Credit Reporting Firm Equifax Announces 'Cybersecurity Incident Impacting Approximately 143 Million US Consumers' (cnbc.com) 299
Equifax, which supplies credit information and other information services, said Thursday that a cybersecurity incident discovered on July 29 could have potentially affected 143 million consumers in the U.S. "The leaked data includes names, birth dates, social security numbers, addresses and potentially drivers licenses," reports CNBC. "209,000 U.S. credit card numbers were also obtained, in addition to 'certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers."
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes. We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations. We also are focused on consumer protection and have developed a comprehensive portfolio of services to support all U.S. consumers, regardless of whether they were impacted by this incident." Equifax is now alerting customers whose information was included in the breach via mail, and is working with state and federal authorities.
UPDATE (9/7/17): According to Bloomberg, "three Equifax senior executives sold shares worth almost $1.8 million" in the days after the company discovered the security breach. Regulatory filings show that three days after the breach was discovered on July 29th, Chief Financial Officer John Gamble sold shares worth $946,374 and Joseph Loughran, president of U.S. information solutions, exercised options to dispose of stock worth $584,099." Meanwhile, "Rodolfo Ploder, president of workforce solutions, sold $250,458 of stock on Aug. 2."
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes. We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations. We also are focused on consumer protection and have developed a comprehensive portfolio of services to support all U.S. consumers, regardless of whether they were impacted by this incident." Equifax is now alerting customers whose information was included in the breach via mail, and is working with state and federal authorities.
UPDATE (9/7/17): According to Bloomberg, "three Equifax senior executives sold shares worth almost $1.8 million" in the days after the company discovered the security breach. Regulatory filings show that three days after the breach was discovered on July 29th, Chief Financial Officer John Gamble sold shares worth $946,374 and Joseph Loughran, president of U.S. information solutions, exercised options to dispose of stock worth $584,099." Meanwhile, "Rodolfo Ploder, president of workforce solutions, sold $250,458 of stock on Aug. 2."
Free Credit Reporting? (Score:5, Funny)
Re:Free Credit Reporting? (Score:4, Informative)
You probably know this already, but you already get one free per year from each of the 3 credit reporting agencies. (Thanks Uncle Sam!)
If you time it right, you can pull one every 4 months (rotating agencies, using each one yearly)
https://www.annualcreditreport... [annualcreditreport.com]
Re:Free Credit Reporting? (Score:4, Informative)
You probably know this already, but you already get one free per year from each of the 3 credit reporting agencies. (Thanks Uncle Sam!)
If you time it right, you can pull one every 4 months (rotating agencies, using each one yearly)
https://www.annualcreditreport... [annualcreditreport.com]
Free credit report != Free fraud alert/monitoring.
Lots of fraud can happen in a 4 month time...
Re: (Score:2)
Re:Free Credit Reporting? (Score:5, Funny)
No, Equifax is going to treat the breach as a "hard pull" on everyone's account and ding your score for it.
Re:Free Credit Reporting? (Score:5, Informative)
Don't worry... (Score:5, Insightful)
No executives will be fired for this incident.
Re:Free Credit Reporting? (Score:4, Funny)
Don't worry, you'll figure it out when someone uses your personal data that they stole from Equifax to open accounts in your name, which causes your credit rating to go down, which will show up on your credit report. From Equifax.
Anyone want to place wagers on whether or not Equifax will drop your score because people stole your identity with the data they got from Equifax?
So much for all those "security" questions (Score:3)
This breach is why it ROYALLY pisses me off when some websites force me to answer "security" questions such as the name of the street I first lived on. The people responsible for such sites should be held accountable for gross negligence.
This is exactly why I now almost always answer the "security" questions with gibberish.
If my 20-length complex password of random digits, numbers, and special characters isn't enough for security then f it.
Also, it seems like it should be a basic civil right at this point
You must be new here (Score:5, Insightful)
On planet Earth.
