Equifax breach exposes 143 million people to identity theft

[Texas42]

What methods should be used to determine an individuals ability to pay?

Income, assets, and liabilities.

Your credit score doesn't take into account the first two. ....

 

[Brains]

Doesn't matter how good the encryption or security is from external threats as it all has to be unencrypted to be usable at some point. Probably wasn't a "hack" but a disgruntled IT flunky with physical access, root password, and a thumb drive.

Perhaps, certainly possible. However, even the most basic of intrusion detection and exfiltration detection systems would have 'noticed' 143 million records going out the door, and shut said door.

Just out of curiosity, where did you read that the data was unencrypted and in plain text? I follow a lot of security bloggers, and nobody has reported that as far as I'm aware. I'd enjoy reading the article to see what other information they have. From my understanding, Equifax has been fairly tightlipped about the whole incident.

The one thing most agree on is this has turned into a public relations sh!t storm for them.

And while it may have been an internal job, it may have been a simple exploit that allowed system level access behind a 0-day exploit. An administrative backdoor was set up and the private keys were located. I can't speak for y'all, but every time I leave a security conference, I regret choosing an occupation in IT.

I have no first hand knowledge, I'm only making educated guesses based on Equifax' reports of the extent of the breech. I'm basing my perceptions on Equifax' own disclosure, as it would indicate any real-world protections against usability of the data were either completely inadequate or non-existent. The bloggers don't know any more than I do of course, but when a company comes out and states the hackers got everything? The hackers got everything.

 

[Brains]

Update: Just read on Slashdot they're blaming Struts for the disclosure. Now I never dug into their site to see if they're using the framework, but I suppose it's possible. Seems awfully convenient to me, honestly, since the Struts vuln disclosure was relatively recent as well.

 

[oldag]

Income, assets, and liabilities.

Your credit score doesn't take into account the first two. ....

Actually, the three C's. Character, Capacity, Capital are the "old school" issues in making a credit decision.

 

[TheDan]

Not quite sure how to break this system of centralized data collection/storage.

blockchain

Without the services of credit reporting agencies the accessibility to credit would stop or at least be limited to merchants willing/able to take the risk. Either that or a huge return on lay away programs. Both would cripple our consumer based economy. Either that or HUGE pricing adjustments would need to happen, which would kill the stock market. Neither is a good idea. Aside from a sealed report model where everyone's credit is sealed and nobody has any access without some form of authentication I'm not sure why to truly do.

I see this as more of a regulatory problem than a technical one. I'm just as guilty as most Americans at this point, but the real issue is all the personal debt to begin with. If interest rates weren't lower than inflation then we wouldn't be in this situation where your credit score is so important in the first place.

 

[ZX9RCAM]

Income, assets, and liabilities.

Your credit score doesn't take into account the first two. ....

I always thought that income was required when applying for a loan.
Should one be required to inform what their assets are before applying for a loan?

 

[Texas42]

I always thought that income was required when applying for a loan.
Should one be required to inform what their assets are before applying for a loan?

I said your credit score. Morgages will want your income, but most car loans, credit cards, store credit, payday, will only check your credit score (if they even do that).

 

[ZX9RCAM]

I said your credit score. Morgages will want your income, but most car loans, credit cards, store credit, payday, will only check your credit score (if they even do that).

Ah, gotcha.
It's been a long time since I've financed anything, but I thought they asked for a pay stub to prove income, and length of employment, but my memory is not what it used to be.

 

[Shady]

I have a 820 Fico and for at least the last 3 cars all wanted a pay stub or direct deposit info.

 

[TexasBrandon]

I've never had to show a pay stub and I'm sitting at 800 right now. The last 3 cars and my motorcycle I walked in told them what I wanted and left with it. Sometimes I would put 50% or more down other times nothing at all and just finance it at 2-3 years. It's probably per business.

 

[TheDan]

I have a 820 Fico and for at least the last 3 cars all wanted a pay stub or direct deposit info.

What kind of cars?

I haven't had to prove income to finance the last few cars I bought. They just went off credit score.

 

[TAZ]

What kind of cars?

I haven't had to prove income to finance the last few cars I bought. They just went off credit score.

Me neither. You do fill out forms that have you state an income, but AFAIK, aside from my mortgage lender nobody checks.

 

[ed308]

Got lucky. They didn't get my information. But they got my wife's.

 

[TheDan]

This is a pretty good read on the situation...
https://www.reddit.com/r/YouShouldK..._what_your_options_for_responding_to_equifax/

 

[pronstar]

With direct deposit, I haven't even seen a pay stub in well over a decade, likely closer to two.


Sent from my iPhone using Tapatalk Pro

 

[ZX9RCAM]

That seems odd to me.
I have always gotten some kind of pay "stub" everywhere I worked while having direct deposit.

 

[TexasBrandon]

All digital for me. Haven't had a paper pay stub since last decade when I was still in the Army.

 

[pronstar]

That seems odd to me.
I have always gotten some kind of pay "stub" everywhere I worked while having direct deposit.

I can go to ADP's website and download one, but I honestly can't even remember the last time got a physical stub.


Sent from my iPhone using Tapatalk Pro

 

[Southpaw]

This is a pretty good read on the situation...
https://www.reddit.com/r/YouShouldK..._what_your_options_for_responding_to_equifax/

Thanks. Will be freezing our credit files shortly. I don't see needing credit for a while anyway and it seems like the only sure way.

 

[JeepFiend]

Looks like the breach may have been caused by a vulnerability in apache that went unpatched for nearly two months:

https://nakedsecurity.sophos.com/20...-by-a-months-old-apache-struts-vulnerability/