Yes, the door key analogy falls short if you've already been a victim, but it's just an analogy.

As far as the automatic freezing, that could cause quite a bit of difficulty for individuals that don't wish that to happen--it does cause problems and inconveniences for some. At least, the three agencies could offer a freeze for free to all who want it via an "opt-in" policy that is mailed out to every consumer. Further, they could eliminate fees for the temporary lifting of the freezes.

This was a problem caused by one of their own and we victims had no choice but to have our personal data sent to them. The responsibility is completely theirs, and the remedy should be paid for by them as well. The information is exposed, forever. Defending against its use will be a battle, forever. These agencies should shoulder the burden in the battle for protection that they have caused by their incompetence.

Tax return fraud.. UGH.

BRB, have to buy some shares of SYMC...

from Reuters:
Seven hours is all it took for Equifax Inc to be hit with two lawsuits over a hacking that may have compromised personal information for 143 million American consumers. It could take years for the credit reporting company to end the legal fallout from the unprecedented breach. “Damages to the class are limited only to the imagination of thieves,” John Yanchunis, a lawyer at Morgan & Morgan who filed one of the lawsuits, in Atlanta federal court, said in an interview on Friday. The lawsuits were filed on behalf of consumers accusing Equifax of negligence, or willful misconduct, in failing to properly safeguard Social Security and driver’s license numbers, birth dates, addresses and sometimes credit card data.

Where do we sign up to be part of that class? Wife and I didn't accept their credit monitoring service.

Let see 10% of 143,000,000 x 1,000 for damage = going bankrupt and whatever crumbs that are left will go to the lawyers...

You'll get a $10-off coupon for their credit-monitoring service and the lawyers will each get new summer homes in the Hamptons

More like there will be a B-I-G settlement, no admission of wrongdoing and the victims (143,000,000+ Americans) won't get diddly squat. We'll likely get a year of free credit monitoring or something equally worthless and the lawyers will get eight-figure payouts and retire to 100' yachts on the Mediterranean.

Sorry, but that's how class action suits REALLY work. They're an absolute sham and only enrich the people that are part of the good ole' boy lawyers' club.

Another exposure of this company's utter lack of giving a damn (my editorial comments in red below...)

- - - - -

https://www.nytimes.com/2017/09/10/your-money/identity-theft/equifax-breach-credit-freeze.html

- - - - -

After Equifax Breach, Here’s Your Next Worry: Weak PINs

Your Money
By RON LIEBER SEPT. 10, 2017

When Helene Muller-Landau first heard the news about the Equifax security breach, she set about freezing her credit files and those of her husband and mother.

Very quickly, however, Ms. Muller-Landau, a Smithsonian research scientist, noticed something strange: The personal identification numbers that Equifax was assigning her family members (to use for eventually lifting the freezes) were awfully similar.

At first, she thought it was a mistake. Maybe it had to do with the fact that she was in Panama, or that her web browsers were acting up. But no: The Equifax PINs are based on the date and time that you set up your freeze.

“The whole point of a 10-digit PIN is that it’s supposed to be hard to guess,” she said. “And then, they have this totally transparent algorithm for assigning them.”

This is among the worst of the facts that have emerged in the wake of the company’s announcement on Thursday that thieves may have stolen up to 143 million Social Security numbers, dates of birth, names and addresses from its credit files. Armed with that information, thieves, blackmailers and enemies can make a lot of mischief. A credit freeze can prevent thieves from using your information to open new accounts, since lenders want to see a credit report before doing business with you.

On Saturday, many readers sent me tales of outrage and woe. They could not believe that Equifax and the other credit reporting firms, Experian and TransUnion, charge fees to freeze the credit files that they had not asked the companies to set up in the first place. Besides, isn’t keeping that information safe their most important job? [nope, making money for themselves is apparently their most important job! Just look at their priorities in handling this to date!]