The people responsible for such sites should be held accountable for gross negligence.
You mean a lackey or two right? No executives are held accountable for their own decisions. In fact, the bigger the screw up the more jumps applied to the Peter Principle.
Also, it seems like it should be a basic civil right at this point to be allowed to change one's SSN. To be forced to deal for the rest of one's lifetime with the consequences of it having been stolen is outrageous.
I'm not sure you know what a civil right is. I would however support legislation which outlaws the use of one's SSN as identification to anyone other than the Government, and perhaps even more specifically the Social Security Agency.
Banks. Schools. Health providers. (Score:4, Interesting)
What's bad is that many of the offending organizations doing this are banks, educational institutions, and health providers. They must think "because we're a [bank|school|health provider] we need extra security" and then proceed to FORCE all users to answer these stupid questions.
Yes, make a law prohibiting use of SSN except by the SSA.
Re: (Score:3)
No, the SSN as identification is fine. Honestly, that's probably what everyone should use. What's wrong is using it as authentication. Nobody should use it for that, but despite that being obvious for decades, everyone continues to use it that way.
Answer with a famous person's info (Score:2)
I understand your frustration. The purpose of those questions is, of course, as a backup because people forget / lose their password.
> If my 20-length complex password of random digits, numbers, and special characters
Unless you're re-using the same password on all sites (bad idea) and never changing it (another bad idea) you're probably storing them somewhere rather than memorizing a dozen different sets of 20 random characters which means you could lose it. In which case you'll need to use the securit
Re: (Score:2)
I use LastPass. If any of my devices are stolen - which has happened several times - I immediately change the master password.
I know people will say this is not perfect - LastPass itself could be compromised, or someone could potentially access my system and keylog - but it seems to be by far the best practical solution and has been foolproof to date.
However I like the idea of client certificates mentioned by another commenter. Sounds like the way of the future.
Re: (Score:3)
Re: (Score:2)
I'm curious about how this would work. Would each person have one client cert that works with multiple sites? Or would each site require it's own cert? What happens if your phone or laptop with the cert(s) on it is stolen? Would use of the cert on the local device (phone, laptop) require something additional like a fingerprint swipe or iris scan?
Re: TLS Client Certificates (Score:3)
You obviously haven't used certs as authentication, but they're to be handled just like regular passwords. You have a private and public key, no reason to keep the private key accessible to any sort of theft, you can encrypt them so that any use requires a password however the password doesn't traverse the network but without it the cert is useless. In most cases you can also revoke the cert, LetsEncrypt-style cert providers allow you to both instantly revoke and have a short enough lifespan.
DONT USE THE LOOKUP TOOL (Score:2, Informative)
It signs you up for a product. READ THEIR TOS. You just waived right to class action and agreed to arbitration...
Scumbag move!
Public Info? (Score:5, Insightful)
At this point, is there anybody left in the U.S. who has not had their names, addresses, and socials stolen in from a hack somewhere?
Re:Public Info? (Score:5, Insightful)
NOW can we stop using SS# as a national identifier? Jeez!
Re:Public Info? (Score:5, Insightful)
Why?
It *is* a national identifier. It needs to stop being used as an authenticator.
SSN and Name first, Name last, Name middle should be interchangeable from a data and security standpoint.
The problem is that SSNs have been used as authenticators for the name and that's not what they were designed for.
Re:Public Info? (Score:5, Insightful)
It is an imperfect national identifier because not everyone in the nation has one. It is an imperfect national identifier because you cannot change it when compromised. It is an imperfect national identifier because the nation allowed it to be hijacked as a commercial identifier. Banks and creditors in general should have to fend for themselves if they want to properly identify a debtor, rather than relying on a number that was issued for a completely different purpose.
Re: (Score:2)
It is an imperfect national identifier because not everyone in the nation has one.
All identifiers are imperfect.
. It is an imperfect national identifier because you cannot change it when compromised.
