Experian Sold Consumer Data to ID Theft Service

http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/

by cylo • 13 years ago

310 79 13 years ago

krebsonsecurity.com

tonyfelice• 13 years ago

Sort of insinuates that ID theft is not meant to be a core focus of Experian.

carbocation3• 13 years ago

Sort of insinuates that ID theft is not meant to be a core focus of Experian.

The post is saying that a service that aids scammers purchased data from Experian.

Seeing the title, I initially thought it meant that Experian sold data to an ID Theft-prevention service, which would be less bad.

greenyoda• 13 years ago

I read it the same way, but that would have been pretty bad in and of itself. Why should an ID theft prevention service have data on me unless I have a business relationship with them?

3327• 13 years ago

Well, is it fair to say that the credit system in the US is fued up? Oligopoly of 3 agencies have pretty much entire control of your fate. Yes Fate. Purchasing power means cash and since credit = cash these companies control the cash that you have at disposal. Which means your FATE. Its insanely difficult to pierce oligopolistic structures and Cartels because of obvious reasons. But some day some startup needs to tackle this. The system works for most but doesn't work for many.

callmeed4• 13 years ago

Yes absolutely. I currently cannot buy a house despite having a six-figure income for 4 years, money in savings, and having no debt save my student loan. All because of bad decisions I made in years past.

dangrossman3• 13 years ago

Actual bad decisions you made in the past are a valid reason not to risk underwriting a large loan to you. There are valid criticisms of the credit agencies, but that doesn't seem like one of them.

If you want a mortgage and you feel you have a convincing reason a bank should risk entrusting you with their money despite a bad credit history, try an in-person appointment with a lender at a local credit union. Be prepared to show your bank statements, several years of tax returns, and if you're self-employed, a signed letter from your business's accountant about the health of your cash flow. You'll definitely need enough cash on hand for a downpayment of at least 30% the house's value; good strategy even if it weren't required.

If you really want to look credit-worthy, use that six figure income to pay off those student loans before you take on an even larger debt obligation.

malandrew2• 13 years ago

I thought credit rating things only lasted 7 years. Are your credit transgressions more recent than that?

afreak• 13 years ago

This Dilbert comic is 100% apt today: http://dilbert.com/strips/comic/2010-10-14/

NIL8• 13 years ago

Perfect.

f902370• 13 years ago

The world should calm down. Take a few years to review what we've done in last 50 years.

skrebbel• 13 years ago

Yeah. Let's rent a holiday cottage with all of us and talk it though.

mindslight• 13 years ago

Except there's actually no such thing as "identity theft" - it's a mere figment of the credit industry's (tracking industry's) fantasy in which they're omniscient, and an attempt to slowly push the responsibility for bank fraud onto uninvolved third parties. In reality, some would-be bank fraudsters got ahold of some non-secret information.

Amadou• 13 years ago

I agree. Identity theft is just a particular method of fraud with a name that mitigates the responsibility of the institutions that enabled the fraudsters.

I don't know if it is one one of those terms that was invented by one of those PR agencies that invented terms like "climate change" to mitigate the visceral impact of "global warming."[1] But it certainly has ended up as a term that obfuscates the responsibility of banks to stop treating public information like passwords.

[1] https://en.wikipedia.org/wiki/Frank_Luntz

davvolun• 13 years ago

I think 'climate change' is generally used now because 'global warming' implies the entire globe will become warmer, when in fact some areas, due to complex interactions, will actually become cooler. That, combined with the political posturing (on both sides), has made it useful to use a more general term. IMHO.

malandrew2• 13 years ago

I wonder if you could mount a class-action lawsuit against multiple financial institutions on behalf of all the "identity theft victims".

summerdown2• 13 years ago

I think this is relevant: it's a sketch from the show "Mitchell and Webb about identity theft.

http://www.youtube.com/watch?v=CS9ptA3Ya9E

dan1234• 13 years ago

The UK police[0] define identity theft as when personal details are stolen and identity fraud as when those details are used to commit fraud.

http://www.actionfraud.police.uk/fraud_protection/identity_f...

