Most likely about half of us has had our personal information, SSN, DOB, stolen from Equifax. The Equifax (EFX) execs sold stock before releasing the news.

If you've ever had a loan or credit card of any sort, you're on file there.

"The potential for harm in the breach of a data broker is extraordinary, in this case potentially leaving 143 million people vulnerable to identity theft, scams, stolen property and accounts and other problems."

http://thehill.com/policy/cybersecurity/349869-five-questions-about-the-massive-equifax-breach

Already had all that info stolen by the Chinese government so I have at least 10 years of my families personal info being monitored

Please note that there have been concerns raised over the TOS (terms of service) for using the provided service to check if you were among the compromised.

https://www.washingtonpost.com/amph...-you-check-equifaxs-data-breach-website/

Edit: I see Equifax has responded to the concerns. Be your own judge.

My sister worked for them for 11 years. They moved a great deal of their operations over seas decades ago. I wonder how much of their IT operations are over seas or outsourced to companies with little oversight or concern for data security. I would like to see a criminal negligence investigation done. The CEO said he was sorry, so I guess that means he is off the hook.


https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do

Some of the comments are very interesting.

I think it's the credit monitoring that the arbitration agreement applies to, but I could be wrong. Checking your name is a good idea. I'm not affected but my wife was. Takes a few days to get the invitation to the monitoring. My problem is that the terms of service read like a sales pitch! More like a free demo than an apology and trying to fix anything.

Freeze your credit by calling the three Credit agencies. You'll need to pay a fee and create a pin number for security. It's only a hassle to lift the freeze for credit approvals, but it will prevent bad guys from opening credit cards in you name, or worse.

The FTC has a list of what steps may be helpful.

https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do

TOS? lol!
These companies hold the credit data of virtually everyone hostage didn't you know? There is no TOS.

You can check here to see if your one of the 143 million with compromised personal information:

https://trustedidpremier.com/eligibility/eligibility.html

Well now... Someone has made it possible to sue Equifax in small claims court using a bot to prepare all the forms:

https://finance.yahoo.com/news/new-website-lets-automatically-sue-equifax-click-214730288.html

And here's the chatbot website:
https://donotpay-search-master.herokuapp.com


I'm not a believer in lawsuits, but I found this interesting. Oh, and apparently my information has been impacted.

CISO of Equafax

Maulding’s education credentials include a bachelor’s degree in music composition (magna cum laude) and a Master of Fine Arts degree in music composition (summa cum laude), both from the University of Georgia.

https://www.hollywoodlanews.com/equifax-chief-security-officer/

After going through the OPM breach, yahoo mail breach, and now this .... i figure it's only a matter of time before my identity gets stolen so I made sure our credit is frozen. Freezing your credit file doesn't affect your credit rating. You can still get a replacement credit card when you need one without having to unfreeze your credit. You will need to freeze your credit at all 3 credit reporting bureaus. Freezing your credit doesn't affect the use of your credit card by you.

For those of you that would be too inconvenienced by freezing your credit (because you take out new apartment leases every year, car loans or your job involves frequent credit checks, etc) then you can place a credit alert instead on your credit file. If you place a credit alert with one of the three credit reporting bureaus, that credit bureau will automatically forward your credit alert to the other two bureaus. Credit alerts however are good for only 3 months . So every 90 days you must place another one. It's very easy to do online and takes very little of your time.

Use the link below to learn more and it also gives you the links to all 3 credit bureaus to easily set it up. I'm going to keep my credit frozen as much as possible for the remainder of my life on the planet. If you're married check with your spouse to have theirs frozen as well.

http://clark.com/personal-finance-credit/credit-freeze-and-thaw-guide/#disqus_thread

FAQ's about credit freezes, et

https://www.doj.nh.gov/consumer/identity-theft/credit-freeze-faq.htm

Well, isn't that interesting. Well, she can teach music in the federal penitentiary for the next 20 years then.

I'm sure it doesn't take much of a technical education to outsource IT data security operations.

Being #%&*$# at your job doesn't put you in prison. She might be sued into the dirt, but jail? I doubt it.

Just tried doing a credit freeze on the Equifax site. It stated they were sorry, put they were unable to complete the request at this time. Probably getting overloaded right now. I wonder how long the wait times are for calling them ?

Considering the type of vital financial information that Equifax has, I'm surprised it took hackers this long to breach their system.

If 143 million people call for credit freezes, isn't that going to have a rather large effect on things ?

Its more than just credit. Someone who has your OL number, ssn, dob, your address history, they can become you.

Haven't checked the news about this, what does the music degree have to do with her going to jail? Did she leak the data?