An identifier can't be 'compromised'; it's not really supposed to be a 'secret'. It's flawed to use it as a secret. Its fine as an identifier.
It is an imperfect national identifier because the nation allowed it to be hijacked as a commercial identifier
How does that have any bearing on its suitability to be an identifier?
r. Banks and creditors in general should have to fend for themselves if they want to properly identify a debtor, rather than relying on a number that was issued for a completely different purpose.
Um... what should they use? And even if they came up with something, it would be a matter of hours before a table of new_bank_id to ssn's was created, and a few hours more before it was leaked, making it a moot point.
Re: (Score:2)
It is an imperfect national identifier because you cannot change it when compromised
You're doing exactly what the GP said not to do. An SSN is an identifier, not an Authenticator. It is not possible to compromise an identifier any more than another person who has the same name as you "compromises" your name.
Or should I "compromise" your Slashdot account by going over to soylent news and signing up as Lab Rat Jason?
Re: (Score:2)
Re: (Score:2)
A SSN-PIN.
You are issued a public credential (your SSN) and a private validation token (PIN). PIN can be changed and is offered as a secure authenticated lookup service from the Social Security Administration.
Still not perfect, sure, but a hell of a lot better.
Re: (Score:2)
No, it is not since it is not unique
Ah, but it absolutely IS unique. There may be someone else incorrectly claiming that number was assigned to them, and it does happen, but the number absolutely is unique. Your father may "share" a number with someone else, but only one of them is correct.
The SSA attempted a few times to correct these errors, but were shut down by immigration lobbyists. That needs to change. If immigrants want to work here, fine, and if they want or need a SSN, then they should get one rather than just "borrowing" someon
Re: (Score:2)
It's going to be amusing when we start reusing numbers. We've already exhausted about 460 million of the 988.9 numbers available.
Can you not change it to alphanumeric?
If you started that process now, everything used everywhere would have time to be replaced with updated software that can handle that format - even those places running COBOL or FORTRAN or whatever the flavor was 40 years ago.
Re: Public Info? (Score:2)
Re: (Score:2)
It still sounds fine as an identifier. But if anyone is thinking of it as a secret, they probably need to change the combo on their luggage.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
NOW can we stop using SS# as a national identifier? Jeez!
Well many years ago companies and government was told/encouraged/waned NOT to use the SSN for Id purposes and my original card had something like that printed on it. Of course everyone and their brother ignored that. So here we are.
Re: (Score:2)
NicknameUnavailable predicted:,/p>
More likely it will be an excuse to give everyone chips.
I like the wavy kind ...
Re: Public Info? (Score:2)
Re: (Score:2)
"143 million U.S. customers" sounds a whole lot like someone's guess as to how many adults live in USA. I don't know if it's correct, but it's gotta be in the ballpark.
I suspect this means that Equifax leaked their entire database.
Re: (Score:2)
Re: (Score:2)
At this point, I assume with total confidence that my data is in the hands of someone it should not be.
It took you this long...
Re: (Score:2)
Re: (Score:2)
Y'know, given that TFS states that 209,000 credit card numbers were compromised, I tend to think that the whole "potentially exposing the data of 143 million customers" hyperventilation is an invention of TFA's author, and that the actual number of customers whose data was exposed was 209,000 or fewer (because of the 182,000 customers' dispute data specifically mentioned thereafter, and assuming that 27,000 of those customers had two credit cards listed in their dispute files).
I'm just sayin' ...
Re: (Score:3)
You see, I think that victims being diligent is just as much the wrong answer as getting a new SSN. It isn't our responsibility to catch bad guys in the act when they use our name and SSNs to obtain credit. It is the credit reporting agencies' responsibility to exercise due diligence in determining whether or not someone should extend cred
Re: (Score:3)
"Illegal," in any legal context has a component of "punishment."
Undocumented immigrants who are "first-timers," are simply given due process and deported.
There is a free ride, meals and accommodations prior to ejection, but there is no punishment.
