Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Government Security United States Technology

One Year After the Massive Equifax Data Breach, Pretty Much Nothing Has Changed (axios.com) 120

Posted by msmash from the they-don't-really-care-about-us dept.
The Equifax data breach was supposed to change everything about cybersecurity regulation on Capitol Hill. A year ago, Equifax announced that 145.5 million U.S. adults had their social security numbers stolen in an easily preventable breach. If any data breach was going to be able to shock Washington into enacting sweeping privacy reforms, this should have been it. Axios: But that didn't happen: "The initial interest that was implied by congressional actions didn't pan out," said Michelle Richardson, director of the Privacy and Data Project at the Center for Democracy and Technology (CDT). What was supposed to happen: After the first of several hearings involving Equifax, Sen. Chuck Grassley (R-Iowa), chair of the Judiciary Committee, said it was "long past time" for federal standards for how companies like Equifax secure data.

Data security wasn't the only anticipated reform. Congress appeared poised to create a national breach notification law governing how and how quickly companies must notify anybody whose personal information is stolen in a breach. Currently, to the chagrin of national retailers, those laws vary state to state. Several investigations were supposed to penalize the credit bureau for lax cybersecurity, including failing to patch the vulnerability hackers exploited despite government warnings. What actually happened: The bills petered out. Mick Mulvaney took over the Consumer Financial Protection Bureau in November and halted the bureau's investigation.
This discussion has been archived. No new comments can be posted.

One Year After the Massive Equifax Data Breach, Pretty Much Nothing Has Changed More

One Year After the Massive Equifax Data Breach, Pretty Much Nothing Has Changed

Comments Filter:

  • Change it! (Score:1, Insightful)

    by Anonymous Coward
    I'd say we should appeal to Donald Trump to change this, but he kind of has his hands full.

    • Re: Change it! (Score:5, Funny)

      by Anonymous Coward on Thursday September 06, 2018 @12:03PM (#57264560)

      He's got big hands, though. Really big, the biggest. Very nice, very big hands. So he'll fix the cyber problem. It really won't be that hard. We've got some great people working on that. Really great, the best.

      • Re: (Score:1)

        by Anonymous Coward
        "You know we're thinking of a seventh branch of the military. The "Credit Force". Because, you know, credit is a really big place, and really important.

        • Re: (Score:1, Funny)

          by Anonymous Coward

          "You know we're thinking of a seventh branch of the military. The "Credit Force". Because, you know, credit is a really big place, and really important.

          Fuck. How am I supposed to tell if this is really Donald or a Stable State [nytimes.com] traitor trying to disrupt his agenda? I know - it's clear nobody but the bestest could come up with the name "Credit Force". It takes a GENIUS level intelligence to think of that. TRUMP TRUMP TRUMP. MANGA

    • Re: (Score:1)

      by Anonymous Coward

      I'm pretty pissed off that Meuller is investigating Trump and not Equifax.

      But my opinion doesn't matter according to the treasonous #resistance

      • Re: (Score:1)

        by Anonymous Coward

        pretty sure this is not the FBIs job, probably the SEC, and FTC

      • Re:Change it! (Score:5, Insightful)

        by ShanghaiBill ( 739463 ) on Thursday September 06, 2018 @12:57PM (#57264952)

        I'm pretty pissed off that Meuller is investigating Trump and not Equifax.

        In no way whatsoever are these alternative actions. Mueller would not be the right person to investigate Equifax anyway, since he doesn't grok technology.

        The Equifax fiasco is not hard to understand. Unqualified people were placed in positions of authority, they made stupid decisions, and there were no mechanisms for underlings with better understanding to raise alarms.

        But there are deeper systemic problems. Only in America do we rely on critical information being both secret and widely known. Mere knowledge of someone's SSN, DOB, and address should not be enough to clean out their bank account nor establish credit in their name. No other country has this problem. Until we fix our financial system, data breaches and identity theft will continue to be major problems.

        • Re:Change it! (Score:5, Insightful)

          by raymorris ( 2726007 ) on Thursday September 06, 2018 @01:22PM (#57265128) Journal

          > In no way whatsoever are these alternative actions. ...
            > Unqualified people were placed in positions of authority, they made stupid decisions, and there were no mechanisms for underlings with better understanding to raise alarms.

