Equifax hack - more than just credit info

[Donald]

Who knows how truthful Equifax is being about what was hacked if they even know all the areas hacked.

You should get the report I mention if only to make sure it's contains accurate info.

My guess is Equifax does not really want workers to know about the employee verification data since if they did they would get millions of requests for copies of the report and thousands of requests to correct errors and for all of that they would not earn any money.

 

[oilpsi2high]

You guys realize that your SSN's, pay info, all of this "sensitive" information, is likely floating around at your old employers anyway? Think back to every application you've ever filled out, at every job you've worked at. These files don't just disappear when you leave, they're filed in a cabinet or box somewhere.

Just food for thought.

 

[ArcticDriver]

Originally Posted By: oilpsi2high
You guys realize that your SSN's, pay info, all of this "sensitive" information, is likely floating around at your old employers anyway? Think back to every application you've ever filled out, at every job you've worked at. These files don't just disappear when you leave, they're filed in a cabinet or box somewhere.

Just food for thought.


Maybe in hillbilly land but professional job applications do not require SSN and professional employers treat personnel data with care. They do not leave it laying around in a shoebox and they don't pay to keep it stored any longer than the law requires. When it is discarded then it is shredded or picked up by a secure shredding service.

Even if it were kept in a shoebox in an office it is far more secure than on the Equifax servers. ;-)

Your nonchalant attitude sounds like you are a rube to people who are well informed on such matters.

 

[ZeeOSix]

Originally Posted By: ArcticDriver
Its little wonder they experienced a data breach. The only surprise is there have not been more.

There may be some data breaches that nobody knows about (yet) or they won't divulge. Seems like I hear about a new one every 6 months or so.

In the last 10~12 years my personal info has been involved in 3 or 4 different data breaches. The places breached always offer free credit monitoring for 1~2 years.

It's all getting ridiculous with all this computer hacking and data theft. There has to be a way to make these systems more secure.

 

[ford46guy]

If you apply for credit, why can't they send a PIN to your phone or email? Text back that pin and maybe some other piece of random PI(year of birth) or yearly code they send.

Then the application is considered. That should be a default. With the systems today something similar could be easily deployed. SSNs would have diminished value.

It sounds crazy but they may consider the losses they accrue less than what setting up a system like that is worth. Let the consumer fight it with the CRAs and banks.

 

[Donald]

Using a call back to your cell phone has proven very unsecure to some financial managers. Hackers would call the wireless companies hundreds of times until they got a soft person to change the IMEI of a given cell phone number to one the hacker has. They then use a text response to the phone they have to update the financial managers account then do damage. Some of these financial managers had notes on their account not to change the IMEI.

 

[Tdbo]

Originally Posted By: grampi
Originally Posted By: mclasser
Man this breach is becoming a worse and worse [censored] show each day.


Not only that, but try registering for their free monitoring service. When you sign up for the service, part of the registration process requires you to click on a link they send you in an email in order to complete the registration. It took over a week for me to just to receive this email, and now every time I click on the link, I get an error message stating that the system is unavailable. I've been trying to complete the process for several days now with no success...


Judging by how well they protected my information the first time, I doubt that I am going to allow myself to be a mark for their paid service, and pay for their gross negligence and incompetence. I'm going to use one of the free monitoring services suggested here:

http://clark.com/personal-finance-credit...ts-coming-next/

 

[eljefino]

Originally Posted By: ford46guy
If you apply for credit, why can't they send a PIN to your phone or email? Text back that pin and maybe some other piece of random PI(year of birth) or yearly code they send.


The more layers they add the more likely it would be that someone who games the system is more likely to be able to represent themselves as the real you.

Equifax should have to pay every compromised US citizen's fee for a passport card, verified by the US Dept of State, and 10 years' lease on a safety deposit box to keep said documents in. Then if when the next ID theft happens the victim can take their documents to an appropriate local court and nuke their wrongful doppelganger.

 

[ArcticDriver]

Originally Posted By: eljefino
Originally Posted By: ford46guy
If you apply for credit, why can't they send a PIN to your phone or email? Text back that pin and maybe some other piece of random PI(year of birth) or yearly code they send.