Because the first-timer is identified and documented, subsequent entry is illegal.
I have one thing to say (Score:5, Insightful)
CLASS ACTION LAWSUIT! These companies that want to collect all this personal data of people and fail to protect it need to be sued into non-existence!
Re: (Score:2)
Re: (Score:2)
This could be a lawsuit goldmine. Not just for the beech, but for errors people will now be able to discover in their reports.
Re:I have one thing to say (Score:5, Informative)
It's funny you mention "gold". During the great California and Alaska gold rushes, do you know who really struck it rich? It was the folks selling mining hardware and other supplies to the miners. The vast majority of miners didn't make much at all.
I think it's an appropriate comparison for modern-day class action suits. These types of lawsuits make lawyers rich, and everyone else gets enough for a free latte or two.
Re: (Score:2)
CLASS ACTION LAWSUIT! These companies that want to collect all this personal data of people and fail to protect it need to be sued into non-existence!
What would be the basis for such a suit? In most cases there's no business relationship between the consumer and Equifax, so there is no implied trust here. Equifax never promised, either directly or implicitly, to the consumer to keep their data secure, so there's no real breach of trust here. I don't see how the consumers have any standing to sue. Perhaps the retailers who supplied the data to Equifax may have some standing to sue as there may have been an implied expectation of privacy, but I don't s
Re: (Score:3)
Preach it!
I'm a retired IT guy for some law firms. Management asked me for years, stuff like: WHEN is this spam going to stop?
My reply, for over 20 years was, "Maybe after you use your goddam talents and sue the mother fuckers."
Litigation cures a lot of ills.
Companies will not address security until it falls outside the cost of doing business.
For reference, see litigation regarding fire codes.
Re: (Score:2)
There would certainly be company-sized HOLES that other companies could fill. There would be void and vacuums for periods of time, and there's a real risk that corporate espionage would be a big tool for corporations to simply kill each other. But I don't think any business should be "too big to fail". If they screw up, they should pay. If that brings them under, so be it. Have a fire-sale and let some younger company pick up the pieces and start anew. Hopefully with something that doesn't pollute cy
Re: (Score:2)
The beating will continue.. (Score:2)
Until accountability is found.
How to fix the broken system? (Score:2)
Re:How to fix the broken system? (Score:5, Insightful)
Social Security numbers are fine. The problem is that organizations have foolishly been using them for authentication ("Prove you are you!"), rather than merely identification ("Who are we talking about?"), which was all they were ever designed to do. As a means for identification, it generally still works just as well today as it did when it began. As a method for authentication, it was lousy from the start and has been getting worse by the day.
Re:How to fix the broken system? (Score:5, Informative)
Social Security numbers are fine. The problem is that organizations have foolishly been using them for authentication ("Prove you are you!"), rather than merely identification ("Who are we talking about?"), which was all they were ever designed to do.
Even more narrowly than that. It's original purpose was to track workers solely for use in determining SS benefits - that's it. From The Story of the Social Security Number [ssa.gov]
The Social Security number (SSN) was created in 1936 for the sole purpose of tracking the earnings histories of U.S. workers, for use in determining Social Security benefit entitlement and computing benefit levels.
Obligatory CGP Grey Video (Score:4, Informative)
Social Security Cards Explained [youtube.com]
.
Re: (Score:2)
Every data request session has to match up with a real computer in an office with a real human requesting data at a human rate of data access?
Why not?
From a used car sale to a gov/mil contractor seeing if the person's data been reviewed has data on them in their own state database.
The problem with that is then a huge new database exists of who went searching for exactly what, when a
Re: How to fix the broken system? (Score:2)
They sat on this? (Score:5, Interesting)
Re:They sat on this? (Score:5, Informative)
They had to wait for a few execs to complete share sell offs yesterday before releasing the public statement.
Re:They sat on this? (Score:5, Interesting)
This is a good thing. A privacy breach generally goes unpunished. Insider trading on the other hand...
