Equifax customer information leak

[2pedals]

According to Krebs on Security, a freeze at Chex Systems will prevent thieves from opening checking and savings accounts in my name. I assume that it would prevent me from buying certificates of deposit from banks as well. Would this be the case at banks that I already have certificates of deposit with?

I checked the list of consumer reporting companies provided by the Consumer Financial Protection Bureau. The list is about 30 pages long and applies to nearly every aspect of our financial lives. One has to wonder how many of those companies have been hacked.

DMW

Can you provide link to back that up? I have not seen that on the Krebs web page. What I saw is this. He talks about placing a security alert not a freeze.

[zaplunken]

An alert is a minor effort, a freeze is the real deal. Read what the differences are at one of the sites.

[Dead Man Walking]

According to Krebs on Security, a freeze at Chex Systems will prevent thieves from opening checking and savings accounts in my name. I assume that it would prevent me from buying certificates of deposit from banks as well. Would this be the case at banks that I already have certificates of deposit with?

I checked the list of consumer reporting companies provided by the Consumer Financial Protection Bureau. The list is about 30 pages long and applies to nearly every aspect of our financial lives. One has to wonder how many of those companies have been hacked.

DMW

Can you provide link to back that up? I have not seen that on the Krebs web page. What I saw is this. He talks about placing a security alert not a freeze.

I have edited my post. I used the link to Chex Systems that Krebs provided and mistakenly credited him in my original post.

DMW

[2pedals]

Okay, I was just thinking...why Krebs would say place an alert for ChexSystem rather than a freeze like he says to do for the big three and Innovis? He specifically says to place an ChexSystems alert to notify to keep eye out for fraud.

[Pajamas]

If they truly didn't do anything wrong and were just hit by a really good hacker (whatever that means), why all the retirements? Makes me more suspicious of what occurred. I am guessing (hoping) criminal charges come out of all of this.

They failed to implement basic security measures such as keeping their basic software updated. Considering the importance of the information they collect and sell without your permission and the sheer quantity of data stolen, a few resignations of key employees is not enough. This company should sell its business to another credit agency or shut it down and distribute anything left to the victims of their negligence.

The $18 million annual retirement that the CEO walked away with is undeserved considering the failure to ensure the most basic security measures were followed. How many members of Bogleheads would it take to total $18 million a year in retirement?

[mhalley]

As usual, the CEO gets his golden parachute. I don't think it's 18 mil a year, but still not too shabby.

. Smith will receive his $18.4 million pension and retirement benefits upon leaving, an Equifax spokesperson said. He was “entitled to that pension under any circumstance,” the spokesperson said. Smith will not be receiving a a severance payment or a bonus for 2017, after receiving approximately $3 million in bonus payments in 2015 and 2016
Smith could still receive the full value from past stock awards, some of which are only received three years after they are granted, depending on what the special committee determines. An Equifax spokesperson said the value of those potential awards is "currently less than $20 million."
.

https://www.buzzfeed.com/matthewzeitlin ... .rl44v4r41

[Munir]

A freeze is a minor effort, a freeze is the real deal. Read what the differences are at one of the sites.

zaplunken: A typo? Which is the "minor" effort?

[zaplunken]

A freeze is a minor effort, a freeze is the real deal. Read what the differences are at one of the sites.

zaplunken: A typo? Which is the "minor" effort?

If you go to the credit bureau websites and read the differences you'll see a freeze locks your credit report so no one can gain access to it and even you can't apply for new credit until you unlock it. An alert is good for 90 days and then expires (if you're a identity theft victim I think it is longer but again go read it) and has to be renewed. It does little to stop a business from giving credit to someone but again I forget the details.

[Munir]

A freeze is a minor effort, a freeze is the real deal. Read what the differences are at one of the sites.

zaplunken: A typo? Which is the "minor" effort?

If you go to the credit bureau websites and read the differences you'll see a freeze locks your credit report so no one can gain access to it and even you can't apply for new credit until you unlock it. An alert is good for 90 days and then expires (if you're a identity theft victim I think it is longer but again go read it) and has to be renewed. It does little to stop a business from giving credit to someone but again I forget the details.