The more layers they add the more likely it would be that someone who games the system is more likely to be able to represent themselves as the real you.

Equifax should have to pay every compromised US citizen's fee for a passport card, verified by the US Dept of State, and 10 years' lease on a safety deposit box to keep said documents in. Then if when the next ID theft happens the victim can take their documents to an appropriate local court and nuke their wrongful doppelganger.


I fully agree these agencies that fail to protect our private information from hackers need to pay substantial punitive damages. These agencies need an incentive to finally upgrade their systems to the 21st Century...including phone staff and chat access.

 

[Donald]

Originally Posted By: eljefino
Originally Posted By: ford46guy
If you apply for credit, why can't they send a PIN to your phone or email? Text back that pin and maybe some other piece of random PI(year of birth) or yearly code they send.


The more layers they add the more likely it would be that someone who games the system is more likely to be able to represent themselves as the real you.

Equifax should have to pay every compromised US citizen's fee for a passport card, verified by the US Dept of State, and 10 years' lease on a safety deposit box to keep said documents in. Then if when the next ID theft happens the victim can take their documents to an appropriate local court and nuke their wrongful doppelganger.


I read how much Equifax could pay each person effected and it was low like $18. They do not have billion in reserve.

 

[eljefino]

Originally Posted By: Donald

I read how much Equifax could pay each person effected and it was low like $18. They do not have billion in reserve.


They probably license the technology from Oquifax and shuffle profits through Aquafax. If they go bankrupt, who will cry?

 

[ArcticDriver]

Originally Posted By: Donald
Originally Posted By: eljefino
Originally Posted By: ford46guy
If you apply for credit, why can't they send a PIN to your phone or email? Text back that pin and maybe some other piece of random PI(year of birth) or yearly code they send.


The more layers they add the more likely it would be that someone who games the system is more likely to be able to represent themselves as the real you.

Equifax should have to pay every compromised US citizen's fee for a passport card, verified by the US Dept of State, and 10 years' lease on a safety deposit box to keep said documents in. Then if when the next ID theft happens the victim can take their documents to an appropriate local court and nuke their wrongful doppelganger.


I read how much Equifax could pay each person effected and it was low like $18. They do not have billion in reserve.


Article from 2016:

The company now projects $5.15 to $5.25 a share in adjusted profit on $3.05 billion to $3.15 billion in revenue, compared with its earlier view of $4.95 to $5.05 in per-share earnings on revenue of $3 billion to $3.1 billion.

http://www.marketwatch.com/story/equifax-profits-outlook-bolstered-by-acquisitions-2016-04-27

 

[oilpsi2high]

Originally Posted By: ArcticDriver
Originally Posted By: oilpsi2high
You guys realize that your SSN's, pay info, all of this "sensitive" information, is likely floating around at your old employers anyway? Think back to every application you've ever filled out, at every job you've worked at. These files don't just disappear when you leave, they're filed in a cabinet or box somewhere.

Just food for thought.


Maybe in hillbilly land but professional job applications do not require SSN and professional employers treat personnel data with care. They do not leave it laying around in a shoebox and they don't pay to keep it stored any longer than the law requires. When it is discarded then it is shredded or picked up by a secure shredding service.

Even if it were kept in a shoebox in an office it is far more secure than on the Equifax servers. ;-)

Your nonchalant attitude sounds like you are a rube to people who are well informed on such matters.


Unless you're working under the table, any company is going to need your SSN before paying you. Even if they use electronic methods to store your information, all it takes is one curious George in HR to steal your information. If a company's servers get hacked then there goes your information too.

 

[zorobabel]

Originally Posted By: ArcticDriver
Originally Posted By: oilpsi2high
You guys realize that your SSN's, pay info, all of this "sensitive" information, is likely floating around at your old employers anyway? Think back to every application you've ever filled out, at every job you've worked at. These files don't just disappear when you leave, they're filed in a cabinet or box somewhere.

Just food for thought.