That's it... (Score:2)
Most of their customers have no recourse (Score:5, Insightful)
Typically when a company screws its clients, they risk clients no longer using their service, so usual market forces apply. This is not the case here. Most of their customers never chose to use Equifax or even given any explicit permission for them to collect their data. Yet, they do collect it and sell credit scores. The problem is that market forces don't work here, i.e. those customers who got hurt are not really paying, or even willing, customers and have no choice to opt out of the service, and those who buy credit scores are not really affected much.
As much as I am generally against regulation, this is one area I think they should be held fully liable, including compensating any affected customers for ALL of their expenses, including their time at some reasonable rate at or above what that customer usually makes per hour - that includes any waiting on hold while calling any of the companies to clear things out. Maybe this would cost Equifax its life, so be it, the next company will be much more careful what they do with the data. This would be no different than an airline being held liable for damaging property of killing people because their planes are shedding parts - the people hurt are not airline customers, they are the homeowners who had an aircraft parts crash through their roof into their living room.
Re: (Score:2)
The breach only effects consumer data, which is not really a client or customer of Equifax. Those would be the banks and lenders that use their data conglomeration services.
The thing about this that bugs me is why in the hell were public facing computers holding access to basically everything someone needs to completely take your identity. Why is that company even allowed to hold anything other than your address, ss# and reporting history ? They shouldn't have credit card or even bank account number info im
Re: (Score:2)
The network and database is secure. Everyone with access is trusted. The data is a format that every one with access can read and have displayed in a useful way.
Re: (Score:3)
Re: (Score:2)
As much as I am generally against regulation, this is one area I think they should be held fully liable, including compensating any affected customers for ALL of their expenses
The problem is, I'm not sure under what grounds Equifax could be held liable here. When a retailer (such as Target or Home Depot) is hacked, exposing customer data, the customers were able to successfully sue on the grounds that these retailers breached their trust. When a customer hands a credit card over to the retailer, there's an implied trust here: the customer is trusting the retailer not to leak their private info, and when a retailer accepts a customer's credit card, there is an implication that t
Re: (Score:2)
Follow my example of an airplane shedding parts causing properties below. There is no implied trust between an air transport company and a homeowner who had a piece of landing gear fall through his roof. There is no business relationship between the air transport company and the homeowner either. Yet, I bet if an engine fell off of a FedEx airplane and damaged someone's home, FedEx would be held liable. IANAL, so you tell me, what would be the grounds FedEx would be held liable for damage their engine cause
Re: (Score:2)
Except that FedEx will claim that they are not the ones liable, it's the responsibility of the aircraft maintenance company. The maintenance company will then deflect the liability on to the local contractor, who will file bankruptcy and go out of business. Meanwhile, the home owner's insurance company, knowing the preceding, will declare the incident an "act of God", therefore, not covered.
(For those who think this wouldn't happened, something similar did happen to one of my neighbors. The "bucket lift" of
Re: (Score:2)
Follow my example of an airplane shedding parts causing properties below.
That comparison isn't valid at all. In that case, the airplane parts are entering someone's property. Same as if I break into someone's house, it doesn't matter if I had a pre-existing business relationship with them or not, I've established a relationship of sorts by entering their property. Same if my plane drops parts on their property. But Equifax didn't trespass on anyone's property or have any interaction with these customers at all. Some information was leaked, but did Equifax have any obligatio
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The difference here is that you are not equifax's customer - you are their product.
You should remember the fact you are the product every time you do a search on the internet, or partake in a free email provider...
Re: (Score:2)
Consumers are not their customers. Their customers are banks and other entities that want to know whether a person is a good credit risk.
Insofar as they injured any other third parties, they should surely be held liable. But this has nothing to do with whether the individuals whose data was leaked are "customers" of the credit agency. They are clearly not, nor should such a designation even be relevant when assessing liability.
