back to article Stand up who HASN'T been hit in the Equifax mega-hack – whoa, whoa, sit down everyone

Global credit reporting agency Equifax admitted today it suffered a massive breach of security that could affect almost half of the US population. In a statement, the biz confessed that hackers managed to get access to some of its internal data in mid-May by exploiting a vulnerable website application. They remained on the …

Page:

    1. Tree
      Terminator

      Re: Sounds like 143 million POTENTIALLY affected

      I believe about 22 million illegal aliens have fake Social Security numbers, The first thing they do when they sneak under the fence is get a fake ID. Seems like the have "documents".

  1. Anonymous Coward
    Anonymous Coward

    Equifax? Ahh security advisors to the credit industry...

    I believe a mandatory 7 year sentence/strike is the UK penalty for being unable to manage your affairs.

    They may find it difficult to obtain credit now. They should have let us know as soon as they knew they were in difficulty, rather than wait months with their head in the sand...

    btw Is there anyone left that hasn't had their data 'accessed'?

    1. TRT Silver badge

      Re: Equifax?

      Wasn't that Channel 4's version of BBC1's Tomorrow's World & BBC2's Horizon combined?

      1. BoldMan

        Re: Equifax?

        Loved that program but of course it got sacrificed in the downward spiral of increasingly banal "science" documentaries that now require some sort of celebrity standing overlooking the Serengeti while wittering about Black Holes and saying "Brilliant" a lot.

  2. inmypjs Silver badge

    "offering every US citizen a year's free identity theft monitoring for those who apply"

    Which like all the 'check your credit score of free' bullshitters will require you to directly give them a bunch more personal information that they can abuse and/or loose.

    1. Yet Another Anonymous coward Silver badge

      Re: "offering every US citizen a year's free identity theft monitoring for those who apply"

      The irony being most of these "customers" were people who got free equifax accounts because of their details being swiped by hacks at just about every US big box store

      The cherry on top being equifax announced that anybody could access their new account by using their name and the last 4digits of the credit card details that had been stolen in the hack ......

    2. Sir Runcible Spoon
      Flame

      Re: "offering every US citizen a year's free identity theft monitoring for those who apply"

      bunch more personal information that they can abuse and/or loose.

      It's lose, lose, LOSE FFS! As in lost! It can't be that hard can it? It gets pointed out on here so often it's starting to make my teeth itch when people still do this.

      Genuine question: This happens so much these days I'd like to know if this sort of thing is covered in schools? I don't have kids so I can't tell how much worse it is now.

      Hmm, perhaps I should have my coffee now :)

      1. Alister

        Re: "offering every US citizen a year's free identity theft monitoring for those who apply"

        Sir,

        I agree wholeheartedly, it really grates on me to see loose... AARGH.

        But the problem, as far as I can see is that children are not encouraged to read any more, which is the quickest and best way to promote correct spelling.

        My daughter was reading books from an early age, and therefore her vocabulary and spelling are much better than most of her peers.

        If you've never seen the words written down, then phonetic errors like this are bound to be more and more common.

        1. Aladdin Sane

          Re: "offering every US citizen a year's free identity theft monitoring for those who apply"

          Maybe OP meant loose as in release?

        2. m-k

          Re: "children are not encouraged to read any more"

          sorry to hijack, but this is not (always) the case. We have encouraged our kids to read in every possible way short of forcing it down their throats (and we do love to read ourselves). But with kids, no can do. They can read, sure, they do read, but ONLY when they have to, never for pleasure. Naturally, they can't be bothered to look things up in an enclopedia or a dictionary on the shelf, sure, but it's worse than that, they can't be arsed to look it up on a f... wikipedia page, because, like, it's f... more than a few lines, too much (and then you ALSO need to try to understand?! No way!) And when I speak to other parents, their observation is pretty similar.

          This generation will be the first truely uneducated one. We ARE doomed! ;)

          ...

          now, back to equifucks...

          1. Alister

            Re: "children are not encouraged to read any more"

            @ m-k.

            Yes, I think you are right that reading for enjoyment is not a thing for kids nowadays.

            One thing that we did with our kids to try and encourage them to look things up was to buy a book of quizzes, (and latterly use those available in phone apps or on the web).

            At meal-times we would all have a go at them - all sorts of subjects, from history to boy-bands (shudder) - but it made it fun for the kids 'cos they could laugh at us adults lack of knowledge, and get a feeling of pride when they got something correct.

            As a consequence, the kids now have minds full of all sorts of useless information :) but it does encourage them to take an interest in obscure subjects, and above all to enquire, instead of following the trend of only knowing things they absolutely need to to get through school.