Maybe in hillbilly land but professional job applications do not require SSN and professional employers treat personnel data with care. They do not leave it laying around in a shoebox and they don't pay to keep it stored any longer than the law requires. When it is discarded then it is shredded or picked up by a secure shredding service.

Even if it were kept in a shoebox in an office it is far more secure than on the Equifax servers. ;-)

Your nonchalant attitude sounds like you are a rube to people who are well informed on such matters.

I'm sure that's how it is in your fairy-land utopia. I'm sure a lot of small to medium businesses do it the hillbilly way.

 

[ArcticDriver]

Originally Posted By: oilpsi2high
Originally Posted By: ArcticDriver
Originally Posted By: oilpsi2high
You guys realize that your SSN's, pay info, all of this "sensitive" information, is likely floating around at your old employers anyway? Think back to every application you've ever filled out, at every job you've worked at. These files don't just disappear when you leave, they're filed in a cabinet or box somewhere.

Just food for thought.


Maybe in hillbilly land but professional job applications do not require SSN and professional employers treat personnel data with care. They do not leave it laying around in a shoebox and they don't pay to keep it stored any longer than the law requires. When it is discarded then it is shredded or picked up by a secure shredding service.

Even if it were kept in a shoebox in an office it is far more secure than on the Equifax servers. ;-)

Your nonchalant attitude sounds like you are a rube to people who are well informed on such matters.


Unless you're working under the table, any company is going to need your SSN before paying you. Even if they use electronic methods to store your information, all it takes is one curious George in HR to steal your information. If a company's servers get hacked then there goes your information too.



Obviously but what is your point? That Equifax (and similar large scale data collection centers) are as safe as anyplace else?
I can't speak for your employers but I have not heard of such data breaches in the Accounting/Bookkeeping Depat from anyone in my industry nor anyone else I know.

Your earlier post was discussing a job application. A job application is not a hire packet. It is the hire packet which requires the w-2 information be filled out and ID provided.

There are times that I have provided my SSN and personal information to employers, accountants, insurance companies, etc.
i made a personal decision and granted them permission by my action. OTOH, there is an organization like a CRA which I did not grant permission to collect and retain my personal financial history. They exist for the benefit of large institutions. Given the sensitive nature of their business and the massive number of indivual files they contain they should have a set of technologically advanced safeguards and protections in place to prevent large scale hacking and data breaches. Think of them as a bank which warehouses large sums of cash. Yes, in theory a dishonest employee could steal a small amount of cash but the bulk of the money is well protected. It is in the banks interest to protect those assets and avoid theft. CRAs should be similarly motovated and only will be when they suffer a court decision that includes hefty punitive damages.

I don't know how else to respond to your "hypothetical" post. You either recognize and consider the Equifax data theft to be a significant breach of trust as a result of systemic carelessness and cost cutting or you don't.

 

[ArcticDriver]

Originally Posted By: zorobabel
Originally Posted By: ArcticDriver


Even if it were kept in a shoebox in an office it is far more secure than on the Equifax servers. ;-)

Your nonchalant attitude sounds like you are a rube to people who are well informed on such matters.

I'm sure that's how it is in your fairy-land utopia. I'm sure a lot of small to medium businesses do it the hillbilly way.


Well as long as you are "sure" then that pretty much settles the whole thing.

 

[dnewton3]

We've had our credit locked for a decade now, at all three (now four) CRAs.

We wrote Equifax immediately upon hearing of this hack event. We asked them to "reset" our security freeze passwords. My wife and I did the exact same thing at the same time; sending in two separate letters.

Two weeks later, she got her new password.
I got a letter stating " ... we have permanently removed your security freeze ..."

That's not helping my perception of their customer focus and lack of attention to detail.
First, your hacked. At an agency that essentially should be at the forefront of security given the nature of your business.
Then, you do something posterior-backwards that the customer never asked you to do.

IDIOTS !!!!


The worst thing about this is that we're all captive in these systems. We didn't elect to be there; we were forced in.
If this were a normal business relationship, they would have more focus on customer satisfaction.
But we have no ability to withdrawl our "membership" so to speak. We cannot withhold anything from them. We cannot "walk away" from a purchase. We cannot complain to a manager.