Tips now that your credit info has been stolen (Score:2)
Someone filed a fraudulent return for me on March 30 of last year. They had their "refund" sent to a debit card. I've used the same CPA for 30 years, which gives you and idea of how well the IRS detects fraud. I have no idea how my information was stolen. A few points:
1. The best defense is to file early (e.g., February).
2. As a victim of id theft, you should qualify for a free credit freeze. Good luck. Out of six requests (3 each for me and my wife) only one was accepted. You can waste your time
Re:Tips now that your credit info has been stolen (Score:5, Informative)
Regardless, in most states you can pay $10 -- to each credit bureau -- and freeze your account permanently anyway. I did just that in 2011. When getting a loan or new line of credit, you can ask the company which bureau it will use for the credit check, call the bureau and either (a) unconditionally unfreeze it or (b) unfreeze it with a password or PIN, which they will US mail you -- for a specific number of business days. It's actually fairly painless.
Re:Tips now that your credit info has been stolen (Score:5, Informative)
Here is an article from the FTC on freezing your credit: https://www.consumer.ftc.gov/a... [ftc.gov]. I also recommend doing it.
Even though some banks can't process your car loan, or other credit. Your goal in personal finance should be to not need credit and to pay cash for everything. If you don't have the cash then you can't afford that car.
Re: (Score:3)
If you don't have the cash then you can't afford that car.
It costs me $20 a week to have that car now rather than save up a few years for it. The gas savings from having the more frugal car is around $15-18 per week, so to have this newer car 'on credit' is costing me less than a dollar a day.
Think I'll take that deal.
Next time it may be different as I won't be going from a gas guzzler to an econobox, but even so that $20 a week will be covered by a single year pay rise, let alone the other 4 years for when the car is paid off. Actually by then pay increases will
Re: (Score:2)
If you don't have the cash then you can't afford that car.
That is possibly the dumbest comment I've ever seen. The ability to afford is about balancing incoming and outgoing finances, not about accumulating mountains of cash.
If that was your criteria then as a well paid engineer I wouldn't have been able to "afford" my car for the first 6 months of my working life.
(I could and did afford it, along side holidays, other luxury spending and also house repayments).
This is Irony, right? (Score:2)
...if the bad guys use this stolen data and mess up your credit score.
Referencing, my primary "go to" grammar resource, it seems to case #2
http://theoatmeal.com/comics/i... [theoatmeal.com]
Need an ethical hacker? (Score:2)
in UK and Canada too (Score:2)
https://www.equifaxsecurity201... [equifaxsecurity2017.com]
Easy fix (Score:2)
Insider Trading! (Score:2)
Make them pay!
Re: (Score:2)
It's going to get (much) worse (Score:2)
Regarding computer and data security, it's going to get (much) worse before it gets better. We're currently in the Dark Ages of Computer Security... but we haven't hit bottom yet.
Company culture in this area is just totally, utterly, hopelessly broken. They value speed above all else, so you end up with developers pulling libraries/jars from all over the Internet (many or most with huge security holes), you have companies incentivizing employees to get things done as quickly and cheaply as possible, you hav
Re: (Score:2)
this lady doth not protect enough, methinks (Score:2)
Wow, it's going to take a long damn time for Equifax to out this tiny blemish from their permanent spot record.
"O, but she'll keep her word."
Actually, sorry Hamlet, cat's entirely out of the bag now.
Criminal Negligence? (Score:4, Insightful)
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company.”
So it’s all about his company. What about the havoc his company will wreak on millions of consumers via this data breach? These a**holes collect all manner of sensitive personal data, without our permission I might add, and let it get away from them because the lot of it is on an Internet facing server connected to a web app. I think it rises to criminal negligence.
Speaking of crimes, I expect to see criminal insider trading charges and jail time for those executives who scurried off to sell their shares when the breach was discovered but left us vulnerable for weeks.
Re: (Score:2)
These a**holes collect all manner of sensitive personal data, without our permission I might add, [...]
