Equifax linked customers to my fake phishing version of their site by accident

Why in the world wouldn't they just put it on their own domain?

I'm with you, it's more criminal that after all they've flubbed, this company is even still allowed to operate, than that they lost all of our information to begin with.

Don't we have at least 3 major credit bureaus? Equifax should be shuttered immediately and with prejudice, the American credit system will be immediately better off and we can all live without this one. Shareholders be damned.

What'd the tweet say?

Never attribute to malice that which is adequately explained by stupidity.

They've completely demonstrated incompetence, no contempt needed.

Just a note, this most likely is not what happened. Identify verification questions typically will ask questions like "Who is your current house mortgage with?" when you have none and they will include a "None of the above" answer, which you're supposed to pick. It's totally intentional.

Or, hopefully, just sued into bankruptcy.

They should apply HIPAA rules to data that can be used for identity theft.

https://www.experian.com/ncaconline/freezepin

We are so screwed by these laggards!

Care to post a mini-example with fake data so we can better understand what you are describing?

Not sure exactly how long it took OpenDNS to fix that but the false positive is cleared up now. Funnily enough, I switched from ISP (Verizon) DNS to OpenDNS to avoid their NXDOMAIN shenanigans, only to end up with other protective shenanigans.

There just isn't! It's perfect. Many people who are professional security types said on Day 1 that this would happen, and sagely advised that it might be unwise for anyone to put part of their SSN into a two-day old website on a previously unknown domain that looked like Baby's first PHP, just as news of the breach was still breaking.

And that it was similarly unwise to ask them to do so! So can we just unplug Equifax already? Please? It should be clear who the guilty party is here, and it starts with an Equifax.

Also - don't be fooled - using the CMM as a metric, the Amish are probably one of the more technologically mature societies around, since they have a clearly defined process around technology usage...

https://en.wikipedia.org/wiki/Capability_Maturity_Model

" There are five levels defined along the continuum of the model and, according to the SEI: "Predictability, effectiveness, and control of an organization's software processes are believed to improve as the organization moves up these five levels. While not rigorous, the empirical evidence to date supports this belief".[15]

    Initial (chaotic, ad hoc, individual heroics) - the starting point for use of a new or undocumented repeat process.
    Repeatable - the process is at least documented sufficiently such that repeating the same steps may be attempted.
    Defined - the process is defined/confirmed as a standard business process
    Capable - the process is quantitatively managed in accordance with agreed-upon metrics.
    Efficient - process management includes deliberate process optimization/improvement.

The model provides a theoretical continuum along which process maturity can be developed incrementally from one level to the next. Skipping levels is not allowed/feasible. "

This talk is both interesting, more or less correct, and absolutely hilarious.

When they notified law enforcement well after the legal requirement to notify law enforcement had come and gone, that would have been a good time for the government to step in and say "hands off the wheel, we're handling this now." Would we be any better off today? I don't know, but my gut says no.

If I had to guess, the answer is that we don't just take companies and put them under state control here in the United States. It just does not happen that I am aware of. Can you name a time this happened?

I certainly can't think of a time when it would have made more sense to do this, but I am struggling to think of even one example of a company that was taken over by the state without searching.

It says here[1] the US government nationalized railroads and the Smith & Wesson company during WWI, and it also nationalized the railroad system and coal mines during WWII, and that Amtrak was the product of another time the government nationalized railroads in the 70's, but was re-privatized in the 80's...

[1]: https://www.cbsnews.com/news/a-history-of-corporate-national...

If the law enforcement agencies had taken some kind of stand, we might still have video interviews with CISO Susan Mauldin from 2016, that have now been erased since September 10, but for some reason there does not seem to be much interest in that. Everyone understands the company is "saving face" by removing those interviews. Nobody is saying it, but it's pretty clear.

There is probably no legal requirement to keep those interviews online, even if they might provide some insight into the mindset of the CISO and how she was influenced in the months leading up to the breach by the other executives and the board members of Equifax. The fact that this is not a bigger story probably owes mostly to the fact that this is already such a big story.

140MM Americans impacted, likely every last person in the country with a credit history's personal information exposed, quite possibly enough to shutter the credit system as we know it for good. What's a little cover-up compared to that?

After the OPM breach, I have zero confidence that the United States have any more competence at this than Equifax.

[0] https://en.wikipedia.org/wiki/Office_of_Personnel_Management...

Pretty much the only way to verify that's the right site is the fact that Equifax.com links to it, although this tweet indicates even that isn't necessarily a reason to trust it.

Why it's not a subdomain of Equifax.com is completely beyond me.

(Even better, the eligibility / credit monitoring signup takes you to another domain, https://trustedidpremier.com/)

/s

You know it's real because it's http.

They'll say no.

Nothing. Your request would be ignored because we don't have legislation like the GDPR in this country to protect the rights of individuals to the privacy of the information collected about them.

(transitive) To let loose, to free from restraints. (intransitive) Of a grip or hold, to let go.