Data breach at Equifax

[Evans, Marv]

I wouldn't think you'd have to sign up to be compromised. I'm assuming whoever breached their database just mined the data available to them at the time/period of time they were in there. That would mean whatever info that was there was taken. Could be somebody else more savvy about this would be more informative.

[Porsche-O-Phile]

Yep, it's a great business model:

They collect all kinds of personal information about you without your consent (well, your "consent" is given when you apply for credit anywhere or interface with our financial system in any way like getting a mortgage, a student loan, credit card, car loan, bank account, etc. so good luck functioning in society without it...) If you DON'T want them to sell this to other people, they make you pay for the privilege.

I can't wait to hear how much of this involved their use of "offshore" servers, IT people, etc. that are not subject to U.S. cyber security laws, protocols, etc.

Prediction: there will be a humongous class action suit that they'll settle for probably eight or nine figures (if not more) and the people affected will get jack ("a year of free credit monitoring" or some B.S. with no tangible value that 99.99% of people will never take them up on anyway or even be able to figure out how to obtain), and of course "no admission of wrongdoing".

Our system is the best. 'merica!

[RANDY P]

Credit monitoring- HAHA.

Now there's a useful tool.Good for telling you you're compromised and you're about to have many sleepless nights thanks to the idiots at Equifax. Gimmcky and useless.

I hope EFX gets sued big time.

rjp

[ossiblue]

Originally Posted by Porsche-O-Phile

Yep, it's a great business model:

They collect all kinds of personal information about you without your consent (well, your "consent" is given when you apply for credit anywhere or interface with our financial system in any way like getting a mortgage, a student loan, credit card, car loan, bank account, etc. so good luck functioning in society without it...) If you DON'T want them to sell this to other people, they make you pay for the privilege.

I can't wait to hear how much of this involved their use of "offshore" servers, IT people, etc. that are not subject to U.S. cyber security laws, protocols, etc.

Prediction: there will be a humongous class action suit that they'll settle for probably eight or nine figures (if not more) and the people affected will get jack ("a year of free credit monitoring" or some B.S. with no tangible value that 99.99% of people will never take them up on anyway or even be able to figure out how to obtain), and of course "no admission of wrongdoing".

Our system is the best. 'merica!

Current information states that the breach was done through a weakness on their website, in other words, it was accessed through the "front door" of the legitimate interface, not through a hack into the servers directly. Of course, that's just the information we've heard so far--along with the information that the three execs who sold $1.8 million of their stock in an unscheduled sale after the breach, but before it was made public, did not know of the breach themselves. Yeah, I believe that.

[OffCamber00]

Originally Posted by ossiblue

Current information states that the breach was done through a weakness on their website, in other words, it was accessed through the "front door" of the legitimate interface, not through a hack into the servers directly. Of course, that's just the information we've heard so far--along with the information that the three execs who sold $1.8 million of their stock in an unscheduled sale after the breach, but before it was made public, did not know of the breach themselves. Yeah, I believe that.

Correct. The breach occurred via exploit of a well-known web related vulnerability. This simply should not have happened. Additionally, it was discovered during routine maintenance and not as a result of the actual breach itself. smh

[pwd72s]

And we the victims had nothing to say about it. All done without any informed consent on our part.

[masraum]

Originally Posted by pwd72s

So, do you have to sign up with equifax to have been compromised? I'm a 'puter illiterate, so have trouble understanding what's going on. Cindy & I don't have a need to borrow, and our home has been paid for since the early 90's. We have used credit cards, but pay them off when the bill comes.

Originally Posted by ossiblue

Short answer is NO, you don't sign up. If you have established credit of any kind, it is reported to the three companies, typically. You don't have a choice.

What he ^ said.

If you have had a mortgage or car loan or credit card (used or not) or line of credit or anything in the last 30 years, then Equifax, Experian and Transunion has your info. Even if a company has run your credit and sent you a letter in the mail saying that you're pre-approved for a credit card, then your info is in there.

[cabmandone]

From the reading I did after I found out my personal information (name, address, SS#) had been part of a medical records (thanks for that ACA!) office hack, you can't really sue until there are actual damages. The courts have ruled that just having your personal information stolen isn't enough.

If you really want to have fun, ask them what type of encryption they used for your data. The people at the medical records office were clueless as to what I was talking about.