          And the other situation is Equifax.

          • No, your other situation is the entire system called credit ratings. Equifax is just a part of the stupid.

            Credit rating in a nutshell:

            Person 1: Sir you have huge debt that means you must be good for it, here's a credit card with an even huger limit.
            Person 2: Sir you're homeless, your credit rating sucks. Have a smaller credit card we know you won't pay off.
            Person 3: Sir you're an engineer earning six figures who just moved into the country? We can give you a credit card with a $200 limit, but because you do

    • Re: (Score:1)

      by Anonymous Coward

      He has more than what is in his small hands to worry about.

    • Re: (Score:1)

      by Anonymous Coward

      You're hilarious. Yes, the man who appointed the man who halted the investigation is certainly motivated to do something about it...

    • I realize that this is just a troll attempt, but even if we had a president that everyone could agree was competent, trustworthy, etc. the U.S. was founded to get away from exactly this kind of autocracy where one person has the power and authority to change something like this. People always think of all the good that might be done with such power, but rarely consider how much evil can be wrought with that authority just as easily.

    • No interest in consumer protection. (Score:5, Insightful)

      by XXongo ( 3986865 ) on Thursday September 06, 2018 @01:59PM (#57265346) Homepage

      The last line of the summary says it all: "Mick Mulvaney took over the Consumer Financial Protection Bureau in November and halted the bureau's investigation."

      The current administration is not interested in consumer protection.

      They are on the side of business, not consumers.

  • Was there an expectation otherwise? (Score:1)

    by Anonymous Coward

    Seriously, did anyone expect anything to change?

  • = nothing gets done

    Did you really think they were going to crack down on corporations? Impose regulations and fines? Hahaha, my sweet summer child.

  • Who wins... (Score:3)

    by AVryhof ( 142320 ) <amos@vryhofres[ ]ch.com ['ear' in gap]> on Thursday September 06, 2018 @11:56AM (#57264522) Homepage
    It's the same winner, every time. Money.

  • Nope (Score:4, Interesting)

    by AlanBDee ( 2261976 ) on Thursday September 06, 2018 @11:58AM (#57264534)

    Politically, nothing happened. But a lot of people locked their credit score. I'm sure credit card companies are now asking for more information to prove your identity to open a new card. People's ssn, date of birth, and drivers license can no longer be trusted as a form of identification for anything. I also had so many friends and family ask what they should do, which opened the door for me to introduce them to things like LastPass, Yubikey, and other security.

    And when the whole debate about voting machines came up, one word shut most people up: Equifax.

    • Politically, nothing happened.

      To the surprise of absolutely no one given the current state of affairs in Washington.

      But a lot of people locked their credit score.

      So what? That's about the least interesting bit of data Equifax has about you and it does nothing to prevent mass data breaches.

      I'm sure credit card companies are now asking for more information to prove your identity to open a new card.

      Citation needed.

      also had so many friends and family ask what they should do, which opened the door for me to introduce them to things like LastPass, Yubikey, and other security.

      So you told them to use an unregulated and unaudited third party single point of failure? Great plan... You do realize that those things would do nothing to prevent a breach at Equifax right?

      • I'm sure credit card companies are now asking for more information to prove your identity to open a new card.

        Citation needed.

        I don't have a citation, it's just as assumption which is why I said, "I'm sure credit card companies..." instead of "Credit card companies are now..." The difference is a little too subtle, I probably should have put, "I assume credit card companies..." instead since it is just a guess.

        also had so many friends and family ask what they should do, which opened the door for me to introduce them to things like LastPass, Yubikey, and other security

        So you told them to use an unregulated and unaudited third party single point of failure? Great plan... You do realize that those things would do nothing to prevent a breach at Equifax right?

        Yep. If Equifax provided an authentication service would you trust it? How about Google, Apple or Microsoft? The fact is that when users try to remember their passwords they end up using the same passwords across multiple si

      • Locking a credit score doesn't prevent a breach but it does limit the useful things that can be done with the data.

        • The premise of this story is nonsense.

          1. And as opposed to "nothing", the current Congress did pass and Trump did sign a bill which takes effect in 15 days [ftc.gov] which according to the FTC includes:

          Free credit freezes
          What is it? A credit freeze restricts access to your credit file, making it harder for identity thieves to open new accounts in your name. Usually you get a PIN to use each time you want to freeze and unfreeze your account to apply for new credit.