Zaplunken: I understand and agree with your latest explanation. My point was that your original post repeated the word "freeze" for both scenarios when I assume you really intended to say "alert" is a "minor effort" at the start of the paragraph- which is why I said you have a typo. Please re-read your original post.

[Small Law Survivor]

Wow, there are over 650 posts on this thread - way too long to read!

Is there a "best practices" summary/conclusions somewhere?

[AntsOnTheMarch]

Wow, there are over 650 posts on this thread - way too long to read!

Is there a "best practices" summary/conclusions somewhere?

I would read this:
https://krebsonsecurity.com/2017/09/the ... ould-know/

Seems to cover it well, imo.

Edit: I had not seen the wiki page siamond posted just below. Looks good! Definitely go for that.

[siamond]

Wow, there are over 650 posts on this thread - way too long to read!

Is there a "best practices" summary/conclusions somewhere?

Let me suggest you read the Wiki page we created in the process...
https://www.bogleheads.org/wiki/Credit_freeze

Bottomline: would be safe to freeze your credit with all major credit agencies.

[flamesabers]

If you go to the credit bureau websites and read the differences you'll see a freeze locks your credit report so no one can gain access to it and even you can't apply for new credit until you unlock it. An alert is good for 90 days and then expires (if you're a identity theft victim I think it is longer but again go read it) and has to be renewed. It does little to stop a business from giving credit to someone but again I forget the details.

If you're the victim of identity thief you can file an extended fraud alert that will last for seven years.

[zaplunken]

A freeze is a minor effort, a freeze is the real deal. Read what the differences are at one of the sites.

zaplunken: A typo? Which is the "minor" effort?

If you go to the credit bureau websites and read the differences you'll see a freeze locks your credit report so no one can gain access to it and even you can't apply for new credit until you unlock it. An alert is good for 90 days and then expires (if you're a identity theft victim I think it is longer but again go read it) and has to be renewed. It does little to stop a business from giving credit to someone but again I forget the details.

Zaplunken: I understand and agree with your latest explanation. My point was that your original post repeated the word "freeze" for both scenarios when I assume you really intended to say "alert" is a "minor effort" at the start of the paragraph- which is why I said you have a typo. Please re-read your original post.

Doh! I proof read before I post and often after I post and yet I missed that! Thanks for the correction, I just fixed it.

[nisiprius]

I put in a security freeze at ChexSystems on 9/12. As fate would have it, I needed to open a savings account last week. The bank said to me "are you aware that you have a security freeze in on your account?" I said "yes." And that was all there was to it. I didn't need to lift the freeze in order to open the account.

[neilpilot]

I put in a security freeze at ChexSystems on 9/12. As fate would have it, I needed to open a savings account last week. The bank said to me "are you aware that you have a security freeze in on your account?" I said "yes." And that was all there was to it. I didn't need to lift the freeze in order to open the account.

Seems Equifax isn't the only CRA that has questionable practices.

Edit - I misread your post and mistakenly thought that ChexSystems lifted the freeze.

[flamesabers]

I put in a security freeze at ChexSystems on 9/12. As fate would have it, I needed to open a savings account last week. The bank said to me "are you aware that you have a security freeze in on your account?" I said "yes." And that was all there was to it. I didn't need to lift the freeze in order to open the account.

Were you actually at the bank when you tried to open the savings account?

[zaplunken]

I put in a security freeze at ChexSystems on 9/12. As fate would have it, I needed to open a savings account last week. The bank said to me "are you aware that you have a security freeze in on your account?" I said "yes." And that was all there was to it. I didn't need to lift the freeze in order to open the account.

While that is convenient that is NOT how this is supposed to work for crying out loud! And a bank no less? Do they know you very very well? I sure hope so.

[Earl Lemongrab]

While that is convenient that is NOT how this is supposed to work for crying out loud! And a bank no less? Do they know you very very well? I sure hope so.

Says who? These freezes prevent the agencies from providing the information that they hold. It doesn't prevent anyone from opening accounts. There isn't any law preventing it.

[zaplunken]

Without info I would expect them to not open an account but being a bank and not selling products/extending credit I see your point. to get a loan from the bank I trust that would be prevented.

[learning_head]

I put in a security freeze at ChexSystems on 9/12. As fate would have it, I needed to open a savings account last week. The bank said to me "are you aware that you have a security freeze in on your account?" I said "yes." And that was all there was to it. I didn't need to lift the freeze in order to open the account.

