Hacker News Reader

Comment by banned1 | Hacker News Reader

Another commenter, who now deleted the comment, said: "There's a 44% chance you were affected, but a 100% chance you waive your right to be in a class action lawsuit if you enroll in their ID protection."

I thought it was a good comment, but I wonder if it matters.

How much would you get? I have been a member of these class action lawsuits before, and I get, like, $3 for my troubles at the end of the day, so I never claim the prize because it's another database where my SSN would be stored and stolen from.

I think the best is to freeze your credit report and deal with the troubles of having to unfreeze it when you need a loan.

If there are expert people from the Fin Svc industry here, is the above correct? Is freeze pretty much the only reasonable action now to protect ourselves?

View on HN

Saying it's a 44% chance you're affected is really skewing things away from how severe they really are. At least 22% of Americans are under 18. There are actually 167 million Americans who own one or more credit cards, so this actually affects 86% of all US credit card holders.

Not to shamelessly promote, but as soon as this broke yesterday I brought this to the attention of my firm and we filed I believe this morning.

http://www.prnewswire.com/news-releases/classactioncom-files...

Glad filings are being made already, I wonder if it will be possible for someone to also seek relief/guidance for individuals checking to see if they were breached on trustedidpremier.com and may be inadvertently waiving their rights to class action suits and instead being forced into individual arbitration.

Based on the fact their privacy policy and terms of service were just updated on Sep 6, this seems pretty blatant. Browserwrapped agreements haven't held up in most cases, but having the arbitration clause at the very beginning seems to be point of the entire thing. Pushing a notice 41 days after a breach (just in time for the 45 day requirement in most states) and directing individuals to check if they are impacted all while tricking them into waiving rights. Seems deceptive to me.

Could you guys push for free credit freezes and unfreezes going forward instead of some sorta ridiculously small monetary comp. It should be free at all bureaus, with Equifax picking up the bill for unfreezing and freezing at the other two.

I'm just a developer in marketing, but I can suggest it.

Well, at least let them know that some nerds on the internet asked for this :)

And. Make it possible to do the process online for all three credit reporting agencies (one of them still requires a phone call). Having to pay and spend at least 20 minutes on the phone to lift your credit freeze because is just ridiculous.

Better yet, lets do away with credit reporting agencies. Why should any oligopoly or, indeed any non-government entity be allow to have the power to cause so much harm to is with effectively no accountability?

How do you prove your identity when freezing and unfreezing? Is it similar to how you "prove" your identity when you apply for credit?

You would use a PIN that is generated at the time of freezing the account. However, this doesn't prevent a future attack from obtaining the PINs.

And if I forget my pin?

It'll be pretty epic for the class if you guys manage to settle this one for tens of millions of dollars too.

Another firm that filed in Oregon yesterday said they're seeking up to 70 billion in damages for clients nationally.

That's right, billion with a B.

I was just making fun of the info highlighted in the press release. If I have it right, the Target breach affected 41 million people. Helping them put it in the rear view mirror for ~$10 million is quite a service.

Maybe it was a different Target data breach?

I'm just saying that some firms try. There's really nobody making them accountable otherwise.

This isn't Equifax's first data breach and the others are pretty recent too.

That's how class actions work. The lawyers extract a fee from the perpetrator as protection against larger settlements/judgments. Perp limits their downside, law firm gets paid, consumers are left holding the bag.

AFAIK, one of our attorneys was involved in 2 with Target, one for $10mil and one for $13mil. We're also involved with Home Depot and other data breach cases. They scope of those breaches is much smaller than this one, by the way.

To date, having been a participant in three - that I was notified of by email - I've netted about twenty bucks.

But I'm also not sure what the benefit of enrolling in their ID protection scheme is, given that the whole reason they're offering it is because they already gave it out to some rando on the internet.

It's rather like paying the schoolyard bully to stop taking your lunch money.

I've received $20.43 from the Perkins v. LinkedIn class action settlement. Personally, it's not about the money, but rather about trying to hold companies accountable for their actions.

(http://www.addconnectionssettlement.com/)

Exactly. People complain about how the lawyers who managed the case (sometimes for years!) take most of the payout, but so long as the company's risk/reward math is tipped towards the safety of their customers I have no issue with not seeing much of the settlement.

