Giant Equifax data breach: 143 million people could be affectedI

[Cedar]

Equifax says a giant cybersecurity breach compromised the personal information of as many as 143 million Americans — almost half the country.

Cyber criminals have accessed sensitive information -- including names, social security numbers, birth dates, addresses, and the numbers of some driver's licenses.

Additionally, Equifax said that credit card numbers for about 209,000 U.S. customers were exposed, as was "personal identifying information" on roughly 182,000 U.S. customers involved in credit report disputes. Residents in the U.K. and Canada were also impacted.


Cedar

[Mintbird]

Here's a link to a NY Post article about the breach. At the end of the article is a link that will let you sign up for information on whether or not your SSN was compromised

http://nypost.com/2017/09/07/equifax-breach-compromises-143m-social-security-numbers/

"Equifax is offering every U.S. consumer in the country free identity-theft protection and credit-file monitoring through the website www.equifaxsecurity2017.com — regardless whether their information was compromised, Smith said."

[RitaRose1945]

I'll have to check tomorrow, but this kind of stuff really pisses me off.

[archer]

to add insult to injury:
http://www.mysanantonio.com/business/technology/article/3-Equifax-executive-sold-stock-before-hack-was-12181693.php

[David in MN]

From the nerdy investor guy, had they been so careless with financial information there would be criminal charges and a shareholder lawsuit.

Be wary what you accept from Equifax. Agreeing to their worthless free monitering may include waiving right to sue.

[Mr. Bill]

Be wary what you accept from Equifax. Agreeing to their worthless free monitering may include waiving right to sue.

Exactly correct.

By signing up on Equifax’s help site, you risk giving up your legal rights

...Buried in the terms of service is language that bars those who enroll in the Equifax checker program from participating in any class-action lawsuits that may arise from the incident. ... Friday morning, after social media users began complaining about the arbitration clause, Equifax updated its terms of service to give consumers an escape hatch if they do not wish to be bound by its language. ... This language helps address some of the concerns, but it requires consumers to remember to write to Equifax. ...

And this too:

Equifax asks consumers for personal info, even after massive data breach

...before people can sign up and find out whether their personal information was compromised, consumers are prompted to enter their last name and the last six digits of their Social Security number. ... after signing up, Equifax did not disclose whether their personal data was impacted by the massive breach. Instead they received an enrollment date for the credit monitoring program. ...

[outoforder2day]

Exactly correct.

By signing up on Equifax’s help site, you risk giving up your legal rights

And this too:

Equifax asks consumers for personal info, even after massive data breach

Regarding the first: False. That relates to the right to sue over the TrustedID service, not the breech itself. See the FAQ here: https://www.equifaxsecurity2017.com/frequently-asked-questions/
Go to FAQS for Consumers then click on the last Question, "Does the TrustedID Terms of Use limit my options related to the cybersecurity incident?"

Regarding the second... How else can they see if you were in the affected dataset if they don't ask for information? Is the issue just that it's the last six of the social? Are they just supposed to know you are who you say you are?

Additionally, here is a reddit thread on the topic. https://www.reddit.com/r/legaladvice/comments/6yvj5c/megathread_equifax_security_breach/


EDIT: Fixed FAQ link

[Mr. Bill]

Regarding the first: False. That relates to the right to sue over the TrustedID service, not the breech itself. See the FAQ here: https://www.equifaxsecurity2017.com/frequently-asked-questions/
Go to FAQS for Consumers then click on the last Question, "Does the TrustedID Terms of Use limit my options related to the cybersecurity incident?"

Ah, good.  That paragraph was added since I looked at the FAQ yesterday.

Regarding the second... How else can they see if you were in the affected dataset if they don't ask for information? Is the issue just that it's the last six of the social? Are they just supposed to know you are who you say you are?