Being the head of a security department doesn't make her criminally responsible for a data breach unless she facilitated the breach deliberately.

Unprofessional, definitely, but corporations are full of stupid idiots in positions they should not be in. 99% of corporations have idiots in charge of their IT departments.

I know, I am over reacting on the jail thing. I did IT work for decades. I saw my fair share of incompetent people in high levels of management. I assume that any negligence found would be a civil case.

"Senator Orrin Hatch, who chairs the Finance Committee, and ranking Democrat Ron Wyden, also demanded that Equifax Chief Executive Rick Smith provide a timeline of the breach and its discovery. They asked for information on when authorities and the company’s board were notified and when three executives who sold stock in the company in August were first told of the data breach"

Three Equifax Managers Sold Stock Before Cyber Hack Revealed
https://www.bloomberg.com/news/arti...s-sold-stock-before-revealing-cyber-hack

My question now is, have they fixed the leak and can they give the public any kind of assurance that their data is now secure with them ?

143 million people won't do credit freezes as many would be too inconvenienced by a credit freeze because of what they do or their circumstances, etc. Many of them also may never find out they can do a credit freeze or credit alert. The remainder of them are smart and also log into SimHQ for the latest news, tropical weather alerts, scams and coolest sims to play

Even if they can give the public the assurance that their data is safe with them now ..... they've already had half the U.S. populations accounts compromised so its a bit too late !

143 million hackers freezing their new ID's. Changing their addresses, getting new credit cards with their new ID's, and not paying it when the bills arrive.

The thing is, when you call to freeze your credit, how do they know its not a hacker using your new ID? You have to provide a pin number for security reasons. Yeah, that'll be even worse, the hacker now has a pin number he chose and it'll keep you from ever accessing your account.

Where this has all gone wrong is when we got away from hometown banking, and a picture ID so the banks know you are who you say you are.

So if a hacker gets your ID , and then beats you to freezing your credit..... good luck fixing that.

Well when i went online to freeze my credit i was asked about 6 to 8 questions such as:

Q. which of these is your current license plate number ?

Q. which make and model of vehicle did you purchase in 2015 ?

Q. select which range represents how much you pay to your mortgage each month ?

....etc.

FsFoot
Love the picture you have under your name...Still fly it here

Doesn't matter what "security" questions they ask you. If they have the information, then so does the hackers. Again, get to your credit before the hackers do, otherwise you'll have a difficult time proving you are who you say you are.

This is going to lead to facial recognition or fingerprinting or DNA, etc for security. Years ago, facial recognition was the only way people knew you were who you said you were. Yup, I know Bob, that's Bob.

Terrible Two ...."Doesn't matter what "security" questions they ask you. If they have the information, then so does the hackers"

while some of the questions they might know the answers to ..... some of the questions they ask you it would not be easy for the hackers to know the answers to or even likely that they could find out as its not the kind of information they could get from your credit file.

II still think this has the potential to become a very big problem for millions of people.

Yes, I think it could. Even down the road. The offered free monitoring service is only good for 1 year, so that almost puts a date for thieves to "sit" on the data and wait until guard may drop. And it's not as though the stolen credentials can be changed by any of us with any ease (or at all).

Looks like I am one of the "victims".

I am now in my 50s and a 'model' for the 20 somethings living in there parents basement. I did not have the guts to join the military when I got into trouble at the end of high school, so off to relatives in California. When I returned home with a new wife (now ex and no kids) in tow, my parents moved out. yes I know how opposite that is

Jump 30 years into the future:
I have an excellent credit rating because I have repaid the debt from two failed business ventures, but I am a terrible business man. I am in debt well past the 8K (I have not made more then 15K since Y2K or so)(it is not a lie. No wife, No kids, Can live on the cheep) a year I earn. don't think you can mod a game and become a millionaire. How does this breach of credit affect me? I do not have a pot to piss in. My home is not owned by me but is owned by family. The cost of insurance is almost more then the cost of cab fare for the 2K miles I drive a year. The last car I owned which was less then 8 years old was a 1987 Fiero.

Before I get too side tracked in a pitty party for a truly lucky boy, why should I care about this breach? I have a good reputation for my motorcycle repairs and a well earned reputation for repaying my debts. But, I have not had an above poverty income for 20 years. How can scammers who live on more then me profit from my personal information.

PS, my life was not bad so do not pittey me.

Okay, so maybe a bit of good news.

Since they know which records were compromised, they've set up a search of their database to see if one is part of the stolen database:

https://www.equifaxsecurity2017.com/potential-impact/

Enter your last name and the last six digits of your SSN, and it will say if one was part of the hack.