AsymetricCom• 13 years ago

Comanies that facilitate identity-based services should be charged as accomplices then, as well as receiving stolen goods.

icu3• 13 years ago

Thanks cylo for the post. Sadly we can't seem to trust the credit agencies or Government agencies with data protection. We need a politician who will champion some sort of legal offence (Federal?) for digital data protection breaches whatever the industry/company (above anything that already exists) that will scare companies enough that they start taking digital identity seriously. Maybe that's a pipe dream but I get the sense after reading this article that regulators just don't carry a big enough stick or have too light a touch when punishing serious infractions.

Zenst• 13 years ago

Agreed and I'm somewhat supprised (UK peep here) that no data protection act is in place. UK had first version of the act in 1984 (oh the ironic choice of dates, govermental humour maybe).

With that I'm amazzed there is nothing in the USA, must be something beyond class action suits?

ams61104• 13 years ago

I think protecting data is a hopeless goal. The penalties need to be for fraud, and the responsibility for identity verification needs to be the creditors.

Hospital admissions and discharges used to be published every day in the paper. People used to have their social security number printed on their checks. Someone's birthday was a day of celebration, not a personal secret.

I want to get back to a place where routine facts about me do not need to be secret or something I worry about. The onus should be on anyone granting credit to verify that the person is who they claim to be, and it should take more than a few bits of public information to do that.

icu3• 13 years ago

Having lived in the USA and the UK I've experienced the political contrasts. My gut feel is that the American political engagement, the way the media reports politics, and how people think as a result are to blame here.

So exactly what do I mean by that? Well for starters I believe that the American political structure doesn't lend itself easily to direct public scrutiny and transparency. I can't remember ever meeting an American politician except when it was in their best self interest... surprise, surprise right around election time. Barriers are set up making it difficult to get face-time with a Senator or a Governor. By comparison MPs (British Members of Parliament) are obliged to have open constituency meetings where a member of the public can arrange to speak to their MP face to face.

British politicians just seem more willing to me to engage with 'Joe Public.' For example, it would be beyond belief to hear that the US Vice President or some Governor of some state has a weekly call in radio talk show slot, yet Deputy Prime Minister Nick Clegg (kind of like the British Vice President) and Mayor of London Boris Johnson (who is more like a US Governor than a city Mayor) have regular weekly radio slot on LBC (a call in radio talk show) where they calls from ordinary citizens and sometimes take some intense heat.

Also understanding American politics outside of the likes of Fox and others (or what I would say is the "TV political bubble") is difficult. Sure there are some amazing publications one can read. The likes of the The Wall Street Journal, The New York Times, Time, The Economist, and Foreign Policy all spring to mind. However these publications are not for everyone and definitely not read by the masses.

In comparison, the Sun and other tabloids, manage to break politics down into bite-sized blurbs that focus on the important parts for the everyman. I believe that this allows Brit Joe Public to be regularly informed on politics and therefore more engaged. So well much could be said about how bad tabloids are, I think they provide a valuable public service keeping people informed and from time to time crucifying the odd politician or goading them to action.

If there was maybe more public political engagement, more willingness for politicians to be accountable and less special interests on capital hill maybe the average citizen would understand why data protection is important and feel they have the leverage on politicians to enact it.

bediger4000• 13 years ago

Do "underground" credit rating agencies exist? I don't mean credit rating agencies for carders and scammers, I mean agencies that track things they're not supposed to track. Agencies that keep the data on file for longer than they're supposed, keep track of how many times a particular ID asks for refunds, or to get their security deposit back, material like that.

It would have to be out of the Caribbean or some place with lax data privacy laws, and strict confidentiality laws.

gergles• 13 years ago

There's a ton of those that are fully aboveboard, you just don't hear about them. One exists for return tracking, one exists for how many applications you've filed for credit cards, one exists for landlord/tenant court entries that saves them forever (they insist they aren't a CRA but under the law they clearly are) -- there's a ton of them other than the Big 3 and there's almost no effective regulation around them.

cptskippy3• 13 years ago

I did a double take when I saw this because I've been in contact with Equifax recently because I started receiving SPAM form a non-existent email address that I shared with them.