          2. Captain Badmouth
            Headmaster

            Re: "children are not encouraged to read any more"

            "This generation will be the first truely uneducated one."

            Is this right? Ed.

        3. Prst. V.Jeltz Silver badge
          Paris Hilton

          reading

          "If you've never seen the words written down, then phonetic errors like this are bound to be more and more common."

          As a kid I was making phonetic errors because i'd *only* seen words written down .

          I used to think recipes was pronounced re-sypes

      2. inmypjs Silver badge

        Re: "offering every US citizen a year's free identity theft monitoring for those who apply"

        "It's lose, lose, LOSE FFS!"

        gsus u r anl. if u cn rd ths sht ytf r u btchn abt a xtr o in a wrd?

        i thnk ppl hu ntce splng mstks r actlly a bt wrd. I m qite splng blnd whn rdng stff, spclly stff tht i wrt.

        1. Sir Runcible Spoon

          Re: "offering every US citizen a year's free identity theft monitoring for those who apply"

          It might seem anal, but if no-one has any standards (and sticks to them) doesn't it just become a race to the bottom?

          I'm sure our ancestors understood each others' grunts as well, but that doesn't allow for much eloquence now does it?

    3. DontFeedTheTrolls
      Go

      Re: "offering every US citizen a year's free identity theft monitoring for those who apply"

      "give them a bunch more personal information that they can abuse and/or loose"

      They've already lost all the information you might be asked to give them.

      I'm in the UK and I've recently checked my scores from the three agencies, Equifax, Experian and CallCredit. Didn't need to give them anything they didn't already know, it was simply used to validate that I was who I claimed to be. I know this because I found two sets of partial records that as a whole pretty much cover my identity, all down to the Electoral Roll using a different address format from the Postcode Address File.

  3. Androgynous Cow Herd

    On the bright side

    All those affected will be offered 1 year free credit monitoring by Equifax.

    1. JCitizen
      Stop

      Re: On the bright side

      I'm sure that you are just being sarcastic, but it would be better if they LOCKED your credit report until you need a free unlock in case you applied for anymore credit. Too many things DON'T show up on regular credit reports to really tell if you've been dinged or not.

  4. Herby

    Scott McNealy was right.....

    We should all remember the quote and treat data accordingly:

    "You have zero privacy anyway. Get over it."

    1. Prst. V.Jeltz Silver badge

      Re: Scott McNealy was right.....

      I'm really surprised , now that the world is finally waking up to the idea of data security , that these huge credit-checker databases of incredibly sensitive information , held without the owners consent wernt "The First Against The Wall"

      perhaps this incident will help trigger that.

  5. Anonymous Coward
    Anonymous Coward

    Equifux

    Couldn't happen to a nicer bunch of fux, sorry! Self-elected Gods unanswerable to anyone! Along with TransUnion these guys are right up there with S&P / Moody's for corporate racketeering. How many hacks has it been so far lads? You were warned! Now, reap the whirlwind:

    ~~~~~~~~~~~~~~~

    http://abcnews.go.com/Politics/equifax-confirms-hackers-stole-financial-data-launches-investigation/story?id=18715884

    https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/

    http://abcnews.go.com/Politics/equifax-confirms-hackers-stole-financial-data-launches-investigation/story?id=18715884

    https://www.law360.com/articles/800482/equifax-hit-with-class-action-over-kroger-data-breach

    https://www.databreaches.net/equifax-discloses-data-breach-due-to-technical-error-during-software-change/

    https://www.scmagazine.com/breach-at-equifax-subsidiary-illustrates-risks-consumers-face/article/662982/

    1. anothercynic Silver badge

      Re: Equifux

      You forgot Experian...

      1. Anonymous Coward
        Anonymous Coward

        Re: Equifux...You forgot Experian...

        The world will be a better place when Experian is completely and utterly forgotten.

        1. This post has been deleted by its author

  6. Anonymous Coward
    Anonymous Coward

    This is why GDPR cannot come soon enough. As-good-as every working adult in the united states has their name, address, date of birth, social security number and maybe their driver's license number and highly sensitive dispute correspondence swiped and the cost to Equifax is...

    ...a year's free credit reporting? That they do anyway?

    Fuck. Off.

    1. Anonymous Coward
      Anonymous Coward

      This is why GDPR cannot come soon enough.

      Won't help our colonial cousins, will it? And given the year that seems to elapse between reporting of the breach and regulatory punishment, we won't be seeing any hot GDPR action until May 2019. I can't see Brexit making a difference since to continue to work with Europe we'll need an equivalent structure.