>the lawyers who managed the case (sometimes for years!) take most of the payout

This meme is part of the problem. The lawyers take maybe a third of the settlement, after bearing most of the costs of litigation themselves, which they would still bear if they lost. It's high risk/high reward. Lowering the reward just means no lawyer will take the case.

Quibbling over "most" is beside the point.

There is a real issue where the incentives for the lawyers don't line up well with the interests of the class. The lawyers likely do pretty well if they settle a huge case for tens of millions and the main thing that happens for the class is they can't file a lawsuit anymore.

The financial penalty for the company is better than nothing, but it often isn't all that much and often doesn't do the class any real good either.

Part of the reason that is an issue is that they're settling for much smaller amounts because the cut they get is big. So you have some massive data breach cases settled for things like $10 million. That's not even punitive at that point for companies like Target.

In practice it seems it basically just winds up being a big payout for whoever actually filed.

> Personally, it's not about the money, but rather about trying to hold companies accountable for their actions.

I'm not entirely certain that a class action settlement is a sufficient deterrent; do the payouts typically hurt the company enough to not take some given risk again?

But didn't you have to provide your SSN to them? That would seem like a huge risk to give your SSN to some paralegal somewhere or some Wordpress plugin and MySQL unsecured database right?

This is a space where I think the id theft protection industry misses. A large chunk of the space revolves around the 3 bureaus, but there's a lot more to it than that.

A credit freeze is only effective if the entity using your information actually checks your credit/talks to the bureaus.

Tax fraud, healthcare fraud, shady car dealerships that don't care about your credit, buying a house where the seller 'holds the papers', etc, are all attack vectors that can be used with this sort of information.

> the best is to freeze your credit report

A question that came up among my coworkers and I was: given the nature of the data that was accessed, don't the thieves already have all the info needed to unfreeze your credit?

Yea I really want clarification on this before I fork over $30 to the mafia families, I mean credit agencies, to lock my credit score.

When you freeze, they give you a PIN to unlock it. You can't unfreeze with just your hacked data alone. Of course, the PIN is probably in the next column over, so...

They've almost certainly got a "forgot my PIN" flow, too. Otherwise a forgotten PIN would mean a lifetime loss of access to credit.

What do you want to bet it uses stuff like your SSN to verify?

For Equifax, you are exactly right [1]. If you lose your pin you just ask for a new one and provide some basic form of id.

[1] https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...

Yeesh.

> Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms.

Given that the hack included name, SSN, date of birth, and address, a fake copy of one of these should be incredibly easy to generate.

edit: Driver's license numbers were also leaked in some cases. Fun.

Even worse: In a number of states, the DL number is deterministic based upon name and DOB.

http://www.highprogrammer.com/alan/numbers/dl_us_shared.html

I don't know if it's still the case, but Virginia used to your SSN as an ID. There was an opt-out for that, which I exercised about 25-30 years ago, so I don't know if that policy is still in place.

There was no mention made that unfreeze PINs were leaked. When you freeze your report with the three CRAs, you are given an unlock code or PIN needed to unfreeze it.

(At least for Equifax) you can get a new pin if you provide a basic form of identification. Guess what they accept? The very things that were stolen.

That's not clear from their help article about it [1], depending on what, in their definition, constitutes "proper identification forms":

"If you lose the PIN that was issued to you when you added the Security Freeze to your credit file, you may request a new one in writing. Please provide proof of identification, such as a copy of your driver's license, passport, birth certificate or other proper identification forms."

[1]: https://help.equifax.com/s/article/ka137000000DS9XAAW/What-d...

The point of a class action suit isn't really the individual gain; it's the pain it's supposed to make the corporation feel. Providing a free trial of their stupid credit monitoring service probably doesn't do that.

It matters a great deal, because the company is saying, in effect, "We will help you mitigate the consequences of our failure, but only if you indemnify us against being held accountable."

I'd be happy to get nothing if they were enjoined from storing any data on me with a hefty penalty for non-compliance.

> you waive your right to be in a class action lawsuit if you enroll in their ID protection

Good luck to them trying to get that to hold in a court of law. Remember that it's ultimately a judge's decision on whether or not legalize like that has any real power.

I've been a member of many class action law suits. Often the payout is literally pennies, maybe dollars. But I have been a member of one class that received several thousand dollars from one suit. So it can happen, it's just rare.

Huh? I've been a part of many class action suits and received many hundreds of dollars. Better than just giving up.

Reply on news.ycombinator.com