Hacker News Reader

Comment by fastball | Hacker News Reader

Here is a crazy alternate theory for you guys, which I think fits all the details we have so far.

1. Equifax was never hacked.

2. Equifax accidentally deleted a substantial portion of their database.

3. Come up with a system to get the information they lost back, via a "have I been pwned?" checker.

3a. If you enter your details and they are not in their database, they assume it is one of the persons they deleted, add it to their database, and give you a "maybe hacked" message. Obviously a fictitious person would never have been in any of their databases, deleted or otherwise. So, assuming this fake person must be a deleted person, they add the info and show the "maybe hacked" message.

3b. If you enter your details and you are one of the lucky (haha) persons that were not deleted, you get a "you are safe" message.

4. Equifax gets a lot of their database they deleted back with little effort on their part.

What do you think?

View on HN

This is silly, because losing data would be lower outrage, and they might even purchase the data from other agencies so we wouldn't even know it happen.

Also the data that leaked is not the valuable data to them. See how proudly they stated that no core databases were affected? Not giving a damn about us?

What's valuable to them and to banks that use them are the actual information about our credit. If that was compromised that would kill them, because they would lose trust of their real customers (banks).

  crazy alternate theory

If #2 is what happened, they aren't acting in their own interests by saying they were hacked. If they were hacked, that means 3rd parties have the data. If they merely deleted a database, that implies the info is gone and nobody has it.

Surreptitiously recreating a database? They can get a list of SSNs from the government, what is a user going to add to that? One of their addresses? All of their previous financial activity? What do you think the database contains?

Not to mention the idea that Equifax doesn't have backups.

Junior developer gone rogue then, using a hacking story to cover his tracks.

> 2. Equifax accidentally deleted a substantial portion of their database.

Although most people know of stories where backups were broken, didn't work, (etc) for some reason, it would be truly mind boggling for it to be the case here.

Deleting a substantial amounts of production data... seen that before (I used to be a NetBackup Admin for large places). But recovery procedures do exist, and for them not to have multiple levels of recovery available for their core mission data is extremely unlikely.

If all they need is a database of basic consumer info, they could buy that list from one of the other credit reporting agencies and avoid the public scrutiny of themselves and the industry itself.

Why would one of the other two sell it to them?

avoid the public scrutiny of themselves and the industry

They'd probably give it to them for free if that would avoid a huge public disclosure.

Though the proposed scenario is impossible, if Equifax really did lose most of their database, asking users to type in their current name/address/SSN (or buying it from a competitor) wouldn't help them, the valuable data is in the credit history, and without that data, Equifax has no business, so they'll go bankrupt. Even if they asked consumers for the data, few people know all of the data that the credit agencies have on them.

They do it now. Typically businesses only report credit information to one of the bureaus. They exchange information with each other so information eventually makes it around to all three.

If that was the case, it would be well-known because banks would not be able to get Equifax credit reports on consumers.

Reply on news.ycombinator.com