      1. NeilPost Silver badge

        Cut'N'Paste

        You must have missed last weeks announcement on UK Data Protection which despite the spin is a re-skinned UK GDPR. However as GDPR will be incorporated into UK law, that's not a surprise or anything to thhank Westminster for.

        Youy can bet your ass it won;t stop GCHQ breaching your ECHR, which we are not leaving :-)

        This cluster-fuck of a data breach might give thhe US some food for thought into perhaps adopting GDPR themselves.... but I expect not and a Presidential pardon for his Exec mates at Equifax.

      2. Anonymous Coward
        Anonymous Coward

        "Won't help our colonial cousins, will it?"

        GDPR applies to any entity either operating in Europe or handling a European citizen's data. Violation of GDPR does not require a breach, as GDPR mandates security-by-design from the inception of a product (and actually mandates full documentation of that compliance.

        A quick scan of the relevant SEC page identifies at lest 15 EU-based subsidiaries. Even post-brexit there's more than enough EU exposure to make enforcement and fines desirable and viable.

        Not enough American companies have realised that GDPR very much applies to them. It'll be particularly tasty when fines start being doled out to those who are exposed because they're routing all their revenue through Ireland.

  7. fidodogbreath

    Whoa, where'd the horse go?

    Smith pledged that the company would not stop until its servers were secure.

    A better choice would have been to not start until its servers were secure.

    Ah, but we all know that security is boring, and it gets in the way of selling people's private data.

  8. Anonymous Coward
    Anonymous Coward

    So due to mismanagement, misuse, abuse, hacking and an endless string of "financial crises", can we collectively agree that the consumer credit reporting system is itself a giant fraud?

    1. Adam 52 Silver badge

      The consumer credit rating system is a giant fraud full stop. It's got notice do with mismanagement or hacking, it's a scam by design.

      They acquire data from third parties under no obligation to check if it's correct, without consent and informing the data subject. They refuse to correct incorrect information and they refuse to disclose it.

      And then they derive a score using a secret algorithm which they then use to libel individuals.

      All which would be illegal unless there were an exemption in law.

  9. Anonymous Coward
    Anonymous Coward

    Co-incidence?

    Hardly! When you decimate wages / opportunities for IT staff and treat them like plumbers, this is what happens! Reminder: You're not masters of the universe CEO's... Hackers / cybercrims are!!! Wake up or don't... Start paying tech staff properly and maybe those that left or were shit-canned will return and bail your ass out! Otherwise good luck getting your multi-million dollar bonuses and retiring to winter homes in the Caribbean anytime soon!

    1. Anonymous Coward
      Anonymous Coward

      This CEO sure isn't getting his bonus anyway:

      "By the summer of 2017, A.P. Moeller-Maersk A/S was the world’s biggest containership operator. However, after a major cyberattack in June 2017, by July 2017, the company was "struggling to restore its global computer network" and was forced to rely on calls and texts to maintain operations. Disruption from the NotPetya ransomware attack was expected to cost Maersk about $250 million."

      1. Anonymous Coward
        Anonymous Coward

        Re: This CEO sure isn't getting his bonus anyway:

        We'll see. Worth noting that the accounts of Maersk indicate that bonuses are very small part of the board remuneration, something like $2m cash incentives against a basic pay of $13m last year.

        1. Anonymous Coward
          Anonymous Coward

          Re: This CEO sure isn't getting his bonus anyway:

          Yes, it's odd how companies like Maersk that really do have significant assets and a product don't pay as much in bonuses as companies that don't actually produce or deliver anything and just move money around.

          It's almost as if money and data companies attract extremely selfish people to their managements.

      2. itsecman

        Re: This CEO sure isn't getting his bonus anyway:

        CEO's always get their bonus, it's just labelled differently when they get it!

    2. Warm Braw

      Re: Co-incidence?

      treat them like plumbers

      Judging by the number of irritating minor problems in the plumbing of my new house, I'd swear it had been installed by IT staff. Fortunately, plumbing is mostly open source and you can fix it yourself, which is more that can be said for the credit oligarchyindustry.

      The real problem is actually that IT staff pass themselves off as engineers when they really don't understand the meaning of the term. Many of them work on the same principle as plumbers - take a bunch of manufactured components and connect them all together - but have less understanding of what each component actually does, let alone how they will act together as a system. If management understood that most IT staff shouldn't be trusted to deliver secure solutions (partly because generations of IT staff before them have built incredibly shoddy foundations) they might be a bit more cautious in their ambitions.

      1. jdoe.700101

        Re: Co-incidence?

