Hacker News Reader

Comment by danjoc | Hacker News Reader

"The company announced Monday that the total number of people impacted by its breach is not 143 million—the amount it first disclosed—but in fact 145.5 million. Its ability to casually misplace 2.5 million lives upended by the breach is alarming"

I can't really take the author too seriously after reading that.

View on HN

Yeah that's overly dramatic. What is probably "we used row count from the old monthly backup instead of current row count of the database" turns into "OMG millions of lives!" And, of course, these lives are not "upended" in any way - some of them potentially might be if they suffer from identity theft, but surely not by a minuscule counting mistake. Bad journalism.

Why not?

It's purposefully alarmist. "[Equifax] casually misplace[d] 2.5 million lives" sounds much more dramatic than "Equifax revised their estimate of the number of affected customers by +1.7%."

Or maybe the latter is purposefully anodyne? 2.5 million people is rightfully alarming. 1.7% minimizes the sheer amount of people affected that weren't revealed earlier.

I want to be a fly on that wall.

"Ah, s--- we got hacked."

"How many users?"

"145,534,902"

"Ouch, that's a lot. Let's say it was 143,000,000."

"He he he, nice."

---

I've misplaced more bytes in a megabyte.

You've misplaced 2.5 million bytes in a megabyte?

I've misplaced > 1.7%.

E.g. I say one million but it turns out to be 1.05 million.

It's kind of a ridiculous statement. A counting error is nowhere near is shocking as the initial breach, especially considering it happened after the breach.

It is bad because not only they let someone in but they don't know what he did despite having recorded everything (or so they said). It means that maybe more is to come.

Forensics is hard for even companies that are well versed and adept with tech. Evidence suggests that Equifax is not among that group of companies.

The number being revised doesn't surprise me. I'd have been surprised if it hadn't been revised. I'd expect additional revision, as the investigation continues and the breach more fully understood.

For the record, that doesn't show I support them, nor am I making excuses for them. It's just the opposite. I believe them to be very, very inept - to the point of being incompetent, illsuited, and inexcusable. I expect additional revision, not because that is justified but because they simply suck that bad.

I can't think of a breach handled quite this poorly, and that includes my biases from the OPM breach. I'd say the OPM breach was far worse but handled marginally better. Equifax had to work hard to take the crown, but they have managed to edge them out by a narrow margin.

To me if they make mistake like that is that they most likely try to estimate and don't really know who was affected. If they knew they could simply just exact number of affected people.

This explain why their site seem to return randomly who was affected.

Reply on news.ycombinator.com