst Leak of Personal Info Ever so far.
It will be very hard to top this. In this case we have half of a population with personal info detailed enough to effectively steal identity in multiple ways, of a group of people who have no business with the company, and who may not know that their personal information is part of it. That is the real problem here. The sheer size and almost covert scope given that none of these people are customers of Equifax and I'm sure nearly all people have no idea who this company even is.
About the only thing that cou
Re: (Score:2)
credential theft (Score:5, Insightful)
Hackers aren't stealing identity, they are stealing credentials (so as so assume an identity, if the world makes this easy for them to pull off).
Institutions want to pretend that credentials = identity, so that if they give your money to the wrong person, it's your fault (your identity was stolen, what else could we do?) rather than their fault (their chosen system of credentials sprung a leak, causing them to misidentify some loser as the real customer).
Finally, a big enough leak that maybe some people will begin to comprehend the distinction here.
Re: (Score:2)
It will be very hard to top this.
Challenge accepted!
Re: (Score:2)
Equifax Breach is Very Possibly the Worst Leak of Personal Info Ever so far.
I've spotted the time traveler.
Send 'em to jail (Score:5, Informative)
The equifax executives apparently sold stock immediately after learning of the breach. Jail them all for incompetence _and_ insider trading.
Re: (Score:3, Funny)
Re:Send 'em to jail (Score:4, Insightful)
> They clearly weren't incompetent at insider trading....
Actually they were. They got caught. They did the insider trading version of vastly upgrading your homeowner insurance policy the day before you set your house on fire to collect the insurance.
Re: (Score:2)
but they're rich & well connected. we must protect them.
Re: (Score:2)
I don't believe you and would like to see actual proof. Executives are not allowed by law to sell stock unless pre-announced in an SEC filing. If what you say is true, the sale was either legal under SEC rules or a complete and obvious violation of them.
Re: (Score:2)
On the other hand, because the executives involved were the CFO, president of U.S. information solutions, and president of workforce solutions, this looks suspect. You would think the president of U.S. information solutions would have been informed of the breach immediat
Re: (Score:3)
Did they sell before the news went public, or after?
From what I read... The execs learned of the breach, sold and then it went public.. So, f'em... Toss the whole book at them.
Re: (Score:2)
Are those police boats?
Hopefully this will be the end of equifax (Score:5, Insightful)
Re: (Score:2)
I'm not defending them, but how else would you propose preventing someone from running up a whole ton of debt, skipping out on it, and then doing it again at another creditor? The best way is to have some sort of equal-access clearinghouse of information on consumers.
The problem is that people are sometimes irresponsible. It's not even just regular consumers...many business owners and wealthy people just go around starting companies, load them up with debt and bankrupt them. That's allowed under the current
Re:Hopefully this will be the end of equifax (Score:5, Informative)
how else would you propose preventing someone from running up a whole ton of debt, skipping out on it, and then doing it again at another creditor?
Like they do in every (?) other country: you go to a bank, show them your bank statements for the last few years, you tax statements, your job contracts, your current house mortgages and anything else they ask, and THEY decide on what kind of loan to give you based on that info. Oh, and yes, having a state-backed ID card helps against you running away and trying somewhere else. No centralization: too much power, too much risk and nothing to gain for the customer anyway.
Re: (Score:3)
Re: (Score:2)
The first "hard" pull will have a slight effect on a credit score. But multiple hard pulls do not have an effect greater than the single. They known people shop around for a good rate, and they don't punish people for it.
Re: (Score:2)
The equifax main site sends users to https://www.equifaxsecurity201... [equifaxsecurity2017.com] which points to https://trustedidpremier.com/e... [trustedidpremier.com] which then asks for a last name and 6 digits of a social security number.
Comment removed (Score:5, Informative)
Re: (Score:2)
If a person is on the black list (late payments) they will not be allowed ANY credit.
That's a bit harsh, no? I've been late on payments once or twice and I'm not even struggling financially. It's easy to forget the due date or mixup the amount. Can't imagine how bad it would be for someone who has several credit cards.
Re: (Score:2, Informative)
That means government regulation (Score:2)
Re: (Score:2)
I hope, in my lifetime, that I see a US govt. with balls, who starts representing We The People, and our privacy becomes #1.