        This reminds me of an old joke.

        Q: what is the difference between car salesman and computer salesman?

        A: car salesmen know when they are lying.

  10. JustWondering
    Facepalm

    Ummm ...

    If they have spilled the data of pretty much everyone, shouldn't they just monitor everyone's accounts that are affected? They know who they are, they are sending them all a letter. Or are they hoping the idea of giving them more data might be repugnant to many, keeping the uptake low?

    1. DontFeedTheTrolls
      Pirate

      Re: Ummm ...

      By making victims sign up for a free year of monitoring they'll manage to bill a sufficient number of lazy people who failed to cancel before the end of the free period.

  11. Florida1920
    Facepalm

    Equifax credit score

    About 0.001. Way to tank a corporation.

    1. Jim Mitchell

      Re: Equifax credit score

      I doubt it. Equifax's customers are not consumers, they are businesses that want to know something about somebody before they extend an offer of credit. That Equifax had a breach isn't their problem at all.

      1. Richard 12 Silver badge

        Re: Equifax credit score

        If the miscreants could read it, could they write it?

        Can Equifax prove that no records were added or altered?

        1. Sir Runcible Spoon

          Re: Equifax credit score

          If the miscreants could read it, could they write it?

          This is exactly the correct attitude and thought processes required to be successful in IT Security. Equifax should hire you asap :)

      2. Anonymous Coward
        Anonymous Coward

        Re: Equifax credit score

        well, that breach IS a problem for real equifucks customers, like big business, because they rely on reliability / accuracy of this data when dishing out credit, at least statistically. So, the big business thinking is: if our dearest, safest business partner got pwned, who's to guarantee that all those credit scorings we pull from them have not been already "adjusted" and we'll be screwed when our marks turn out to be unable to pay back? (this is nonsense of course, but the big business will react with a flinch).

        Also a potential surge in scams will be directed against those marks' accounts held by big business, mostly banks. Not that they give a flying monkey about little people, but increased "traffic" in complaints and investigations falls upon their head, financially, as they will have to allocate resources (and money) to deal with this. So, they won't be happy.

        On top of everything, the issue of business "trust" is in large part smoke and mirrors (you're big, you project sense of reliability, security. It's called - reputation) until something like this breach occurs. A bit of a rude awekening to equifucks customers, to realize that all those assurances about security and reputation are worth - nothing. Ooops. In the spirit of schandenfreunde - exactly the same feeling little people experience when their bank, who cares oh so greatly about their security, and is so well-protected NOTHING can happen - gets hacked. What goes round, comes round.

        1. Anonymous Coward
          Anonymous Coward

          Re: Equifax credit score

          This could make a good plot for a film. The fall of western civilisation brought about by over enthusiastic lending brought about by some malefactor skewing everyone's credit score to allow them to borrow amounts they have no hope of repaying.

          It could be called "2008 - The Follow through."

          1. Anonymous Coward
            Anonymous Coward

            Re: Equifax credit score

            "some malefactor skewing everyone's credit score to allow them to borrow amounts they have no hope of repaying."

            Good morning. I am Mr. Nong from Nigeria. You have been identified by my company as an individual who is both ambitious and of modest means. I can show you how to raise your credit score so you can borrow the sum of thirty five million dollars ($35,000,000) and then change your identity so that you cannot be pursued for the debt. I will do this for you for only five percent (5%) of the amount borrowed plus a small initial down payment for me to pay my business associate to start the process.

      3. Adam 52 Silver badge

        Re: Equifax credit score

        "That Equifax had a breach isn't their problem at all."

        It is a bit, because those same customers also supply the data (which is what makes this such a great business, you get data from your customers and give it back to them). They can only do that if there's plausible deniability around customer security, and events like this make it blatantly obvious that data isn't being held as securely as the public and regulators much expect.

      4. Florida1920

        Re: Equifax credit score

        @ Jim Mitchell

        I doubt it. Equifax's customers are not consumers, they are businesses that want to know something about somebody before they extend an offer of credit. That Equifax had a breach isn't their problem at all.

        Wall Street isn't particularly thrilled with Equifax either. As of mid-day Friday, the company's stock was down nearly 14 per cent.

        http://www.theregister.co.uk/2017/09/08/lawyers_line_up_to_sue_equifax/

  12. Nick Kew

    They're doing us a favour

    Whatever data equifax hold on most of us is self-evidently not secret or private: it's assembled from publicly-available information. And is the kind of thing that regularly leaks in bulk: here's from ten years ago.

    If this leak can help convince companies to stop misusing such public information as proof of identity, then it's done the world a favour.

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like