Were you actually at the bank when you tried to open the savings account?

And did you feel like they were trying to make sure you are who you say you are a little more than usual?

Either way, this is quite disappointing. Thanks for sharing this experience, Nisiprius

[F150HD]

I put in a security freeze at ChexSystems on 9/12. As fate would have it, I needed to open a savings account last week. The bank said to me "are you aware that you have a security freeze in on your account?" I said "yes." And that was all there was to it. I didn't need to lift the freeze in order to open the account.

Interesting. I may be switching cell phone providers in a few months, I wonder if I'll need to 'lift a freeze' to do that.....or if I can move w/out having to worry about it. Haven't moved phone providers in a long while.

[Earl Lemongrab]

And did you feel like they were trying to make sure you are who you say you are a little more than usual?

Either way, this is quite disappointing. Thanks for sharing this experience, Nisiprius

If it was in-person, then it wouldn't surprise or disappoint me. They would have better and more reliable ways of checking identity.

[SmileyFace]

I put in a security freeze at ChexSystems on 9/12. As fate would have it, I needed to open a savings account last week. The bank said to me "are you aware that you have a security freeze in on your account?" I said "yes." And that was all there was to it. I didn't need to lift the freeze in order to open the account.

Interesting. I may be switching cell phone providers in a few months, I wonder if I'll need to 'lift a freeze' to do that.....or if I can move w/out having to worry about it. Haven't moved phone providers in a long while.

I believe a lot of carriers use SageStream for credit checks - lessor known so you may not have thought to put a freeze with them.

[F150HD]

I believe a lot of carriers use SageStream for credit checks - lessor known so you may not have thought to put a freeze with them.

Thanks.

[Wakefield1]

Won't make a bit of difference. The whole system is broken and setup with wrong incentives, and a forced early retirement of CEO is not going fix it...

Agreed, and his $18 million annual pension isn't making me feel any better about it. With this breach, Pandora's box is open and can't be shut again.

If they truly didn't do anything wrong and were just hit by a really good hacker (whatever that means), why all the retirements? Makes me more suspicious of what occurred. I am guessing (hoping) criminal charges come out of all of this.

As alluded to by another poster it appears that an egregious failure to install an important security update to their system occurred-so might not have been too hard to hack
--then there is still that question about whether insider trading might have happened while the breach was known within the company but not yet to anyone else-and I am curious as to whether high level law enforcement was notified of the breach promptly or not before the breach was disclosed publicly

[AntsOnTheMarch]

Won't make a bit of difference. The whole system is broken and setup with wrong incentives, and a forced early retirement of CEO is not going fix it...

Agreed, and his $18 million annual pension isn't making me feel any better about it. With this breach, Pandora's box is open and can't be shut again.

If they truly didn't do anything wrong and were just hit by a really good hacker (whatever that means), why all the retirements? Makes me more suspicious of what occurred. I am guessing (hoping) criminal charges come out of all of this.

As alluded to by another poster it appears that an egregious failure to install an important security update to their system occurred-so might not have been too hard to hack
--then there is still that question about whether insider trading might have happened while the breach was known within the company but not yet to anyone else-and I am curious as to whether high level law enforcement was notified of the breach promptly or not before the breach was disclosed publicly

I just heard on NPR that the state of ny served them subpoena for more details/info shortly after breach became public. It was audio so I have no link but I'm sure that we will be hearing about this for many months. It also mentioned that the new CEO has promised to implement system by end January that "allows customers to fully control their own data"--whatever that means.

[chevca]

I read a couple articles on this today. One said Equifax was looking at how to make it permanently free to freeze and unfreeze one's credit there. I believe that's the new CEOs plan mentioned above.

The other was about a small percentage of folks have actually frozen their credit after the hack... like 7%, IIRC. I thought, huh, I believe all of those folks are posting in the Equifax thread on BH.

[cas]

It also mentioned that the new CEO has promised to implement system by end January that "allows customers to fully control their own data"--whatever that means.

The new CEO wrote an editorial in the Wall Street Journal where he announced that Equifax would be rolling out a new "credit lock" service "free, for life" in January. In the quotes I've seen, he used all the same buzzwords that TransUnion uses on their "credit lock" product.