I suspect that in my lifetime I may get to see a government with balls who starts representing We The People, I just think it won't be called the US government. Things can't keep going the way that they are going, something will have to give. My personal hope is for a peaceful fragmentation of the US. It will allow the liberals and conservatives to go their separate ways in peace. With a bit of luck one of the two (maybe even both) will represent We The People.
It's time for regulation. Sorry to say it. (Score:5, Insightful)
We have PCI-DSS for companies that deal with credit card information. Why not for companies that store even more sensitive information that potentially allows a criminal to pretty much take over my life by essentially stealing my identity?
The damage here is way more serious than ANYTHING the loss of a million credit card numbers could mean. Could it be that it's just us that have to foot the bill instead of Visa and Mastercard?
No, that can't be. Government represents the people, right?
Fuckers, I hope some Supreme Court judge alongside of a few congresscritters get hit badly with this breach. I usually don't wish bad things to happen to anyone, but I really hope that one of them has their identity stolen, their credit rating trashed and their life basically ruined by this hack.
Because ONLY then we'll FINALLY see something happen.
Re: (Score:2)
Government represents the people, right?
97% reelection rates say, yes, the government does represent those who vote.
Re: (Score:2)
Government represents the people, right?
In theory, yes. In reality, government represents their corporate owners.
Re: (Score:2)
We have PCI-DSS for companies that deal with credit card information.
Yeah because *that* works so well. [crn.com]
Relevant quote:
"I'm not surprised to see another large credit card breach; they will continue to happen because the impact is not a large one to the business," Doten said. "Being PCI-compliant doesn't make you secure; it only protects you from the lawsuits."
Re:It's time for regulation. Sorry to say it. (Score:5, Interesting)
No regulation would stop this. Computers are enormous and complex; either Equifax writes in-house software or hires out for someone to write their software; and credit reporting agencies are dealing with a unique business situation requiring some kind of unique front-end to their clients. Even Windows, Linux, Oracle, Adobe, and Chrome have security bugs.
Regulation can't prevent them from putting forth all due diligence and still failing. Equifax was founded in 1899 and has been the front-line CRA for decades; they got the tech first, they got the Internet services first, they got the Web sites first, and now they got hacked first. It's been a long time coming and they've gotten hacked once. You can't stop that.
You want security against identity theft? Here it is: hardware identification. U2F devices--I hate them, rant in a minute--can identify a user without relinquishing a key. You want to know I'm who I say I am? Then I register with Equifax, I give them an identifying key, I authorize your credit check with my key. You can't hack that. It's unhackable, or else somebody has figured out how to break encryption that should not be breakable yet--in which case nothing is safe.
I would not be above passing legislation specifying that a person's credit history cannot be impacted by non-challenge-response, user-presence-based authentication in line with modern standards. That is: you have to have something that can be handled entirely in the open and still not allow impersonation, such as RSA or Ed25519 challenge-response exchange with a secure hardware device. These devices cost all of $20 at the lowest end.
If the banks want to go ahead and verify your ID by other means, that's fine; and when you have presented your case in dispute and filed for small bankruptcy, we bail you out of only those unauthenticated accounts, and don't mark it on your credit history, at all. They can validate your identity later and confirm those accounts only with your informed consent.
Lost your key? Call your bank; all banks are required to file a Lost Key hold for anyone with a credit account with them, which freezes all your credit. You have to show up to a bank, present valid ID (e.g. a real Driver's ID), and then prove you still have your key or provide a new key to re-establish a trust relationship between you and the CRA. No verbal verification; you physically come here and show me your ID, or you're full of shit and have a print-out of stolen Social Security numbers at your desk.
The states or the SSA could supply similar attestation, with those smart chips (they're actually miniature computers, in full) embedded into multi-layer polycarbonate Driver's IDs and Social Security cards functioning as U2F devices with a trust relationship to the Government agency. These cards are tamper-proof: your photograph is laser-etched into a mult-image across multiple polycarbonate layers. You're not going to clone someone's Driver's ID with a non-readable private key inside, not without stealing the original Driver's ID. If your state supplies this, you can easily attest to your bank that you are in fact holding a real Driver's ID, and they can verify who you are, and you can use your own personal security key device to set up a trust relationship to the CRA and not to the bank (again: the CRA is authenticating you; it's working on your behalf, not on the behalf of the bank).