I have a Catch-all address setup on my Domain so that I can give every site I interact with their own custom email address. In this case it was equifax.com@mydomain.com. Since the email address doesn't exist, and they're the only company I've shared it with, they're the only ones with a record of it's existence.

When I emailed them asking if they'd had a security breach or if they were selling email addresses they responded saying they would opt me out of marking emails. When I responded with the context and header info of the emails I received and asked if this was in fact from them things turned. About an hour later I got a response, the tone had changed significantly and they indicated that the incident had been escalated to their security department and that they would be in contact with me as their investigation progressed.

I can say this has been the best response to the dozens of emails I've sent to companies about the same issue. The worst was Best Buy whose response was something along the lines of "Eat Dk, we do what we want."

nwh• 13 years ago

Heh, same. The excuses I get from companies are hilarious. In my case they're just the domain, but encoded and obfuscated. The company will claim anything to get out of it, that my account was compromised, all the way to someone guessing it.

Irritatingly, when I signed up for the utilities at my apartment I used a single address "utilities@domain.com" for simplicity. One of my three suppliers leaked my details with that address, and they all deny it. Took less than a week from moving in to getting penis pump advertisements at that address.

GFischer4• 13 years ago

I worked for an Equifax subsidiary for a time, and I can vouch that at least there they took security very seriously, and always worked with the best practices.

The downside was that changes were veery slow to implement :)

hnriot• 13 years ago

that's not exactly a difficult email address to guess, I would think that in this case (specifically this case) equifax would have a very good claim that it wasn't them that leaked it. If instead you had used a hash or something unguessable then you might have a case, but I could easily go and sign up to my favorite nigerian viagra supplier with all the usual suspects facebook@yourdomain.com, airbnb@yourdomain.com... and you'd go right on blaming the facebook, airbnb, etc.

eropple• 13 years ago

Agreed--this is why I append a few random characters to the end of my catchalls when I set them up. Not a hash or anything, but the likelihood of someone guessing a few characters blindly hit on the keyboard is low.

cptskippy3• 13 years ago

This is a classic case of engineering a solution to a problem that doesn't exist.

The first question you have to ask your self is for what reason would anyone choose to do that? Shits-and-giggles and malice against me personally are about the only legitimate reasons someone would do that.

Spammers wouldn't want my dummy addresses in their list, and harvesters who sell emails to spammers wouldn't either because I could easily invalidate swaths of their lists by disabling my catch-all giving them a bad reputation.

I mainly do this to see how my email address gets around. If and when I contact a company about my email address receiving SPAM, I don't name and shame in any public capacity. Its of little consequence how they respond because the damage is done, its not like they can undo the SPAM.

usefulcat• 13 years ago

I do the same thing (using unique email addresses) and over the years several such addresses have been aquired by spammers one way or another. Until recently, it was mainly smaller sites and businesses that this happened with. But I was quite surprised when I started getting spam at the unique address I gave to Dropbox.

cptskippy3• 13 years ago

I'm always disappointed when I receive SPAM from large online companies like that. SPAM on non-profit emails or from small businesses that probably use Outlook are no surprise but large IT related companies are disappointed.

I was pleasantly amused when I got an email from my congress man asking my specifically about my email address and wanting to know what was going on. We had a nice back and forth conversation about it and I had a greater appreciation for him as a result because I knew that a human was actually reading my emails. More than that, he was looking at the email address.

vinhboy• 13 years ago

Very interesting story. Do let us know how it turns out.

arca_vorago• 13 years ago

For those of you interested in learning how the cough scam cough system of credit scores works and how to maximize the system, here is a talk I have found very informative. It's a dirty business and industry...

http://www.youtube.com/watch?v=5gFDnQGr6WU

Experian Sold Consumer Data to ID Theft Service

Related Stories