The real gimmick is, they collect your data (SS# included) and charge you to freeze that information. They then charge you each time you unfreeze it. Some states it's mandatory that if you've been part of a data breach they can't charge you to freeze your credit. In others like Ohio, it's only free if you have actually had someone try to use that information to open an account. Pretty sweet racket places like Equifax, Experian and Transunion have.

[GH85Carrera]

This is supposed to be the site where you can see if you are at risk.

https://www.equifaxsecurity2017.com/potential-impact/

[legion]

Now I'm hearing that if you sign up for their free credit monitoring, the fine print says you are agreeing the binding arbitration and giving up the right to any settlement.

[GH85Carrera]

Originally Posted by legion

Now I'm hearing that if you sign up for their free credit monitoring, the fine print says you are agreeing the binding arbitration and giving up the right to any settlement.

The only settlement money will go to lawyers. The people in the class action might get a few bucks at most. The lawyers will get rich.

[Porsche-O-Phile]

To further shed light on just what a rotten, horrible sleazebag company this really is, read the below (they're now trying to walk back their "we'll give you free* credit monitoring if you agree to give up your right to sue us despite our gross negligence" position). For one I'd love to see them sued right into bankruptcy but as stated earlier the eventual outcome is predictable - a settlement out of court with "no admission of wrongdoing" in response to a class-action suit wherein the real victims (143 million people, give or take) get absolutely NOTHING of real value - just "free" credit monitoring or some similar nonsense. The lawyers will rake in tens if not hundreds of millions of dollars and the company will continue on as before. Nothing will change. All kinds of people will suffer real damages due to identity theft; it'll go on for years if not decades.

* This is already available - for free - once per year anyway. You go on, download your credit reports, review and dispute any items you want to contest. This is already there and is required as part of the FCRA of 1970. These clowns are utterly brazen in putting their lack of concern and care about the severity of this incident on display. They clearly view the American public as a bunch of idiots and don't give a damn.

- - - - -

If you want help from Equifax, there are strings attached - Sep. 8, 2017

- - - - -

Equifax is offering help for people whose personal information was hacked -- but there are big strings attached.

The credit reporting agency announced Thursday that the personal information of as many as 143 million people was compromised in a data breach between May and July. The stolen data includes names, Social Security numbers, birth dates, addresses and driver's license numbers.

If your information was exposed, Equifax is offering free identity theft protection and credit file monitoring services. But the offer comes with some conditions that may make you think twice.

You can't get help right away. When people enter their last name and part of their Social Security number on the site to see whether they were affected, some are being told: "Based on the information provided, we believe that your personal information may have been impacted by this incident."

But even in that case, Equifax is not offering the credit monitoring service until next week at the earliest. Monday is the first day you can sign up.

You could be giving up some of your rights to sue. At first, Equifax said anyone who gets the credit monitoring service, TrustedID, must agree to submit any complaints about it to arbitration. Those people wouldn't be allowed to sue, join a class-action suit, or benefit from any class-action settlement.

After public pressure, Equifax added an opt-out provision on Friday. Customers can get out of the arbitration requirement by notifying Equifax in writing within 30 days of accepting the monitoring service.

And Alex Southwell, a privacy lawyer at Gibson Dunn and a former federal prosecutor in New York, said the original rules still left room for people to sue Equifax over the original hack, even if they can't sue over the credit monitoring.

The federal Consumer Financial Protection Bureau recently published rules against these kinds of arbitration requirements by banks and credit card issuers. The rules will apply to credit rating services such as Equifax. But they don't take effect until next year, and Republicans in Congress want to roll them back.

Equifax isn't promising help fixing your credit: Equifax will agree only to monitor your credit, not help you fix any problems arising from the hack. "We do not offer, provide, or furnish any products, or any advice, counseling, or assistance, for the express or implied purpose of improving your credit record, credit history, or credit rating," the company in its 7,200-word terms and conditions. "By this we mean that we do not claim we can 'clean up' or 'improve' your credit record, credit history, or credit rating."

Equifax did not immediately respond to a request for comment Friday.

- - - - -

[OffCamber00]

Terrible situation all around.

Unfortunately, we are only on the cusp of what is yet to come from a cyber-attack perspective. Its a whole new world out there.