Brian Krebs, of Krebs on Security, was extremely negative about the TransUnion "credit lock". My suspicion is that Equifax is trying to do something similar.

Currently, if you attempt to freeze your credit file at TransUnion, the company’s site is relentless in trying to steer you away from a freeze and toward the company’s free “credit lock” service.

That service, called TrueIdentity, claims to allow consumers to lock or unlock their credit files for free as often as they like with the touch of a button. But readers who take the bait probably won’t notice or read the terms of service for TrueIdentity, which has the consumer agree to a class action waiver, a mandatory arbitration clause, and something called ‘targeted marketing’ from TransUnion and their myriad partners.

<skip>

In short, TransUnion’s credit lock service (and a similarly named service from Experian) doesn’t prevent potential creditors from accessing your files, and these dubious services allow the credit bureaus to keep selling your credit history to lenders (or identity thieves) as they see fit.

As I wrote in a Sept. 11 Q&A about the Equifax breach, I take strong exception to the credit bureaus’ increasing use of the term “credit lock” to divert people away from freezes. Their motives for saddling consumers with even more confusing terminology are suspect, and I would not count on a credit lock to take the place of a credit freeze, regardless of what these companies claim (consider the source).

Source: https://krebsonsecurity.com/2017/09/equ ... -straight/ then scroll down to the "Freezing Up" sub-heading.

[SimonJester]

In short, TransUnion’s credit lock service (and a similarly named service from Experian) doesn’t prevent potential creditors from accessing your files, and these dubious services allow the credit bureaus to keep selling your credit history to lenders (or identity thieves) as they see fit.

I think his statement is a little misleading. TransUnion’s credit lock service DOES indeed block access to your credit file just like a freeze.

I believe the lock does not carry the same legal weight as the actual freeze, but does it really matter if you have the lock vs the freeze if the CRA is hacked? Your information is still stolen.

Also just because your have your CRA reports locked doesnt mean someone cannot obtain a fraudulent account in your name. That still can happen, it just means the creditor will not have access to your credit report.

[learning_head]

In short, TransUnion’s credit lock service (and a similarly named service from Experian) doesn’t prevent potential creditors from accessing your files, and these dubious services allow the credit bureaus to keep selling your credit history to lenders (or identity thieves) as they see fit.

I think his statement is a little misleading. TransUnion’s credit lock service DOES indeed block access to your credit file just like a freeze.

I believe the lock does not carry the same legal weight as the actual freeze, ...

That's been the big question in fact. Does it really block it for all? For example some agencies (like insurance companies) apparently can still access your credit if you have a lock, but not a freeze. What's exactly the extent of the blocking via "lock" vs real "freeze", and is there any guarantees it won't change in future, given that there are no regulations on TransUnion regarding lock, unlike the freeze?

I wish TransUnion were more transparent about it.

And I wish even more TransUnion provided an actual freeze, not just a lock, in same manner as they do for their "lock"; but it's not in their business interest.

... but does it really matter if you have the lock vs the freeze if the CRA is hacked? Your information is still stolen

Lock vs freeze matters even MORE when your information is stolen, since it's a lower vs higher barrier for thieves to *use* that stolen information (i.e. when trying to open accounts in your name).

[SimonJester]

That's been the big question in fact. Does it really block it for all? For example some agencies (like insurance companies) apparently can still access your credit if you have a lock, but not a freeze.

Actually insurance companies have been accessing my reports with them frozen for years. It showed up as a soft pull even though they were frozen.

What's exactly the extent of the blocking via "lock" vs real "freeze", and is there any guarantees it won't change in future, given that there are no regulations on TransUnion regarding lock, unlike the freeze?
I wish TransUnion were more transparent about it.
And I wish even more TransUnion provided an actual freeze, not just a lock, in same manner as they do for their "lock"; but it's not in their business interest.

I couldn't agree more with this. I suspect the business model may change with this hack, but sadly probably not free freezes and unfreezes.

I had had my reports frozen for about 10 years, the biggest pain is that you have to pay (in some states) to temporarily unfreeze.

[learning_head]

That's been the big question in fact. Does it really block it for all? For example some agencies (like insurance companies) apparently can still access your credit if you have a lock, but not a freeze.