Yeah, I'm not sure what the fuss is about that, except that people are understandably leery of Equifax's website security at the moment.  The part that bothers me is that they don't actually tell you whether your data was among those stolen, they just sign you up for the credit monitoring service.  If I knew my data was in the stolen set, I might take precautionary actions, rather than just waiting for a monthly monitoring report to arrive.

[mountainmoma]

Gien the amount of people whose data is comprimised, compared to the population of the country, and given that some of our population is children or others that do not have any credit  -- It seems to me that all of us who have any credit are affected. Or am I doing my mental math wrong ?

350million people in country, over 200million affected -- so, isnt that all adults with credit ? Or, at least, odds are that it is likely to just assume we are affected ?

So, those of you more in tune with this, if we just take it as a given that our data was compromised, what is it we should be doing ?

[AvenueQ]

I saw a recommendation that putting a credit freeze on your credit report would be a good alternative to Equifax's fraud alert monitoring. Anyone have thoughts on this? It seems like it's usually only used in extreme situations, but I think this may count as extreme.

[iam4liberty]

I saw a recommendation that putting a credit freeze on your credit report would be a good alternative to Equifax's fraud alert monitoring. Anyone have thoughts on this? It seems like it's usually only used in extreme situations, but I think this may count as extreme.

Spot on.  Monitoring does very little.  But freezing credit stops a lot of shenanigans.  See here:

http://clark.com/personal-finance-credit/credit-freeze-and-thaw-guide/

[Morning Sunshine]

I saw a recommendation that putting a credit freeze on your credit report would be a good alternative to Equifax's fraud alert monitoring. Anyone have thoughts on this? It seems like it's usually only used in extreme situations, but I think this may count as extreme.

we have a freeze, and have had for years.  We have our house, we are not in the market for vehicles, and we have the credit cards we use.  No need for crazy impulsive credit checks

[David in MN]

Given the (what I would call) poor response and the breadth of potentially effected people one must wonder the chilling effect this is having. Not that I fault people for freezing their credit but from houses to cars to new credit to car rentals this could have a dramatic pullback on sectors. Maybe not the time to be invested in credit companies...

Be wary what you accept from Equifax. Agreeing to their worthless free monitering may include waiving right to sue.

Regarding the first: False. That relates to the right to sue over the TrustedID service, not the breech itself. See the FAQ here: https://www.equifaxsecurity2017.com/frequently-asked-questions/
Go to FAQS for Consumers then click on the last Question, "Does the TrustedID Terms of Use limit my options related to the cybersecurity incident?"

We actually split the difference here if I understand correctly. It was initially set up as I posted and rapidly changed after those of us who follow finance balked. Either way it was a ham-handed effort at best.

I haven't yet done my homework to know if this type of breach is insured and I should buy shares of Equifax (who will no doubt then shrug this off) or if it could effect long term use. I highly doubt you'll ask the lender to check your credit but not with Equifax.

I've got a little bone to pick with Equifax anyway. An upper 700 score? Yup, it turns out my credit would be better if I carried a balance on the card and had a loan on my car. Maybe even if I had school loans. I guess it comes out in the wash because I don't need a loan but still... no reward for making good on my debts?

[City Folk Convert]

I suggest if you haven't done so yet, go onto Equifax and check to see if you were affected. I was displaying normalcy bias until my wife started barking up my tree this morning. Long and behold I drew the short straw and was 'potentially impacted' aka the F'ers got my info - SS#, drivers license, address and name of course.

Spoke with a lot of my colleagues about it, and no one had checked yet. Same with my friends. 50% of the people I spoke with (no exaggeration) were either personally affected or their spouses were. Go figure, out of 143 million people you literally have 50/50 odds.

If impacted, monitor your credit - I use Credit Karma and have found them reliable(and free), and put in place permanent credit freezes with Equifax (takes the longest since everyone else is freezing their credit lines), Experian, TransUnion and Innovis. Takes maybe 30 minutes total. Only cost me $20 - varies by your state.