    • And when the whole debate about voting machines came up, one word shut most people up: Equifax.

      I'm confused, how are voting machines related to the Equifax breach? Do they run Struts? It can't be relate to identity theft, because it's still people that verify your identity (or don't) before you vote, not the mchine.

      Electronic voting machines are a bad idea, but I don't see how waving your hands and mentioning a data breach in an unrelated industry supports the case. Isn't the technology probably more like a kiosk or industrial control equipment?

  • Comment removed (Score:3)

    by account_deleted ( 4530225 ) on Thursday September 06, 2018 @11:58AM (#57264536)
    Comment removed based on user account deletion

    • Re: (Score:2)

      by Xarius ( 691264 )

      I dunno

      In the UK I think they use their own keys. You have to provide your name, some other misc. items like phone number, date of birth and your postal address history. They use a combination of a lot of data items to point to "you".

      This has some problems, but seems to work well enough. I also dislike them intensely and don't trust them at all, just FYI.

  • The headline can be taken two ways ... the identity theft Armageddon didn't happen either. Did it?

    The interesting question would be why ... I know I put a fraud alert on my credit bureau accounts (and have kept renewing it), but did most people really do that?

    • Re:headline (Score:5, Interesting)

      by wwphx ( 225607 ) on Thursday September 06, 2018 @12:45PM (#57264884) Homepage
      I've been mulling over the lack of an armageddon since the breech happened. I'm not a conspiracy theory kind of guy, but my personal conclusion is that it was done by a state actor, and that actor was China. My suspicion is they hoovered Equifax because the exploit made them vulnerable and in doing so it gave China access to a treasure trove of information not just on pretty much every American, but a specific subset: every American working for the U.S. government. Every CIA agent, every NSA agent, in addition to every head of industry, every computer chip researcher. Anyone who might be of interest. At first I thought it might have been theft for stealing medical insurance coverage, but not only did that not happen, but nothing happened. It was such a huge haul of information that no criminal org capable of stealing that amount of info is going to sit on it - they need/want to monetize it for their efforts, but a government who wanted it for different purposes could.
      • The problem with that reasoning is Equifax's security was so demonstrably poor that it could have been China or your 8 year old cousin. They should have been sued, fined, and regulated into oblivion.

      • I'm not a conspiracy theory kind of guy

        But when I am, dammit if I don't go all out.

    • I've had my credit frozen since way before the Equifax breach. Somehow (I've never found out how and likely never will), someone got my name, SSN, DOB, and address. They used this to open a credit card in my name. (RED FLAG #1: They got Mother's Maiden Name wrong. So much for security with that.) They then immediately changed the address to an address in another state (RED FLAG #2) but not before paying for rush delivery of the card. Thanks to the latter, the card was rushed out before the address change we

      • Re: (Score:2)

        by ftobin ( 48814 )

        Did you have security freezes with all three major agencies? I'm surprised that an organization would give you credit without being able to verify your worthiness, unless there's a "back door" that we're not aware of. I've had to do freeze lifts for even things like opening a bank or brokerage account, but I don't mind, since that happens maybe once every few years.

        Transunion has the least painful process by far, since you actually have an account with them so you don't have to re-enter a bunch of persona

        • Yes. My credit with all three agencies is frozen (as is my wife's). The fraudulent card was issued before I had the freeze on. That happened back in my blissfully ignorant days when I thought my information was secure because I was careful about it. Now I know that your information is only as secure as the least secure company holding your data. And with breaches happening so often, it's best to just assume your data is out there and act accordingly.

  • Comment removed based on user account deletion

    • One of the big problems is that big agencies like Equifax contribute to politicians and hire lobbyists.

      Imagine your example, but when you steal 10 cookies, you give your mother a cookie. In exchange, she wags her finger at you for stealing cookies but nothing else. Meanwhile, your younger brother has no such arrangement and gets grounded for a week for eating a cookie crumb that wasn't his. After the most recent Cookie Stealing Incident, your mother moans about how horrible it is that people steal cookies a

  • You're free.

    You're equal.

    You are tolerated.