Actually insurance companies have been accessing my reports with them frozen for years. It showed up as a soft pull even though they were frozen.

That should be allowed only by insurance companies that you currently do business with. When (really) frozen, and not just "locked", soft pulls are still allowed by any organization that you are currently customer of. However, if you try to shop around for insurance, you may not get as good of a quote since the new ones won't be able to access it.

I couldn't agree more with this. I suspect the business model may change with this hack, but sadly probably not free freezes and unfreezes.

Hmm; I would think the opposite - business model will remain the same as it would require major structural changes to how these companies operate (or even exist) and I am not sure there is enough public will to change that.

As for free freezes/temporary lifts/unfreezes, [OT comment removed by admin LadyGeek]

Anyway, all we can do is contact our representatives to encourage some action...

[SimonJester]

That should be allowed only by insurance companies that you currently do business with. When (really) frozen, and not just "locked", soft pulls are still allowed by any organization that you are currently customer of. However, if you try to shop around for insurance, you may not get as good of a quote since the new ones won't be able to access it.

This is how I understand it to work as well, however I absolutely know 100% sure my reports were frozen and multiple soft pulls were reported from insurance companies I have never done business with before when getting insurance quotes. Its not supposed to happen but it did...

When pulling my reports from the three main CRAs it shows my reports are frozen, then shows the soft pulls from the insurance companies I requested quotes from,

[zaplunken]

My credit report has been frozen at the 3 majors for years. I assume my insurance company checks upon renewal each year but I never have received an email stating they were accessed. When I unfroze one to increase a credit card limit that did generate an email to me. I guess whatever the insurance company does isn't at a level that it alerts the company that monitors my credit or maybe they realize what it is and don't report it.

[LadyGeek]

I removed a comment concerning proposed legislation related to the credit freeze. Discussions of proposed legislation are off-topic. See: Re: Tax exempt muni bond funds & proposed lower rates on taxable investment interest for the details.

[Longtermgrowth]

It also mentioned that the new CEO has promised to implement system by end January that "allows customers to fully control their own data"--whatever that means.

When watching Nightly Business Report today, my initial impression was that they already made the free lock/unlock for life accessible. Skip to 10:25 in the video: http://nbr.com/2017/09/28/nightly-busin ... r-28-2017/

[F150HD]

Equifax says millions more customers affected in cyberattack than previously reported

http://www.marketwatch.com/story/equifa ... 2017-10-02

In late September, Mandiant, which is owned by FireEye Inc. FEYE, +3.04% reported that hackers had been roaming on Equifax's network undetected for more than four months.

(Maybe this is posted in a diff thread)

[DiggleRex]

And I wish even more TransUnion provided an actual freeze, not just a lock, in same manner as they do for their "lock"; but it's not in their business interest.

I admit I am new to all this, and everything I've learned about credit reports and freezes etc, I've learned in the past couple of weeks. But I don't understand why, especially now, there isn't one centralized website (like a .gov website), where all three can be frozen/unfrozen instantly, with a minimum of two-factor authentication to sign in (and perhaps a way to make it even more secure than that). I haven't frozen mine yet (I plan to), but based on my understanding, it's pointless to only have 1/3 or 2/3 frozen, so the fact that it has to be done separately for each of the big three seems absurd. It's like if your house has three entry points, you hire 1 locksmith to change the locks, not three locksmiths--one for each door. I'm skeptical of the "locks" because the companies are all of a sudden pushing them so hard and trying to scare people away from freezes, and it makes me wonder why or what one might be agreeing to (fine print) without knowing it. Freezes wouldn't be so scary if you could literally toggle a switch from just one website.

[zaplunken]

Yesterday I got the info from Innovis and ChexSystems, almost 3 weeks so they are getting it out just swamped.

[Uncle Pennybags]

But I don't understand why, especially now, there isn't one centralized website (like a .gov website), where all three can be frozen/unfrozen instantly,

That is not in the business interests of our politicians. There will be a dog and pony show on the hill today, I'll be watching.

