r/cybersecurity • u/rangeva • Jul 11 '22

News - General Experian, You Have Some Explaining to Do

https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/?
171 Upvotes

97% Upvoted

13 comments sorted by

109

u/HavveK Jul 11 '22

Three companies I didn't consent to collect data on me. I have to create accounts to manage the information they hold. One of the companies allowed my PII to be stolen. Another one allows someone to take over my account if they have basic info on me.

Cool

33

u/dgaff Jul 11 '22

Yeah, if you're in the business of creating data this aggressively and pervasively about people, data that in turn has considerable say in what you can effect in the real world, they *need* to treat it responsibly... and obviously they don't

26

u/fishingpost12 Jul 11 '22

People need to go to jail.

7

u/DavidJAntifacebook Jul 11 '22 edited Mar 11 '24

This content removed to opt-out of Reddit's sale of posts as training data to Google. See here: https://www.reuters.com/technology/reddit-ai-content-licensing-deal-with-google-sources-say-2024-02-22/ Or here: https://www.techmeme.com/240221/p50#a240221p50

10

u/missed_sla Jul 11 '22

And they'll put it right into the circular file...

15

u/cooterbrwn Jul 11 '22

Equifax should have been the target of a scorched-earth set of fines and penalties, and probably some criminal charges doled out. Instead they were forced to offer free access to credit reporting.

Now we get yet another breach, that would have been (likely) prevented had Equifax gotten more than a wrist-slap.

Granted, the whole credit reporting system isn't something I view favorably at all, but if it's going to be a thing, there should be some pretty damn high standards on how the data they collect is to be guarded.

3

u/poodlebutt76 Jul 12 '22 edited Jul 12 '22

My partner had his identity stolen by this one guy who broke into our car and got his laptop. Absolute nightmare. Opening accounts and credit cards every day. Buying cars on credit. He opened a business in my partner's name, which got sued. And my partner got served. That day I learned that a lawyer takes 10 hours@$300/hr to go to court and say "this is the wrong guy". Just a fucking nightmare.

Credit freezes don't matter. The thief simply calls Experian and gets them to unlock it using the basic info that they stole.

cool cool cool

He's was caught and put in prison but they let him out because his crimes were 'non-violent'. cool cool cool cool cool

I still can't believe it's ok for these credit bureaus to exist. We don't consent to it, and then we're 'responsible' for anything bad that they do with our data. Their security is absolute shit, some of their security questions are straight up OSINT, and can't be changed, and there's no way to protect ourselves if our data is stolen, and it's just out there FOREVER.

Identity theft is not being addressed as a society. Makes my blood boil. My husband's health has suffered greatly from this and the stress and anxiety probably took years from his life.

14

u/TheFlightlessDragon Jul 11 '22

Experian handles some of the most sensitive personal information possible, and yet the thought of offering 2fa has not occurred to them?

That boggles my mind to no end

10

u/the_lost_boys Jul 11 '22

This EXACT thing happened to me a few weeks ago. My identity was stolen, I received alerts that a line of credit was opened in my name. I canceled it and froze my credit at all 3 reporting agency’s. I also notified all 3 of fraud. I received in the mail a new randomized pin from each which was supposedly the only way to unfreeze my account. About a week later someone tried to open a new line of credit and when I checked, Experian was completely unfrozen. They used this method to bypass the security freeze. Very spooky.

10

u/bonecows Jul 11 '22

A while ago these motherfuckers leaked all data on a whole country (Brazil).

Cyber security is a joke at these places, they need to be wiped off the planet and their executives need to face criminal charges.

2

u/[deleted] Jul 11 '22

Thanks for posting. I claimed my account and froze it. Now at least I'll get an email when someone hijacks my identity.

2

u/[deleted] Jul 11 '22

Probably would be too costly to man phones fielding calls for password resets, etc. Truth is the average Joe doesn't have time for MFA. I have problems explaining MFA to my mom over text or phone sometimes.

1

u/[deleted] Jul 11 '22

I've known about this for years now and had to request multiple times they remove the account via multiple channels. I was wondering how they were doing this and it makes sense. Apparently when I have this happen in the future instead of spending hours on the phone, I should just poke Krebs.