Nevertheless, consumers persisted. But when they pulled up the websites of Equifax, Experian and TransUnion, they often found crashed sites (because everyone else was persisting, too) or requests from the companies to write in or call instead. (For a variety of reasons — some of them security-related — the bureaus sometimes refuse online requests for freezes. Just be glad you don’t have to make the request via registered mail as I did back in the old days.) [I simply LOVE the inconsistency here... On the one hand they're saying "mail in your requests (presumably because it's more secure) while they're simultaneously directing everyone to their breach web site... because it's secure. LOL! For the record, I tried three times and was denied three times for a freeze last night - all three major bureaus defaulted to "mail in your request", almost like it's automatic or something (they wouldn't do that hoping that most people would just eventually give up and go away now, would they? Naaaaah. ;) )]
Candy Sagon, in Reston, Va., had a typical experience. Equifax’s system worked fine. “Including the $10 charge they don’t deserve,” she said. But Experian’s site to set up an online freeze didn’t work at first, then kicked her to the snail mail option because she didn’t put in the amount of her monthly mortgage payment correctly when the site attempted to identify her. Then, TransUnion’s phone system disconnected her four times.

Dan Harrison, a Los Angeles media executive who is also a lawyer, said he already had a credit freeze, one that he’d set up after a previous breach involving another company. When he heard about the Equifax breach, his immediate instinct was to contact Equifax to change his PINs. His logic was this: Why assume that those were safe, given the circumstances?

But when he called the company, a representative said that he did not even know what a PIN was and that there were no supervisors with whom Mr. Harrison could speak. The story changed once Mr. Harrison educated the Equifax representative on basic freeze facts. A supervisor did exist, but the one who got on the phone with Mr. Harrison said that it was not possible to change the PIN. He would not answer additional questions, referring Mr. Harrison to the company’s breach site instead.

In an interview on Saturday, Mr. Harrison said that he wouldn’t trust someone swearing on a stack of Bibles that his PIN was safe. [LOL!!! The same thing I'm sure they said about the data and their web site(s) that they keep sending people to in a circular, avoid-the-issue fashion...] “They are going to have to change my PIN,” he said, adding that it is the safety net of last resort for him and every other person who has had their personal information stolen. “I’m going to force them.”

On Sunday afternoon, in an emailed statement, an Equifax spokesman, Wyatt Jefferies, said that no PINs had been compromised in the breach and that the company would soon be changing the PIN generation and reset request process.

“While we have confidence in the current system [that makes one of us!], we understand and appreciate that consumers have questions about how PINs are currently generated,” he wrote. “We are engaged in a process that will provide consumers a randomly generated PIN. We expect this change to be effective within 24 hours.” [we'll see if this becomes effective today or not. My money is on "not". Why can't I just pick my own damn PIN like I can everywhere else?]

Meanwhile, Mr. Harrison said he longed for a legislative or regulatory solution, even if it means the sort of piecemeal, drip-by-drip state actions that have forced the credit bureaus to provide more information and protection to consumers.

A memo to state legislatures: Maybe start with giving everyone access to their credit reports whenever they want to see them, free, at all three bureaus, as the Stanford professor Jeffrey Pfeffer suggested over the weekend in a LinkedIn article. (Currently, you get only one free look at each report each year via annualcreditreport.com.)

Then we could require the bureaus to provide free, top-of-the-line monitoring forever, including free freezes and thaws, whenever a breach occurs at one of their own websites.

Several readers also suggested that freezes simply become the default. Would Equifax fight such an effort? [crystal ball says "yes"] “This is a very complicated issue and we expect to engage with regulators and legislators on this topic in the future,” Mr. Jefferies wrote.

Credit should be hard to get, readers noted. That might also help reduce impulse buys at pushy retailers that hand over store cards with 29.9 percent interest rates, while pretending that the 10 percent off they give you for that day’s purchases somehow makes up for the usurious interest rates. [While I generally don't like laws that exist solely to protect stupid people from themselves (I'm a big believer that life should be harder on dumb people as it makes us stronger as a society a la Darwin) I think the ends would justify the means here... As we saw in 2008, if you get enough stupid people doing the same stupid thing together, it jeopardizes the stability of the system for EVERYONE - including the ones who do nothing wrong and haven't been stupid in their choices / actions, so it's worth pushing the legislative route and insisting that just enough be done to protect the system from the unintended consequences of these sorts of actions by the indiscriminate or stupid... Then again, in an age of chest-thumping "''merica baby!" bravado, a feckless Republican congress shamelessly beholden to big banks, Wall Street and insurance companies and the glorification of excess and boorish, vapid behavior these days, I'm won't be holding my breath...]

