Link: Huge data theft on Equifax - action needed by everyone...

CrimsonNagus said:

In fact, a system similar to Apple Pay or Google Wallet should be develop that you can use when applying for credit. Apple Pay uses AES256 encryption and your device randomly generates a different number each time you use it with a merchant. So even if a criminal captures the number leaving your device they can't use because it is only good once.

It's time this country end its reliance on SSNs, they have never been secure because we have to write them down on almost every official form that is filled out for anything. I'm okay with going to a national ID system where everyone has an ID card with a secure chip embed like credit cards. This card would have to be shown every time you apply for anything, cash a check, pay with a cc, basically anytime you need to prove your identity.

Click to expand...

CharminTide said:

If we had a functioning Congress, it might even be something that could be brought up for debate.

Click to expand...

CrimsonNagus said:

I just can't believe I have to pay to freeze my own credit report! That's freaking criminal. I should control my credit report, not these idiot companies. I should be able to securely, with 2 stage authentication, log into one website and be able to monitor my credit report, freeze, unfreeze and dispute items completely free of charge. I should also be able to setup personal secret pass codes that are used instead of SSN to apply for credit. I should also be able to change that pass code whenever and how often I wish.

In fact, a system similar to Apple Pay or Google Wallet should be develop that you can use when applying for credit. Apple Pay uses AES256 encryption and your device randomly generates a different number each time you use it with a merchant. So even if a criminal captures the number leaving your device they can't use because it is only good once.

It's time this country end its reliance on SSNs, they have never been secure because we have to write them down on almost every official form that is filled out for anything. I'm okay with going to a national ID system where everyone has an ID card with a secure chip embed like credit cards. This card would have to be shown every time you apply for anything, cash a check, pay with a cc, basically anytime you need to prove your identity.

So, it will cost me $60 to freeze both my wife and me's credit reports. Plus, it cost $10 each time you want to temporarily unfreeze your report when applying for credit. Do you have to temp unfreeze for all 3 when applying for something, because then it's $30? Or just tell them to run your credit with "this" reporting agency? Seriously asking because I'm leaning towards freezing our reports. I have also read that you should consider freezing your kids reports. Is this really necessary for my 3 kids who are 9, 7 and 7? That would be $150 to get all of us done.

Something has to be done because these companies have proven time and time again that they don't care about protecting our data. Then they turn around and charge you when you ask them to protect your data more. I'm so p'd that they charge you to do this, that is criminal in my book.

I will join any and every class action suit against Equifax and I'm considering looking into that app Jon posted about if it turns out to be legit. Not because I care about getting money from Equifax but because I truly believe that they need to be buried for this and bankrupted beyond there wildest dreams. Upper management, CEO and even the head IT security guys should face jail time IMO.

Click to expand...

TIDE-HSV said:

Lotta hassle in Alabama. Unless they just raised the limit, it's $6K and you have to prove, as in California, that you've asked them for recompense first, and, as they say, you have to find an agent upon whom to serve process. They biggest problem, IMO is proving damages. Apprehension doesn't count. You'd have to prove that their breach actually cost you money. By the time it did, it would be far, far greater than $6K...

Click to expand...

Bamaro said:

Froze mine on Equifax today. Easy and free. Haven't decided to do it with other two yet.

Click to expand...

I'm not sure where to post this, but noticed something had changed on the TransUnion website about freezing credit this morning when I was giving links to family so they could freeze theirs.
I froze my credit the day after news about the Equifax breach broke, and it looks like TransUnion has since changed their site to push people away from freezing their credit in favor for their own product called TrueIdentity (like what Equifax was doing with their TrustedID Premier.)
The FTC website links to this page for freezing your credit with TransUnion.
This is what the website looked before the changes were made on 9/11. The instructions on placing a credit freeze were clear and there was no mention of their own TrueIdentity product.
If you want to place a credit freeze with TransUnion now:
You have to get through a page of info about credit and fraud, and then the action it tells you to take is to "Lock your credit information by enrolling in TrueIdentity."
The option to freeze your credit is under "About credit freeze", deliberately passive in their use of language
The description about credit freezing is dissuasive: "A credit freeze may be available under your state law"
The link for the credit freeze is also a passive "click here" compared with "by enrolling in TrueIdentity" language used for the link to their own product.
Clicking the link to learn more about credit freeze brings you to yet another page that tries to convince you to enroll in their product over placing a credit freeze
After searching through their page of BS, you finally get to the link to freeze your credit.
This is such a blatant attempt by TransUnion to take advantage of the Equifax breach for their own financial gain. It's a ....ty thing for TransUnion to do, and people should be aware that they are being led away from putting an actual credit freeze on their account.
(Edited for formatting on mobile)

Click to expand...

The Equifax breach that exposed sensitive data for as many as 143 million US consumers was accomplished by exploiting a Web application vulnerability that had been patched more two months earlier, officials with the credit reporting service said Thursday. "We know that criminals exploited a US website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638. We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement."

The flaw in the Apache Struts framework was fixed on March 6. Three days later, the bug was already under mass attack by hackers who were exploiting the flaw to install rogue applications on web servers. Five days after that, the exploits showed few signs of letting up. Equifax has said the breach on its site occurred in mid-May, more than two months after the flaw came to light and a patch was available.

Thursday's disclosure strongly suggests that Equifax failed to update its Web applications, despite demonstrable proof the bug gave real-world attackers an easy way to take control of sensitive sites. An Equifax representative didn't immediately respond to an e-mail seeking comment on this possibility.

Click to expand...

CharminTide said:

Failure to patch two-month-old bug led to massive Equifax breach

Click to expand...

The credit report provider Equifax has been accused of a fresh data security breach, this time affecting its Argentine operations.
Cyber-crime blogger Brian Krebs said that an online employee tool used in the country could be accessed by typing "admin" as both a login and password.
He added that this gave access to records that included thousands of customers' national identity numbers.
Last week, the firm revealed a separate attack affecting millions in the US.
After being notified of the latest breach, Equifax temporarily shut the affected website.
"We learned of a potential vulnerability in an internal portal in Argentina which was not in any way connected to the cyber-security event that occurred in the United States last week," an Equifax spokeswoman told the BBC.
"We immediately acted to remediate the situation, which affected a limited amount of information strictly related to Equifax employee

Click to expand...

TideEngineer08 said:

More from Brian Krebs. Apparently Equifax's Argentinian web portal had been set up with very poor security. That is to say, none whatsoever.

https://krebsonsecurity.com/2017/09/ayuda-help-equifax-has-my-data/

Click to expand...

Jon said:

it's crazy, it's been 20 years since I sold them anything directly but the people I worked with at Equifax were always top notch then, but 2 months to fix a known exploit? Insane


then there is this http://www.bbc.com/news/technology-41257576



My 76 year old Mom knows better than to leave the default login and password

Click to expand...

TideEngineer08 said:

The link from Krebs' website above..

Click to expand...

crimsonaudio said:

Goodness!

Susan Mauldin, Chief Information Security Officer (CISO) at Equifax Inc when the massive data hack occurred, was a music major

SMH

Click to expand...

Jon said:

The best security guy I've ever worked with has a high school degree and 1 semester at the Art Institute, I'd give him a CISO gig anywhere and never sweat it

so the major doesn't really matter

but he also never screwed up even close to this

Click to expand...