Of course, it could just be a "feel good" sort of thing that gives a negative response every time - but that would be a huge gamble on their part, litigation wise.

Nope, it isn't that.

Okay, so maybe a bit of good news.

Since they know which records were compromised, they've set up a search of their database to see if one is part of the stolen database:

https://www.equifaxsecurity2017.com/potential-impact/

Enter your last name and the last six digits of your SSN, and it will say if one was part of the hack.

The wife came up hot, "you may have been compromised," but mine said "you haven't taken out a loan or used credit in twenty years, who are you, anyway, some kind of poor person or strange prepper type? Don't worry about it." Or words to that effect.

Pretty much anything that doesn't require face to face. Think what havoc I can create once I have your info. Fraudulent tax returns. Attempt to have all you passwords changed, not just online stuff but banking stuff. The credit report shows all cards you have, I can call the issuing bank and say I can't recall my password, or pin number, need a new one. They ask for SSN, address, DOB, many identifying things about you that are on the credit report (not the one you get when you pay for a report). The credit companies have boatloads of personal info about you. Now that have your credit cards canceled and new ones issued with a new pin in your name. Now exactly what are you going to do? Call the credit card company? Lol. How do they know that YOU aren't the hacker?

I wouldn't brush this off. If you one of the identities someone decides to use, your sol.

Problem with biometric online verification (Face Recognition etc.) is that you can change your password if it gets compromised. You can't change your face if someone finds a way to fake it in an online process...

If new credit cards are issued they will be sent to the address on record. Also those credit cards will have your name on them. When you call your credit card company they know what telephone number you should be calling from. If they see that you're not calling from a recognized phone number it will trigger an "out of wallet" question. The representative will ask you a question or several that you would not be able to find from a credit report.

However, security as we all know is multilayered and requires taking precautions in all areas:

Computer security, online security, email security, credit freezes and credit fraud alerts, telephone security, shredding paperwork with sensitive information on them instead of tossing in the garbage. I wonder how many people who had their identity stolen made bad mistakes in the areas i just listed rather than having their SS# and name and address compromised only without any other security mistakes.

We also depend on security from the representatives of the institutions we're doing business with so if they don't do their job properly ...well ....as individuals we can only do so much with such things.

I'm sure all those people trying to rebuild their lives after Harvey and Irma don't need the extra aggravation of having to deal with credit freeze right now. My sister works at a Credit Union call center now. She says, as Haggart pointed out, there are steps in place to protect the consumer.

So from here on out, every time you need to open some kind of credit line, you have to go and un freeze everything. Welcome to the new normal.

Remember too that you can for now just do a credit fraud alert which is free ....doing just one automatically sends it to the other two credit bureaus and its good for 90 days. Also, you can ask the company you are dealing with which credit bureau they will be using to check on your credit so you only have to unfreeze that credit report and not from all 3 credit bureaus

T2,
My large credit credit card had allowed me to bill it months after my active card expired. I did not renew it, or call that I had received the new card., Yet, they continued to allow me to bill it. When I did call with regrets of my drunken play, the answer I got was that the billing account was one that was common to my account, so they let it process. It took months before they declined the card number. How is this any different that a hacker that knows my #s

Update on Equifax - Why the Data Breach Happened In One Sentence

The breach happened because Equifax security staff failed to promptly install a security fix to a flaw found in a web application tool used by many major corporations, the industry group that oversees the open-source software said earlier this week.

Hackers took advantage of a window when the flaw was known but not fixed, which lasted two months, to penetrate the company's digital defenses.

Equifax faces at least 23 proposed class-action lawsuits over the breach and a federal probe from two agencies. Its stock has lost more than a third of its value since the breach was disclosed.

Two top Equifax security executives fired effective immediately. In addition, Equifax could lose its government contract with the Social Security Administration

http://www.reuters.com/article/us-e...pany-effective-immediately-idUSKCN1BQ2WN

Personally, I think Equifax should be fined and sued out of business. There's no excuse for something like this to happen, EVER. It's just one more reason why I think computers that store or work with sensitive data should never, EVER, be connected to the web or be networked using anything other than wired connections. If an employee needs data that's physically located at another location, a licensed, bonded courier can bring it on a flash drive or other medium. People will just have to get used to not being able to open new credit cards or take out loans instantly online or in a store.

The whole "Cloud" thing has made data storage so much cheaper that companies are just willing to risk there ever being a breach (IMHO). The top people at Equifax will find some lower level managers to scapegoat, the media and congress will accept it, and it will be business as usual.