Even if any of these things happen — and I’m not holding my breath — it will take many months, at a minimum. In the meantime, we’re on our own, per usual, to protect ourselves.

So keep freezing your credit files. Keep crashing the company’s websites. Every freeze puts a stick in the spoke of the wheel of credit data that has spun far out of control for far too long. [I agree. After being told on three different web sites "you need to mail in your request" I'm only all too happy to do it, knowing that it's much more labor-intensive to process requests that way and it'll end up costing them more, AND to keep re-trying their lousy web sites in the meantime. I was able to get fraud alert set up and that buys me 90 days of SOMETHING until I can get the actual freezes in place everywhere. Good luck to everyone!]
- - - - -

100% agree with this!!!

This won't change until some C-level exec start going to Federal Pound Me In The Ass Prison

Or, nancy pelosi winds up co signing for 30 cars in Brooklyn.. Then Uncle Sam will take over EFX.

rjp

I don't recall ever giving them my permission to collect any information on me.

Nor have any of us, but the more I think about it, it may have been in the small print of any and all the agreements we signed when applying for credit or securing a loan. Something to the effect of sharing with limited third parties related to the loan/financial institution. Looks innocuous enough and is identified as part of the lender's institution or business model, not just random commercial businesses.

That's my recollection, anyway, until I can find a copy of the credit agreements. Even if that is the case, the reality is, if one refuses to that part of the agreement, they cannot get the credit/loan so you have no choice.

It is a system forced on us (consumers) by the lawyers and bankers. I really don't know if there is a totally secure system on planet earth. Even the Feds got hacked and the list of all civil servants and their information was stolen. It is just unacceptable that the data is not encrypted at the local source.

Until some powerful no wait, until most of congress gets hacked and has their personal credit file stolen and fraudulent charges charged to them, nothing is going to change except a lot of lawyers are getting rich.

How can the economy really operate is everyone with good credit has the credit files locked. Most small businesses use different forms of basis on a regular if not hourly basis. They just can't lock up everything.

I followed the recommendations here and froze my credit. Plus submitted a complaint to the CFPB. We should all submit complaints. I also agree with @widebody911 that this won't change until there are true penalties for the people in charge of these companies for lackluster security.

Statement from Apache on the Equifax security breach. It is suspected that a zero day exploit was used to get at the data.

https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax

Apache Struts is an open source project. See https://struts.apache.org/ Many companies, including financial companies use open source.

Dumb question, but how do security companies do Social Security searches. Do they just search for people's SSN with the thought that if it isn't direclty associated with a person, that a SSN is just a string of numbers? I guess I am just wondering if I look for my SSN in the open, whether I am creating an unnecessary risk.

One more thing on you to-do list guys: Contact the IRS and request a special PIN ! People with that info can now file taxes for you and request a bogus refund be electronically paid to them ! then you file and get denied ! Surprise !!!

So what does that mean long term for banks/credit institutions/loans approvals ? I imagine some enterprising folks can get new IDs issues with that info....

At this point if you exclude children and folks living under a rock, EVERYONE's info has been compromised, by this and other breaches... Everyone's social security #, address, DOB, whatever they need to open a new account is out there.

Are we no longer legally responsible for Identity fraud ? Are we gonna have to start getting a special super duper verified ID when we do everything, now in person ?

I'm thinking there's allot of people out there who are pleased as **** this breach happened. Their credit histories are so screwed up this might give them a do-over somedamnhow.

Seems to me they don't care about learning. As mentioned by someone here the PIN's they issued are a combo of the date you froze your credit reports followed by a number. I went back & checked mine, & the number following the date numbers is a four digit number. How long would it take a computer program to crack that? Seems like that is inviting more of the same.