I can understand (but not necessarily agree) with arguments for full disclosure when the consumer has a choice to avoid using the vendor .. but, in this case?
Additionally, Krebs has stated that Experian has yet another glaring security issue. He's not saying exactly how to do it, or dropping POC in the post.
Given the size and importance of Experian, there's nothing wrong with pointing out this issue, especially when after 4 days they can't even acknowledge an issue this serious.
Krebs stating a vulnerability exists, is more responsible than not disclosing it -- given their importance, and history of security screw-ups, the people have a right to know.
A malicious actor wouldn’t wait until business hours.
The older ongoing problem is that any person can create a new Experian account with a new email address, and answer a few credit-related quiz to take over somebody's credit file. When doing this Experian will helpfully even offer to unlock the credit file and you can reset security questions etc. All without the consent of the victim. All the "security" systems are bypassed.
This new vulnerability means you need even less information to take over somebody's credit/identity. You can get the answers to their quiz directly from Experian's own systems. That makes it a bigger deal.
Experian had 72.