This is a terrible business model; CRAs have too much power with too little oversight.

 

[friendly_jacek]

Originally Posted By: jmsjags
Originally Posted By: leje0306
Fake news.


What the previous poster said is not "fake news" at all,


relax, "fake news" these days simply means truth i don't like to hear about.

 

[ArcticDriver]

Originally Posted By: dnewton3
We've had our credit locked for a decade now, at all three (now four) CRAs.

We wrote Equifax immediately upon hearing of this hack event. We asked them to "reset" our security freeze passwords. My wife and I did the exact same thing at the same time; sending in two separate letters.

Two weeks later, she got her new password.
I got a letter stating " ... we have permanently removed your security freeze ..."

That's not helping my perception of their customer focus and lack of attention to detail.
First, your hacked. At an agency that essentially should be at the forefront of security given the nature of your business.
Then, you do something posterior-backwards that the customer never asked you to do.

IDIOTS !!!!


The worst thing about this is that we're all captive in these systems. We didn't elect to be there; we were forced in.
If this were a normal business relationship, they would have more focus on customer satisfaction.
But we have no ability to withdrawl our "membership" so to speak. We cannot withhold anything from them. We cannot "walk away" from a purchase. We cannot complain to a manager.

This is a terrible business model; CRAs have too much power with too little oversight.


Exactly...a full understanding and awareness of the threat...and of the lack of mitigation available.

Thanks

 

[oilpsi2high]

Originally Posted By: ArcticDriver
Originally Posted By: oilpsi2high
Originally Posted By: ArcticDriver
Originally Posted By: oilpsi2high
You guys realize that your SSN's, pay info, all of this "sensitive" information, is likely floating around at your old employers anyway? Think back to every application you've ever filled out, at every job you've worked at. These files don't just disappear when you leave, they're filed in a cabinet or box somewhere.

Just food for thought.


Maybe in hillbilly land but professional job applications do not require SSN and professional employers treat personnel data with care. They do not leave it laying around in a shoebox and they don't pay to keep it stored any longer than the law requires. When it is discarded then it is shredded or picked up by a secure shredding service.

Even if it were kept in a shoebox in an office it is far more secure than on the Equifax servers. ;-)

Your nonchalant attitude sounds like you are a rube to people who are well informed on such matters.


Unless you're working under the table, any company is going to need your SSN before paying you. Even if they use electronic methods to store your information, all it takes is one curious George in HR to steal your information. If a company's servers get hacked then there goes your information too.



Obviously but what is your point? That Equifax (and similar large scale data collection centers) are as safe as anyplace else?
I can't speak for your employers but I have not heard of such data breaches in the Accounting/Bookkeeping Depat from anyone in my industry nor anyone else I know.

Your earlier post was discussing a job application. A job application is not a hire packet. It is the hire packet which requires the w-2 information be filled out and ID provided.

There are times that I have provided my SSN and personal information to employers, accountants, insurance companies, etc.
i made a personal decision and granted them permission by my action. OTOH, there is an organization like a CRA which I did not grant permission to collect and retain my personal financial history. They exist for the benefit of large institutions. Given the sensitive nature of their business and the massive number of indivual files they contain they should have a set of technologically advanced safeguards and protections in place to prevent large scale hacking and data breaches. Think of them as a bank which warehouses large sums of cash. Yes, in theory a dishonest employee could steal a small amount of cash but the bulk of the money is well protected. It is in the banks interest to protect those assets and avoid theft. CRAs should be similarly motovated and only will be when they suffer a court decision that includes hefty punitive damages.

I don't know how else to respond to your "hypothetical" post. You either recognize and consider the Equifax data theft to be a significant breach of trust as a result of systemic carelessness and cost cutting or you don't.


Ever heard of Boeing?

Background checks, part of the application process, also require a SSN along with a bunch of other sensitive information.

My point is these security breaches happen quite often, more than people realize, and even at Fortune 500 Corporations. You're making it seem like working for a large company reduces the risk, which simply isn't the case.