Some people might consider it a pain in the arse to do so since if you want to open a new credit card (Jack is mind slapping you at this moment) or mortgage, then you need to create a 'temporary thaw' on the freeze and then reinstate, all which cost money. But I think it's worth it. Too many hacks have taken place in recent years. 

[Mr. Bill]

I'm wondering if any of you have tried to get your free annual credit report from Equifax, and run into this:

The security of your information is our priority and it is of utmost importance.  Please help us confirm your identity by providing answers to some questions below.

1.  Your credit file indicates you may have a student loan, opened in or around August 2013.  Who is the credit provider for this account?
 (_) ...some local credit union you've never used...
 (_) ...some random bank you've never heard of...
 (_) ...another random credit union...
 (_) ...another random bank...
 (_) NONE OF THE ABOVE

...followed by three similar questions.  They all refer to accounts you don't have, and the only correct answer for all of them is NONE OF THE ABOVE.

After which Equifax responds with:

Online Delivery Unavailable

...and instructions for how to download and fill out a PDF and mail it in along with copies of various documents.

We tried twice, and got two completely different sets of 4 questions, all with NONE OF THE ABOVE answers.

We did manage to get a free credit report from Experian, and none of the anomalous accounts showed up on it, so I don't really believe Equifax is asking us about actual fraudulent accounts opened in our name.

You don't suppose Equifax could possibly be doing this intentionally, just to slow down the number of credit report requests?  I mean, if that sounds too tinfoily I'll move the question to TFHB...

[RitaRose1945]

Hmmm.  Very interesting.  You usually get one of those at most.

[David in MN]

Every morning on CNBC as Equifax's share price tumbles they ponder why the board hasn't acted to replace management. I have actually shared an elevator ride with one of the board members and have known her through my work to be honorable and I find her silence surprising.

Bear  in mind this is a company whose business is credit security who couldn't keep credit data secure. They then spun it that it was all the fault of a guy with the wrong degree they left in charge of the vault after failing to cover it up. They are in freefall and I wouldn't be surprised by anything.

Equifax sounds like a character from The Canterbury Tales, the security officer who can't stop blabbing. They've done nothing publicly to fix it and held no one accountable. Don't set your watch by a train you know is off the rails.

[iam4liberty]

Equifax sounds like a character from The Canterbury Tales, the security officer who can't stop blabbing. They've done nothing publicly to fix it and held no one accountable. Don't set your watch by a train you know is off the rails.

Remember, the entire board and executive staff are facing jail terms through criminal negligence.  They supposedly knew of the issue and chose to do nothing.  Retaining a music major with no formal education or even basic understanding of the technology as chief security officer is a major piece of the criminal negligence case the government is forming.  For their part they are following the "we can all hang together or we will all hang separately" logic.  They gave her and some other staff members lucrative retirement packages to secure their pleading the fifth.  That is the end game...they will all take the fifth except to make a statement that they acted in a fiduciarily responsible manner.  This will most likely keep them out of jail unless some more junior managers turn state's evidence and provide a smoking gun.  But that is probably unlikely as they have surely been doing a total purge of email and other files during this week before criminal charges can be made.

[David in MN]

Remember, the entire board and executive staff are facing jail terms through criminal negligence.  They supposedly knew of the issue and chose to do nothing.  Retaining a music major with no formal education or even basic understanding of the technology as chief security officer is a major piece of the criminal negligence case the government is forming.  For their part they are following the "we can all hang together or we will all hang separately" logic.  They gave her and some other staff members lucrative retirement packages to secure their pleading the fifth.  That is the end game...they will all take the fifth except to make a statement that they acted in a fiduciarily responsible manner.  This will most likely keep them out of jail unless some more junior managers turn state's evidence and provide a smoking gun.  But that is probably unlikely as they have surely been doing a total purge of email and other files during this week before criminal charges can be made.