In case it hasn't been mentioned - they also stole the credit card numbers of over 200,000 people

If it was healthcare organization they could have been fine $50,000 per person's data stolen. So 143,000,000 x $50,000 = $7.15 trillion. But I'm sure Equifax is "too big to fail" or at least allowed to. I believe the top two IT security people were fired but I'm pretty sure if its anything like our organization administration has until recently put information security as a low priority. In our team meeting last week we even discussed what was left to protect at this point other then patient records.

Financial Institutions need to have an equivalent to HIPAA legislation. Unfortunately, as we have seen many times, they answer to no one.

https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

"What you'll need to open an account:

A few minutes to complete this form
Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN)
Foreign tax ID, passport, or visa number (if you're not a citizen or permanent resident of the U.S.)
Employer's name and address"


Just an example of what can happen when someone has the above info. About to open an investment account and have all the required info needed. Fund the account with stolen credit card, make huge trades, take huge losses, and slip back into the shadows. The real person is then hit with the losses. Prove you weren't the one doing the trading?

See here's the problem facing these innocent companies, how do they know that YOU aren't a criminal yourself? Just because you have your ID stolen, allegedly, doesn't automatically make you an upstanding citizen. How do they know you haven't just taken advantage of the identity theft, make some bad deals, then claim it wasn't you?

If anyone wants to brush this off be my guest. The time and frustration of proving your innocence isn't worth it.

I froze my credit and my wife's credit at all 3 credit bureaus and that's the way it will stay

"In a statement to Bloomberg, Equifax said the March hack was not related to the one that exposed personal and financial data of up to 143 million Americans between May and July, but sources told Bloomberg that the same intruders were responsible for both breaches."

So despite being hacked in March, Equifax continued using the software with the flaw that allowed the cyber criminals entry

An update on this situation...

Equifax awarded $7.25 million dollar contract with IRS to detect fraud

Can't make this stuff up!

WTF, to award a guilty Corp over this.

Someone in Congress must have gotten a huge BJ and cash from some Equifax executive.

only have 1 more credit freeze to go for younger son - it's taken several weeks to get the credit frozen for all my family members.

As a result of that breach (and other breaches over the past 5 years including email breaches) it's become crystal clear that your good credit needs to be good frozen credit



If you're a U.S. citizen or even of the UK it is almost a certainty that your credit information will begin to be sold on the dark web either this year or next - after that you stand an excellent chance of having your identity stolen.

Maybe we should all just go and destroy our credit right now. All of us, come on, let's do it. I'm going to DIsneyland ! Then I'm buying a little place in Aspen. All on my Visa.

Don't worry your credit might be destroyed soon enough - you'll get a letter one day asking you to pay your first installment on the vehicle you just purchased last month or the IRS tells you they already sent you your refund check except this time it's going to another address

I already have spent hours doing the freeze thing for me and my family. I am at the point now where I don't worry about it.

I get this guy to freeze my credit,

then

it's a shame we have to do that but the cyber crimes are not getting better - the security situation of our identities has not improved - it took a curve downhill and social security numbers are no longer a secure form of identity

That looks like my CPA. Oh, no !

Equifax incompetent?

When was the last time you talked to supervisor in ANY government department?

The Equifax breach doesn't seem to indicate incompetence. What it shows is that even when your vulnerability assessment (including testing) says you don't have to patch, you should patch anyway because the vulnerability reports might not be entirely accurate.
That's what happened. They examined a particular vulnerability, decided they weren't vulnerable, but the vulnerability report and description was a symptom of the real problem which was only understood later. My 2c of understanding what happened. YMMV.

PS: Yes, there are reasons to not patch or to defer patching. Patching can lead to down-time in various ways.

At this point it doesn't matter to nearly half the U.S. population how it happened and if you add all the different breaches in which they obtained a piece of your information (the yahoo email breach involved 3 Billion people & that includes me) then it's clear that it's not "if" they have stolen your identity but a question of "when" will you receive the request letter to start paying your new car loan.

IDENTITY THEFT REPORTED BY HOUSEHOLDS ROSE 33 PERCENT FROM 2005 TO 2010 (Bureau of Justice Statistics)

"Approximately 15 million United States residents have their identities used fraudulently each year with financial losses totalling upwards of $50 billion.
On a case-by-case basis, that means approximately 7% of all adults have their identities misused with each instance resulting in approximately $3,500 in losses."

The good news is that completely stealing your identity and taking out new loans is not at the top of the charts and what is more likely to happen to you is:

"Among identity theft victims, existing bank (38%) or
credit card (42%) accounts were the most common
types of misused information"