This is the part where I think the US (and the rest of the world too, for that matter) needs a law like the upcoming GDPR in Europe. That would require anyone to obtain explicit & informed consent, protect data properly, and inform the public timely when this protection fails (the 'timely' bit was clearly not done here).
Re: (Score:3)
What a joke (Score:2)
First off, the executives that sold their stocks while withholding negative information should have that money confiscated and be prosecuted for insider trading (seeing as how they were holding back negative news on purpose to profit.) The retiree pension fund should not take the hit that those assholes created in the first place...
Yet another example of the dire need for legal accountability at the federal level of companies that hold private, personal information. The three credit reporting agencies don
It's time to write Congress demanding reform (Score:5, Insightful)
Right now, someone who has your information but no real proof of identity can borrow money as "you", and the creditor gets to libel you via the credit reporting agencies when they don't get paid.
This must stop. Please write Congress and demand that creditors no longer have the right to libel you as a non-payer unless they can prove it was actually YOU who borrowed their money and failed to repay as promised instead of just someone who had some information about you, that they didn't bother doing due diligence on to verify.
I've already written Congress about this several times, but now it's literally EVERYONE'S information that has been stolen, and the whole nation must face the fact that they are vulnerable to this sort of thing now.
--PeterM
You mean these guys? (Score:2)
http://www.equifacks.com/ [equifacks.com]
Re: (Score:2)
I'm fairly certain if you have applied for credit of any kind, somewhere on the dizzying array of forms in the small print you did indeed consent to sharing your financial information with Equifax. In fact, I doubt there's any kind of main street lender anywhere in the US or Canada that would loan you so much as a penny without consenting to this, so about the only way you could have borrowed money without this consent if it was from a guy in a trenchcoat in a dark alley who went by the name "Vinny the Knif
Re: (Score:2, Insightful)
Neither did Equifax, I'm sure. They're crime is not securing their systems, which would obviously be a very attractive fruit for any hacker to try to pluck, and in a perfect world Equifax would be fined billions of dollars and its management would rot in prison cells for a very long time. As it is, I'm sure the FCC will do some shoddy little investigation that amounts to a few million dollars in fines, there will be a class action lawsuit that probably will see some small fraction of the victims get some me
Re: (Score:2)
Company-destroying fines or jail sentences will probably just mean said companies will do anything to cover up this sort of breach. Moreover, these sorts of breaches can occur even when everything is done as correctly as possible due to things like targeted spear-phishing or rogue employees. We want companies to be able to disclose these sorts of things responsibly, even if it was their lack of proper oversight that caused the problem in the first place (and yes, most of the time it DOES seem to be their
Re: (Score:3)
I don't recall ever being asked by my bank for permission to share information with Equifax or Transunion.
It's buried in the boilerplate you signed when opening your account(s).
The company names may or may not be there. If they are not there, the paperwork uses something vague like "credit reporting agencies" or even "third parties".
Would it really break the US banking system, if there was a way for us to opt out of having our spending history sent to 3rd parties?
Only in as much as you'd never be able to get a loan, rent a house/apartment or open a new bank account ever again.
Why is there this assumption of agreement for this sharing of information?
Because 1) you agreed to it, and 2) centralized reporting is very handy for creditors.
I don't recall any newspaper articles about a national discussion and debate on this decision?
It's not a law, so there was no national debate. Theoretically, banks do not hav
Re: (Score:2)
I once had an identity theft incident, nearly 25 years ago, where a couple credit cards were taken over (mailing address changed, and new copies of credit cards shipped) and a few new credit card accounts opened. I caught the problem early enough that the damage was minor, more nuisance than financial.
But a little digging and simple deduction led me to this conclusion: someone gained access to my full name, mailing address, SSI, mother's maiden name, and multiple open credit card account numbers. Now wher
Re: (Score:2)
Baloney. I just did a search for "Anonymous Coward" and got millions of results. Your info is all over the place.
Re: (Score:2)