[flamesabers]

I admit I am new to all this, and everything I've learned about credit reports and freezes etc, I've learned in the past couple of weeks. But I don't understand why, especially now, there isn't one centralized website (like a .gov website), where all three can be frozen/unfrozen instantly, with a minimum of two-factor authentication to sign in (and perhaps a way to make it even more secure than that). I haven't frozen mine yet (I plan to), but based on my understanding, it's pointless to only have 1/3 or 2/3 frozen, so the fact that it has to be done separately for each of the big three seems absurd. It's like if your house has three entry points, you hire 1 locksmith to change the locks, not three locksmiths--one for each door. I'm skeptical of the "locks" because the companies are all of a sudden pushing them so hard and trying to scare people away from freezes, and it makes me wonder why or what one might be agreeing to (fine print) without knowing it. Freezes wouldn't be so scary if you could literally toggle a switch from just one website.

The reason why there isn't a centralized website is because the three credit reporting bureaus are private firms. It would be like asking why when you move you have to notify all of the companies you do business with of your new address instead of just submitting a change of address with a centralized website.

As for your locksmith analogy, I think a more accurate analogy would be having three houses in three separate states instead of three points of entry in one house. Unless the locksmith you were hiring had branches all throughout the country, you would more then likely hire 3 different locksmiths to change all of your locks.

In regards to freezing vs. locking, it doesn't look like there's an article on the FTC website as to what "locking" your credit report entails in terms of personal liability and the like.

[Uncle Pennybags]

The reason why there isn't a centralized website is because the three credit reporting bureaus are private firms.

These private firms can be forced to offer services like a free credit report. The problem is people have to face the consequences alone when they have a stolen ID, it doesn't make headlines and there are no congressional hearings. Of course one could buy "protection" from Equifax. What a racket, the mob has nothing on these "legitimate" businesses.

[pennstater2005]

Enrolling into their free monitoring will exclude you from any future class action lawsuits.

With so many people involved what would the actual amount of settlement money be at the end anyway? A check probably barely worth cashing. I got a check a few years ago from student loan servicer AES that was a few dollars. I did cash it though

[Mudpuppy]

The reason why there isn't a centralized website is because the three credit reporting bureaus are private firms. It would be like asking why when you move you have to notify all of the companies you do business with of your new address instead of just submitting a change of address with a centralized website.

Being a private firm doesn't make them immune to government regulations. For example, they all work through a centralized government website to get your annual credit report because that is what regulations require them to do. But discussing potential regulations is against forum policies. We'll just have to wait and see what regulatory changes come out of this breach.

[benevo]

I put in a security freeze at ChexSystems on 9/12. As fate would have it, I needed to open a savings account last week. The bank said to me "are you aware that you have a security freeze in on your account?" I said "yes." And that was all there was to it. I didn't need to lift the freeze in order to open the account.

Interesting. I may be switching cell phone providers in a few months, I wonder if I'll need to 'lift a freeze' to do that.....or if I can move w/out having to worry about it. Haven't moved phone providers in a long while.

I have an alert on my account - supposed to get a phone call verifying before accounts are opened - opened a new cell account, no call.

[DiggleRex]

I have an alert on my account - supposed to get a phone call verifying before accounts are opened - opened a new cell account, no call.

A 90 day fraud alert? Through which bureaus?

[benevo]

Equifax, TransUnion, and Experian

[DiggleRex]

Equifax, TransUnion, and Experian

Which one did you place it with? I placed it with Experian, it was forwarded to Transunion but not Equifax. Someone else on here also reported that only 2/3 got it. But in any case, it's a shame that the fraud alerts aren't taken more seriously, but that's one of the criticisms that I've read--that they're often ignored, if they're even noticed. I take it you haven't done any freezes yet?

[benevo]

Equifax, TransUnion, and Experian

Which one did you place it with? I placed it with Experian, it was forwarded to Transunion but not Equifax. Someone else on here also reported that only 2/3 got it. But in any case, it's a shame that the fraud alerts aren't taken more seriously, but that's one of the criticisms that I've read--that they're often ignored, if they're even noticed. I take it you haven't done any freezes yet?

Hmmm! I'll have to confirm, that's a great question. No, didn't do a freeze yet - knew I'd be setting up a new cell account and didn't want to unfreeze. I'm in a state where it's free to freeze but not unfreeze, so figured I'd wait. Now that account is setup, I'm not sure what to do!