I actually didn't think it was that bad. Of course I expect a class action (makes too much money for the lawyers not to) and a shareholder suit. After the recent firings it really does look like the Temple of Doom without Indiana to save the day. It's at the point where the long term stability can be questioned. I was looking to the board to make hard decisions and now I unfortunately agree they are saving their skin rather than tending to the company.

Top 10 funds that own Equifax..
Fidelity Contrafund
T Rowe Price Mid Cap Growth
Vanguard Mid Cap Index
Vanguard Total Stock Market
T Rowe Price Growth Stock Fund
Vanguard 500 Index
Findlay Parks PLC American Fund
MFS Value Fund
SPDR S&P 500 ETF
Manulife Monthly High Income Fund

[David in MN]

Funny how a week can change things. I now have a feeling the board and management will get away with it. I mean, the investors got a 30% haircut and roughly 100 million "consumers" got data stolen but it sure seems like nothing will happen.

I'd feel better if it wasn't only 'the socialist who cries wolf' Elizabeth Warren barking about it. Too bad she finally decided to get something right when she's squandered her capital.

Too bad. I hope there's a shareholder lawsuit but other than settling that to a soft landing it seems you get away by keeping your head down and letting the news cycle 25 hours.

[Alan Georges]

Now this: https://www.theverge.com/2017/9/20/16339612/equifax-tweet-wrong-website-phishing-identity-monitoring

From the article:

... Equifax set up a website — www.equifaxsecurity2017.com — for possible victims to verify whether they're affected. Because the process involves sharing sensitive information, consumers have to trust they're entering their data in the right place, which can be tricky because the breach-recovery site itself isn’t part of equifax.com. If users end up on the wrong site, they could end up leaking the data they're already concerned was stolen.

Today, Equifax ended up creating that exact situation on Twitter. In a tweet to a potential victim, the credit bureau linked to securityequifax2017.com, instead of equifaxsecurity2017.com. It was an easy mistake to make, but the result sent the user to a site with no connection to Equifax itself.

Fortunately the phishing site was set up by a white-hat guy for reasons of his own, mostly it seems to shine a light on what a crappy job Equifax was doing here.  Still.

[David in MN]

And now the SEC admits to being breached.

Can nobody store data? Or do we just resign ourselves to getting new socials when we renew passports?

[bigbear]

   Oy vey... 

[BravoWhiskey]

And now the SEC admits to being breached.

Can nobody store data? Or do we just resign ourselves to getting new socials when we renew passports?

Oh. Well. That's an interesting turn of events. Where'd you hear about it?

My concern is what the bureaucrats have in mind. "Let no good crisis go to waste" is a great mantra for preppers who need to test out a new generator or water purification method, but it scares me out of my gourd to think about what TPTB will be coming up with.

Also, to answer the question, no. The only secure data is that which is permanently air gapped and continously accounted for (thumb drive on your keychain or in your safe,) or data that was provably destroyed, which is even rarer. Sorry to be the bearer of bad news.

Therefore, best practice is to plan for failure by pulling a clean report now, so you've got legs to stand on if/when it gets screwed with later. However, I too experienced an issue similar to this when I tried:

I'm wondering if any of you have tried to get your free annual credit report from Equifax, and run into this:

The security of your information is our priority and it is of utmost importance.  Please help us confirm your identity by providing answers to some questions below.

1.  Your credit file indicates you may have a student loan, opened in or around August 2013.  Who is the credit provider for this account?
 (_) ...some local credit union you've never used...
 (_) ...some random bank you've never heard of...
 (_) ...another random credit union...
 (_) ...another random bank...
 (_) NONE OF THE ABOVE

...followed by three similar questions.  They all refer to accounts you don't have, and the only correct answer for all of them is NONE OF THE ABOVE.

After which Equifax responds with:

Online Delivery Unavailable

...and instructions for how to download and fill out a PDF and mail it in along with copies of various documents.