As for why I hate U2F devices? Yubico built them right. They use secure hardware--specialized, physically-unhackable without some serious high-end equipment, and potentially impossible to get into without destroying it unless you can remove ceramic in atomic layers--and they accept a challenge, then issue a response. You have a parent key, which the device uses to create child keys, and then sends the certificate (public key) to whoever wants it. No exposure of the identity credential: you can only identify t
Re: (Score:3)
I've seen those kinds of places get hacked. It just happens almost-never. "Almost" means you still failed to stop it; it's an improvement, but it's not enough.
I would not install an explosive into the base of my skull and then place the trigger to detonate it on your network. Maybe it's nigh-on-unhackable, but it's not impossible. Your security means nothing to the attacker who walks right in the front door. In your case, maybe it takes someone who can actually understand your security--give me time
I think you're confused (Score:2)
I think the trouble here is Equifax has virtually no penalty here (save a few million paid out to lawyers in the inevitable class action, assuming the recent laws regarding mandatory Arbitration don't kick in which depending on when the breach happened they might). When you say regulation what you really mean are fines bigger than cost of actuall
A lot of people don't care about privacy (Score:4, Insightful)
Even if Equifax is found to have been careless with all that vital personal information, I doubt they'll get more than a slap on the wrist.
Why should corporations, government or the courts give a crap about people's privacy, when so many of the people themselves very obviously couldn't care less?
Re:A lot of people don't care about privacy (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
There's a big difference between 'ok, so the NSA knows who I've been having phone sex with and multiple people know what kind of porn I look at' and 'what do you mean I can't buy my dreamhouse? where the fuck did all these maxed out credit cards come from? I never opened those!'
This isn't privacy, this is identity, and folks will care alot more when it starts to effect them negatively.
Yay, more free credit monitoring fo rme. :-) (Score:5, Insightful)
Equifax and the 2 other credit bureaus have a ton of non-credit related information on consumers as well. It will be interesting to see what else was not reported as part of the breach.
I'm going to sound like an old fart, but a lot of these "cyberattacks" end up being down to a very dumb misconfiguration like leaving FTP open, failure to patch security holes, and things like leaving data on unprotected public cloud storage. Part of my job is being a technical mentor to some of our more junior staff, and what I'm seeing is a lot of developers and CS people who really don't know the guts of how IT works. I'm not saying people should go back to punch cards and assembler, but having some clue about TCP/IP, DNS, what an open port on a server means, how a firewall works, etc. would go a long way to preventing some of the dumber things I've seen. Most of this is very much abstracted, and in a "cloud-first" world it's even more so. The network is just assumed to work underneath everything else, and i think this is where a lot of the misconfiguration problems get missed.
We may or may not see what actually happened. It could have been some state-sponsored hacking group planning a painstaking attack requiring intimate knowledge of everything. But knowing what I know about corporate IT, it was most likely some lowest-bidder contractor being forced to pull another 12-hour shift and missing something. Until companies have to actually pay for these issues, all we're going to get is "free credit monitoring" for a year, which costs them nothing, and _maybe_ we'll get a check for 11 cents from a class action lawsuit 20 years from now when it winds its way through the system.
Re: (Score:3)
This philosophy is what's wrong with cybersecurity (Score:2)
That strategy is the digital equivalent of storing your valuables scattered throughout a mall, and then hiring enough mall cops on Segways to cover all the doors. Unsurprisingly, the right strategy is the digital equivalent of storing your valuables in a good safe, with one door that
Three executives sold 1.8 million in stock (Score:4, Interesting)
Re: (Score:3)
Re:Three executives sold 1.8 million in stock (Score:5, Insightful)
I'm not sure if that qualifies as insider trading
Of course it does. Any time an employee trades stock in the company he's employed by, that's insider trading because the employee is an "insider". Most of the time, it's perfectly legal.
From SEC.gov: [sec.gov] "Illegal insider trading refers generally to buying or selling a security, in breach of a fiduciary duty or other relationship of trust and confidence, while in possession of material, nonpublic information about the security." And that is what happened here, because the trading happened before the public was made aware of the breach.