[cabmandone]

Originally Posted by legion

Now I'm hearing that if you sign up for their free credit monitoring, the fine print says you are agreeing the binding arbitration and giving up the right to any settlement.

That is typical. Just freeze your credit and don't worry about the monitoring.

[Baz]

Originally Posted by drcoastline

News just reported execs at Equifax sold 2,000,000 in stocks the day after discovering the compromise.

[stealthn]

https://www.cnet.com/how-to/a-guide-to-surviving-equifax-data-breach/

[ossiblue]

Originally Posted by craigster59

As I said in a previous post, as long as you freeze with one you are good. When I applied for a car loan recently they would not approve because my credit was frozen. Called Experian, lifted the freeze for 24 hrs, and called the dealer to rerun my credit. Same when I just purchased my home.

It's a PITA at times but I don't have to worry about I.D. theft anymore.

I have not found that to be true (bold). Every source I've checked, including Equifax itself, states that you must contact each agency separately and request a freeze. Asking for a Fraud Alert, on the other hand, only requires that you apply at one agency. The alert will then be forwarded on to the other two. I don't doubt your experience, but it's possible the company you were dealing with only used Experian as their credit verification source so you were covered.

From the Transunion website:

"You will need to place a security freeze separately with each of the three major credit reporting companies if you want the freeze on all of your credit files." https://www.transunion.com/credit-freeze/place-credit-freeze

Financial help website:

"*When you do a credit freeze, it is imperative that you freeze your credit with all three bureaus.*" http://clark.com/personal-finance-credit/credit-freeze-and-thaw-guide/

From the FTC website:

"How do I place a freeze on my credit reports?

Contact each of the nationwide credit reporting companies:

Equifax — 1-800-349-9960
Experian — 1‑888‑397‑3742
TransUnion — 1-888-909-8872"
https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs#place



Unless you can supply a verifiable source that states asking for a freeze on your credit from one agency will automatically transfer to the other two, the claim should be held in serious doubt. Perhaps it is a regulation in your particular state. If so, it does not apply everywhere, certainly not in California.

[island911]

Originally Posted by Evans, Marv

I wouldn't think you'd have to sign up to be compromised. ...

That's my understanding too. (correct me if I'm wrong.)

I've always thought it odd that people seek to protect their information by giving it all to yet another third-party, for monitoring. --that's simply one more entity (target) with ALL of your important info.

[Danimal16]

Originally Posted by legion

Now I'm hearing that if you sign up for their free credit monitoring, the fine print says you are agreeing the binding arbitration and giving up the right to any settlement.

This is true, but there is a 30 day opt out that you have to send them via snail mail.
Here is the excerpt:

Right to Opt-Out of this Arbitration Provision. IF YOU DO NOT WISH TO BE BOUND BY THE ARBITRATION PROVISION, YOU HAVE THE RIGHT TO EXCLUDE YOURSELF. Opting out of the arbitration provision will have no adverse effect on your relationship with Equifax or the delivery of Products to You by Equifax. In order to exclude Yourself from the arbitration provision, You must notify Equifax in writing within 30 days of the date that You first accept this Agreement on the Site (for Products purchased from Equifax on the Site). If You purchased Your Product other than on the Site, and thus this Agreement was mailed, emailed or otherwise delivered to You, then You must notify Equifax in writing within 30 days of the date that You receive this Agreement. To be effective, timely written notice of opt out must be delivered to Equifax Consumer Services LLC, Attn.: Arbitration Opt-Out, P.O. Box 105496, Atlanta, GA 30348, and must include Your name, address, and Equifax User ID, as well as a clear statement that You do not wish to resolve disputes with Equifax through arbitration. If You have previously notified Equifax that You wish to opt-out of arbitration, You are not required to do so again. Any opt-out request postmarked after the opt-out deadline or that fails to satisfy the other requirements above will not be valid, and You must pursue your Claim in arbitration or small claims court.

[Mad Max]

What we have here is the corrupt system exposed for all to see. The curtain is pulled back and the wizard of all our personal and confidential information is exposed to the highest bidder.

The premise that anyone/entity should be trusted no matter what they claim or pretend to sell in the name of security is anything but.

This whole financial charade exposed for what it is; a con game with your information being fair game!