We tried twice, and got two completely different sets of 4 questions, all with NONE OF THE ABOVE answers.

We did manage to get a free credit report from Experian, and none of the anomalous accounts showed up on it, so I don't really believe Equifax is asking us about actual fraudulent accounts opened in our name.

You don't suppose Equifax could possibly be doing this intentionally, just to slow down the number of credit report requests?  I mean, if that sounds too tinfoily I'll move the question to TFHB...

I won't add to the conjecture other than to say that this seems plausible, especially given that their new breach detection website is apparently giving out randomized results. Even if they were a company of 100% window-licking total idiots (and I know they're not,) they'd know that they have to do something like this; They have to be in damage control mode.

[David in MN]

CEO is out. Unclear at this time but they're saying he "retired". So maybe he still gets his bonus?

At least the board is acting.

[FreeLancer]

In Tuesday's Security Now podcast, Steve Gibson mentioned growing evidence this breach is state-sponsored, likely Chinese.  If that's true, the risk of our personal information being sold for criminal purposes may be very low, but China now has the financial dirt on half the individual citizens of its main adversary.


A Bloomberg article from yesterday:  https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros

“This wasn't a credit card play," said one person familiar with the investigation. "This was a 'get as much data as you can on every American’ play.” But it probably won’t be known if state hackers—from China or another country—were involved until U.S. intelligence agencies and law enforcement complete their work.

[iam4liberty]

CEO is out. Unclear at this time but they're saying he "retired". So maybe he still gets his bonus?

At least the board is acting.

It was in the wall street journal.  He is surrendering about $5 million in scheduled bonuses and severence but is departing with  ~$20 million in pension and other compensation.

[bigbear]

https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros

The hack has the fingerprints of state sponsorship.

The handoff to more sophisticated hackers is among the evidence that led some investigators inside Equifax to suspect a nation-state was behind the hack. Many of the tools used were Chinese, and these people say the Equifax breach has the hallmarks of similar intrusions in recent years at giant health insurer Anthem Inc. and the U.S. Office of Personnel Management; both were ultimately attributed to hackers working for Chinese intelligence.
 
Others involved in the investigation aren't so sure, saying the evidence is inconclusive at best or points in other directions. One person briefed on the probe being conducted by the Federal Bureau of Investigation and U.S. intelligence agencies said that there is evidence that a nation-state may have played a role, but that it doesn't point to China. The person declined to name the country involved because the details are classified. Mandiant, the security consulting firm hired by Equifax to investigate the breach, said in a report distributed to Equifax clients on Sept. 19 that it didn't have enough data to identify either the attackers or their country of origin.

Eventually the intruders installed more than 30 web shells, each on a different web address, so they could continue operating in case some were discovered. Groups known to exploit web shells most effectively include teams with links to Chinese intelligence, including one nicknamed Shell Crew. Some investigators within Equifax reached the conclusion that they were facing Chinese state hackers relatively quickly after analyzing the Moloch data, according to a person briefed on those discussions. If the Equifax breach was a purely criminal act, one would expect at least some of the stolen data, especially the credit card numbers that were taken, to have showed up for sale on the black market. That hasn’t happened.

“This wasn't a credit card play," said one person familiar with the investigation. "This was a 'get as much data as you can on every American’ play.”

[DrJohn]

You cannot make this stuff up...

"This Isn't A Joke: The IRS Just Hired Equifax To Safeguard Taxpayer Data"

Just hours after Equifax CEO Rick Smith wrapped up his testimony before the House Energy and Commerce committee – the first in a series of Congressional “fact-finding missions” about the hack - Politico reported that the IRS last week awarded the disgraced credit monitoring bureau with a $7.25 no-bid contract even as the company struggled to address suspicions that it mislead investors and customers by withholding information about one of the most damaging data breaches in US history.

http://www.zerohedge.com/news/2017-10-04/isnt-joke-irs-just-hired-equifax-safeguard-taxpayer-data