    Maybe these are not the right things to be hoping for; perhaps we need reality, sanity, and the ability to address glaringly obvious problems instead.

  • Republicans (Score:1)

    by Anonymous Coward

    is the short answer. Can't let anything inconvenience the corporations, after all.

  • Free credit freezes are due this month thanks to Economic Growth, Regulatory Relief, and Consumer Protection Act

    https://www.congress.gov/bill/115th-congress/senate-bill/2155/text?format=txt/ [congress.gov]

    TITLE III--PROTECTIONS FOR VETERANS, CONSUMERS, AND HOMEOWNERS

    SEC. 301. PROTECTING CONSUMERS' CREDIT.
    (a) In General.--Section 605A of the Fair Credit Reporting Act (15
    U.S.C. 1681c-1) is amended--
    (1) in

    • Too bad neither of my state senators voted for it but then one really can't expect much out of Amy Klobuchar. At least my Representative in the House voted for it.

      Looks like I may have some things to get setup in a couple of weeks when things go into effect on Sept 21.

      • Too bad neither of my state senators voted for it but then one really can't expect much out of Amy Klobuchar. At least my Representative in the House voted for it.

        I admit that I haven't read much of the bill, and so this may be unfair stereotyping, but when there's a bill that regulates large companies and only one Republican between both the House and Senate votes against it, I get suspicious of what the bill will really do.

        • From what I read of it, it is fairly long, it seems like it is pretty good. Then again there are a number of change these words to these other words in existing law which is usually where things go sideways. In the senate it looks like 16 democrats and 1 independent also voted for it. In the house it looks like 33 democrats voted for it too. So while not a strongly bipartisian bill it seems like there is support from both sides and from what little reporting on I have seen seems to indicate that it did roll

          • ...from what little reporting on I have seen seems to indicate that it did roll back some of the Dodd-Frank regulations...

            Thanks, that's the answer I was looking for.

  • Why should anything change? (Score:5, Insightful)

    by CaptainDork ( 3678879 ) on Thursday September 06, 2018 @12:33PM (#57264810)

    There's no incentive, no motive.

    Customers are helpless to do anything about it so they just shrug and move on.

    Their shit is out there anyway, what with all the other goddam break-ins.

    In the spirit of, "too big to fail," Equifax is too big for their breaches.

    All your base are belong to us.

  • is if Equifax gets hacked yet again, because there's a fresh new Struts weakness that was announced within the last week that was every bit as bad that lead to this breech. I would fine it hilarious if they're getting cleaned out once again even as we post.
    • This is how you know Slashdot ain't really news for nerds anymore. Here are teh types of article that would be linked into TFsummary if it was:

      https://www.darkreading.com/application-security/thoughts-on-the-latest-apache-struts-vulnerability-/a/d-id/1332716

      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11776
  • We need to elect politicians who support regulation as a solution. You can't rely on market forces since you're not able to "shop around" for a credit agency. They're assigned to you.
  • Of course nothing changed; the politicians, The Rich, they're all already 'protected', they were never in any danger from this, only The Poor, and middle-class working people stood to lose anything -- and our own alleged 'representatives' in our government don't really give a rat's ass about any of us filthy plebians. Politicians are too busy trying to hold on to their power and position, a large part of which is serving corporate interests (whose money got them elected in the first place; thanks so much Ci
  • You are not Equifax's customer, you are their product. (Just like you are facebook and google's product). You are however your credit card companies customer. If there was pressure put on the credit companies not to share information with an insecure entity like Equifax then Equifax would either put some effort into security or go bankrupt. Equifax has to have a near complete picture of everyone's credit score to remain in business. If even a few creditors stopped sharing information with them they wou
  • Just tell Donald that it's a wall, he'll start pushing for funding.

  • My credit is fine. Have there been reports of massive fraud that can be traced back to this? What are they doing with it?

    I predicted that this won't be a consumer problem. The credit system now has an issue - all of their previously "Secret" data is floating around. As a consumer I don't know what to do or what is happening out there. But if a rash of fraudulent loans start appearing then the credit market will really have a problem.

    Just like I have to press "block caller" due to the high level of sca

Slashdot Top Deals

Real programmers don't comment their code. It was hard to write, it should be hard to understand.

Close