Surely this marks the end of "SSN as passwords" (Score:3, Insightful)
So, as a result, the US loan industry is going to end their grossly negligent practice of using my Social Security Number as the root password to my financial life, right?
wish every single SSN would leak (Score:2, Interesting)
i keep hoping that every single SSN for every american will leak so that the SSN can no longer be used the way it is using now... i wish the breach would be much worse until enough SSNs are available to everyone and the SSN can no longer be used as a personal identifier
Re: (Score:2)
Business as usual... (Score:5, Insightful)
Re: (Score:2)
I'm sure nobody will be jailed.
I'm not. At least not for the data breach. The share sale on the other hand...
Didn't really need to store all that data (Score:3)
Re: (Score:2)
I realize the SSC is used as a primary key, but if you think about it, to do their job, they could have just stored a salted hash of the social security
The SSN is only 9 digits long. It's trivial to crack a 30-bit keyspace.
Use it as what it was meant to be - a public unique identifier, and not a secret. Its role is to separate John Doe from John Doe and John Doe, not anything else.
Re: (Score:2)
Re: (Score:2)
they could have just stored a salted hash of the social security number along with a plain text full name and address
I have a better idea. Store it in plain text and start treating the SSN like what it is: a unique number, not a authenticator, not a piece of private information, and not something of importance, not something that certifies you are who you say you are, and certainly not something that if anyone got their hands on would make anyone else think that you are any more you than they did before.
So, is it yet time to talk about actual security? (Score:3)
The breach is annoying. It's also almost an inevitable thing.
Can we *now* start talking about moving beyond "a ten-digit number and some generally publicly-researchable information is enough to do almost anything as you"?
I mean, seriously. Next year will be the 40th anniversary of the publishing of the RSA algorithm. Secure smartcards have been around for 25 of those years, and some countries have been issuing them for 15+ years now. Bit of biometric, and Alice is your digitally-signed aunt.
No... we're still in a country minting pennies and shuffling 19th century bank-draft checks around, aren't we? Oh, and the exact same people who are freaking out about 'Voter ID protects the sanctity of the vote' simultaneously go bat-guano crazy if you propose an actually secure ID card system.
Re: (Score:2)
The current situation is made worse by the fact that as the identity theft victim, you're the one who needs to prove it was fraud, rather than the bank needing to prove it was you who opened it, meaning you need to cough up lawyer money exactly when you have the least control over your finances.
And don't forget: (Score:2)
Easy fix (Score:2)
Not the worst breach (Score:2)
Back in the 1980's/early 1990's I knew several people who hacked CBI (Credit Bureau Inc) We used to hack the X accounts because accounts that started with an X were admin accounts.
Back then when you got one, you could see everything! Bank account numbers, credit card numbers, etc, etc. You could even change the information reported on a persons account.
So, once we had them we would sell "Corrections" to peoples reports AND some would even use it to card stuff. (Buy stuff on someone eases credit card)
Those b
Credit Freeze Pin's not random (Score:2)
Re: (Score:3)
Home Depot (Score:3, Insightful)
Can we just all finally agree... (Score:2)
That this type of info is basically public domain at this point, and any company using it to verify identity is being negligent?
Good thing we have consumer protections (Score:2)
143 million (Score:2)
Class Action Lawsuit (Score:2)
As long as 99.9% of the settlement goes to those who were affected I can get behind this. Unfortunately I know that a huge chun
I would pastebin it all. (Score:2)
Social Security numbers were intended for one purpose only, to identify the Social Security retirement account of individual citizens.
The fundamental security model of Equifax and the other credit agencies has always been broken. In my opinion the very best thing that could happen would be if a complete database of the names, addresses, birthdates, and social security numbers of every single US citizen was published and updated quarterly. The clowns at these credit agencies need to stop building an identifi
Equifax has had terrible security for years! (Score:2)
I generally use a custom, unique address for each domain where I register, and did the same when I registered with Equifax to get my credit report through the free annual credit report that we are entitled to receive.
Two years later (2011), I started getting lots of spam for the address that I had used ONLY for Equifax and nowhere else. They've had crappy security (and most likely a customer data breach) since way back when.
I even emailed their customer service to report this at that time and their response
I think this is just the beginning (Score:2)
Maybe I'm oversimplifying, but ... (Score:2)
...Equifax shouldn't survive this.
And the board of directors should be* held responsible for the management practices that allowed this sort of error to happen.
