PBI hacked?

[GH85Carrera]

I received a letter from PBI or Pension Benefit Information. I had never heard of them, and I did not even know who they were.

Anyway the letter states that on May 31st, they were hacked with the MOVEit exploit. Evidently my name and SSI were copied.

So a company that I do not, and can't even deal with has crappy security, and my name and SSI gets hacked by thieves.

They are paying for a year of credit monitoring with Kroll Monitoring Services. Again, never heard of them. Oh, and they want my name address and SSI to sign up. So another possible hack can happen?

From what I can see online, Kroll is a real company and not some scam, and so is PBI.

[wilnj]

That sucks.

I had something similar happen except in my case, someone in payroll fell for a fishing scam and emailed an excel spreadsheet with W2 data for 4000 employees.

My former employer paid for Kroll. I would reach out to PBI directly first.


Sent from my iPhone using Tapatalk

[masraum]

Originally Posted by GH85Carrera

I received a letter from PBI or Pension Benefit Information. I had never heard of them, and I did not even know who they were.

Anyway the letter states that on May 31st, they were hacked with the MOVEit exploit. Evidently my name and SSI were copied.

So a company that I do not, and can't even deal with has crappy security, and my name and SSI gets hacked by thieves.

They are paying for a year of credit monitoring with Kroll Monitoring Services. Again, never heard of them. Oh, and they want my name address and SSI to sign up. So another possible hack can happen?

From what I can see online, Kroll is a real company and not some scam, and so is PBI.

I think that part is the key. Over the years, I've gotten emails from every bank you can think of and many that you haven't about "my" account, except that I don't have an account with them. It's a shotgun approach that they hope will trick the not terribly savvy folks.

Send 10 million email addresses an email about a free service. Some folks that are not that smart, and probably a little greedy ("I don't know what this is about, and I don't have an account, but I'd love to get something for free") will click the link and enter all of their info in the bogus website so that the folks behind the website and emails will have a ton of their info including name, address, phone number SSN, whatever they pick as a password (which is probably one that they use on every site) and probably a credit card.

[GH85Carrera]

Originally Posted by masraum

I think that part is the key. Over the years, I've gotten emails from every bank you can think of and many that you haven't about "my" account, except that I don't have an account with them. It's a shotgun approach that they hope will trick the not terribly savvy folks.

Send 10 million email addresses an email about a free service. Some folks that are not that smart, and probably a little greedy ("I don't know what this is about, and I don't have an account, but I'd love to get something for free") will click the link and enter all of their info in the bogus website so that the folks behind the website and emails will have a ton of their info including name, address, phone number SSN, whatever they pick as a password (which is probably one that they use on every site) and probably a credit card.

I did not blindly follow the instructions. Look online at several sites. PBI is a real company, that deals with pension data to various providers. They don't deal with the individual customers.

Kroll has been around for a long time as well. They are not some fake company.

Many years ago Home Depot had their credit card system hacked, and it has a list of all the customer info on a credit card and they provided me a free year of monitoring.

[stevej37]

Both real companies...PBI Blaster and Kroll Penetrating Oil.

[MBAtarga]

Wife and I got a letter last week from Genworth Life insurance company we've used for about 20 years - reporting a similar hack from the MOVEit exploit as reported to them by PBI! They are also providing the same monitoring service from Kroll.

From our letter: PBI Research Services (PBI) - is a 3rd party vendor used by Genworth to satisfy regulatory obligations to scan various databases to determine whether a customer
may have passed and triggered death benefits, etc.

So it looks like PBI got hit.

[rwest]

Yes, those may be real companies, but did the email come from them and is the link to the monitoring company real? Anyone can say they are that person or company to try and trick people into giving out personal information.

Hopefully you did not click on anything?

[MBAtarga]

Difficult to "click" anything when the USPS delivers a first class envelope with a letter inside.

[rwest]

Originally Posted by MBAtarga

Difficult to "click" anything when the USPS delivers a first class envelope with a letter inside.

Ahhh, my reading comprehension isn’t what it should be!

There should be some real world consequences for the “c” suite if their cybersecurity is lacking and/or if they collect and store more information than is needed for them to do business.

[masraum]

Originally Posted by GH85Carrera

I did not blindly follow the instructions. Look online at several sites. PBI is a real company, that deals with pension data to various providers. They don't deal with the individual customers.

Kroll has been around for a long time as well. They are not some fake company.

Many years ago Home Depot had their credit card system hacked, and it has a list of all the customer info on a credit card and they provided me a free year of monitoring.

Bank of America, Ameritrade, etc.. are a real companies. I've received bogus emails that were supposed to be from all of those and many more. The thing is that the email isn't really from the company. It's from someone that made an email that mostly looks like it's from those companies, but the email isnt' REALLY from those companies.

[masraum]

Netflix is a real company, but this email is fake.



another fake email


another fake email that's imitating a real company


I could do this all day...

[john70t]

It's easy to take a website's .html and spoof it.
Some email links look authentic but are not when examined. Krol1 vs Kroll. Or bobby.Kroll.com. A roll-over shows an AOL account. etc.

Same with sending information to 'official address'.
It will be a PO box at a drop building, along with hundreds of other vapor accounts.

Only deal with proven company contacts, and even then give them the limited information required.
(oh, and the IRS/FBI/Police will never call you for a payment to avoid jail)

[GH85Carrera]

It was NOT an dang email. It was a two page analog old fashioned letter from them!

[masraum]

Originally Posted by GH85Carrera

It was NOT an dang email. It was a two page analog old fashioned letter from them!

That's super weird. I'd be contacting them and asking them why/how they had my info. I'd be curious if they had some sort of account for me that I didn't know about. Maybe you've got a couple of million bucks sitting in an account that you don't know about. I'll take a 5% finders fee for whatever you get from them.

[red 928]

Originally Posted by GH85Carrera

It was NOT an dang email. It was a two page analog old fashioned letter from them!

so ... you're saying it WASN'T an e-mail?

[GH85Carrera]

Like most people, I had never heard of PBI. I don't have any direct accounts or contact with them at all.

https://cybernews.com/news/pbi-data-breach-moveit/

Pension Benefit Information (PBI), a US-based population management solutions provider, discovered another MOVEit Transfer related breach that exposed its users. The total number of exposed users exceeds 2.5 million.

Evidently they do some sort of data management for pension plans, and they deal with financial institutions only.

https://www.pbinfo.com/letter/

This link explains it all. And don't worry, it is not a bad pookie link, just information.

I get Phishing emails on a regular basis, and they all go straight to my spam folder. And I never ever click on a link in an email except one I was expecting, or one from a very trusted source, like my business partner.

[Zeke]

No one mentions the Kroll biz wanting your SS?

[GH85Carrera]

Originally Posted by Zeke

No one mentions the Kroll biz wanting your SS?

Kroll is a legitimate credit monitoring company. They will watch for any attempts to get credit, or new ID on my information for 12 months. They have been in business for 50 years, the beginning of the consumer computer era.

Like going to a credit bureau, they want the SSI to know what to monitor. And they asked some multiple answer question no scammer would know. Like what street name did I live on once, and the list was 6 wrong answers, and only one from 33 years ago.

Jules Kroll founded Kroll Inc in 1972 and its a reputed organization worldwide.

https://eveninsight.com/kroll-monitoring-review/

I even searched for Kroll scam and this was one site.