Ultimately, the buck needs to stop somewhere, that's why they get the very big bucks. I believe their CEO was paid $13.4 million last year. Taking that, plus the lush salaries of their board and other c-levels, would be a start.
*OK I'm even laughing as I type, knowing how unlikely this is
Yes, regulation CAN solve this (Score:5, Insightful)
...not perfectly, of course. A previous poster is correct that no system is perfect. But systems that are well-regulated can be pretty good. The airline industry used to drop planes as frequently as we hear about major data-breaches today: like every month. Now it's less than one per year, despite travel having increased over 10 fold.
We could be hearing about 1/100th as many data-breaches, as well. A bunch of financial services would get a little more expensive, but only a little, just like airline fares have not gone out of sight - they didn't even go out of sight after 9/11 when new regulations made flying more expensive. Just not much.
This company has NO reason to spend more money on security next year. Why would they? The actual financial consequences of this event are really quite minor for them. No fines, no lawsuits, and almost no compensation. (The "year of monitoring" will cost about as much as a coffee for each of the 1% that sign up for it.)
If Corporate Death Penalty were the consequence of an event like this, you'd see OpenBSD web sites with custom web servers written to only provide the application; you'd see humans paid to monitor the logs in real time, and more humans to watch them. You'd see the difference between how civilians do things and how the military do things, not caring that they spend a hundred dollars where a civilian would spend five. And you'd see some real results. Right now, failure is not just an option, its the cheaper one.
People prattling on about how "nothing could have prevented this" are exactly like those who said the same about the Titanic - until new regulations that were "utterly unaffordable" the day before Titanic were suddenly gospel: double-hulls were very expensive, watertight compartments that go 20ft above water line, enough lifeboats for everybody, 7x24 ice patrols, 7x24 wireless monitoring on every ship. All of that was "impossible" the day before Titanic. The security equivalent is still "impossible" here, because there is essentially no penalty for failure.
Not the worst (Score:2)
I disagree. I think that the federal domestic data collection programs constitute the worst leak of personal information ever.
Here's what bothers me... (Score:3)
Why was the system with everyone's SSNs connected to internet at all? Why was it not air gapped?! You don't need plaintext SSN included on anyone's credit report, it's only used for authentication (shouldn't be, but too late to change it now I guess). So why not treat it as passwords? As in, properly salted and hashed. And then you don't have to worry about it being stolen. Did they even hire any security experts when designing the system?!
Equifax Chief Security Officer unqualified (Score:5, Interesting)
Looks like Equifax's Chief Security Officer Susan Mauldin is unqualified for her position. She doesn't seem to have the necessary education or experience.
You could go to her LinkedIn profile to check yourself. Only problem is she deleted it.
https://www.linkedin.com/in/susan-mauldin-93069a
Thankfully, someone did a screen capture: http://i.imgur.com/QiXX3it.jpg
These will continue to happen (Score:3)
Unless and until the FTC starts fining these companies large enough fines to cause the execs to take notice, these breaches will continue and only get worse. Security is a process and a breach like this usually required multiple lazy or sloppy decisions just to make the exploit possible. These breaches aren't national state actors writing custom exploits. These are script kiddies trolling for sloppy systems they can exploit. And those systems wouldn't be exploitable by those kiddies unless the engineers and IT folks were being so lazy and sloppy with security. There aren't even good risk reward decision making on these issues. The attitude is if I can save 1 dollar by doing less security, we will. Until fines and criminal charges start becoming a real risk, companies will continue to be breached over and over again.
90 day fraud lock (Score:3)
I guessing, but I bet if everybody puts the 90 day fraud lock on the credit, all of the banks, lending institutions, and money based businesses will really feel the squeeze.
I understand the 90 day fraud lock is free.....
Re: (Score:2)
Re: (Score:2)
In what way is this a failure of big government?
I'd actually assert that this is a failure of small government - in Europe where the government is bigger, there's regulations about what information these companies can store, how they must store it, and what the penalty is if they fail to do so.
Re: (Score:2)
Yep. Now, I will refuse to do business with them.... ohwait.
Re: (Score:2)
IMO, Congress should start an investigation into this. It's just WRONG!
The way things are now the investigation would probably be why people didn't waive thier right to sue and what can be done to fix it so you don't have that right in the first place.