|
HUGE data breach at Equifax
https://www.bloomberg.com/news/artic...lion-customers
"Equifax Inc. said its systems were struck by a cybersecurity incident that may have affected about 143 million U.S. consumers, shedding light on what could be ranked as one of the largest breaches in history. Intruders accessed names, Social Security numbers, birth dates, addresses and driver’s license numbers, Equifax said in a statement. Credit card numbers for about 209,000 consumers were also accessed, the company said. Equifax shares dropped more than five percent in after-hours trading." You can check to see if you were impacted at: https://www.equifax.com/personal/ or https://www.equifaxsecurity2017.com Equifax is also offering complimentary ID monitoring for one year that can be accessed at their websites (linked above). |
It says: You can check to see if you were impacted at...
Tried that, but they do not tell you if you were or were not impacted. They just give you some number code to use for "registering next week". |
Key point from The Guardian:
"Equifax discovered the hack 29 July, but waited until Thursday to warn consumers." |
Originally Posted by muji
(Post 28790229)
It says: You can check to see if you were impacted at...
Tried that, but they do not tell you if you were or were not impacted. They just give you some number code to use for "registering next week". 1. Here's your date to register. 2. Our records indicate you have been impacted. 3. Our records indicate you have not been impacted. At least you didn't get #3 . |
Originally Posted by Diplomatico
(Post 28790312)
Apparently you can receive one of three messages when you check:
1. Here's your date to register. 2. Our records indicate you have been impacted. 3. Our records indicate you have not been impacted. I got message 1, which I guess means they don't know whether or not I've been impacted. |
I just got the message, "Based on the information provided, we believe that your personal information was not impacted by this incident." So apparently they are doing some sifting out when you first try to enrol.
|
Originally Posted by muji
(Post 28790339)
Thanks, Diplomatico.
I got message 1, which I guess means they don't know whether or not I've been impacted. |
Originally Posted by tmiw
(Post 28790470)
I got message 1 too. Can't say that gives me any confidence.
|
Originally Posted by EmailKid
(Post 28790643)
Sadly, that would be my first thought as well :(
|
Project Mayhem for those "Fight Club" fans.
|
In my memory, I have not heard of such a massive hack which involves 4 sensitive pieces of information - name, DOB, SSN and Address. That is basically all you need in order to identify a person in the USA!!
This will end up being much bigger than the Target incident which involved a POS hack. |
Damn... I got the may have been impacted by this incident message.
|
Originally Posted by 889
(Post 28790280)
Key point from The Guardian:
"Equifax discovered the hack 29 July, but waited until Thursday to warn consumers." |
Originally Posted by mauve
(Post 28791219)
Perhaps related, according to Bloomberg, three Equifax execs sold almost $2 million in stock between the discovery and announcement.
|
Originally Posted by mikesyr18
(Post 28791312)
That's completely illegal, and I'm sure the SEC will investigate if that's true... Those people will see jail time.
If the SEC chairman is a former industry guy, he probably won't come down too hard. My understanding is that this is not the first time Equifax has been breached. I don't know what kind of laws there are about data protection but if these companies are collecting data but are unable or unwilling to spend the money to protect it, there should be sanctions against such companies. |
I got #2 . Lovely.
|
Issuing credit used to be based on the idea that the SSN was a secret that only the person identified by that number knew. That doesn't seem to be the case any more, with all the data breaches that have been occurring. At this point an SSN is barley any more 'secret' than your name. It's really frustrating that our legislators haven't done anything to encourage organizations to guard against these breaches (either via carrot or stick) and to tighten up security procedures around issuing credit.
After I wrote that I decided to check before I posted - I'm a #2 . |
So apparently, even checking if you were impacted waives any right to join a class action against Equifax. I've seen this all over the internet and Reddit, but I just don't see how checking one's status is "registering for the product", since I haven't signed up for the monitoring service. Anyone else think that even checking if you were affected constitutes using their TrustedId service?
|
Originally Posted by travlngeng
(Post 28792324)
So apparently, even checking if you were impacted waives any right to join a class action against Equifax. I've seen this all over the internet and Reddit, but I just don't see how checking one's status is "registering for the product", since I haven't signed up for the monitoring service. Anyone else think that even checking if you were affected constitutes using their TrustedId service?
http://www.equifax.com/terms/
Originally Posted by Equifax Terms and Conditions Section 4
AGREEMENT TO RESOLVE ALL DISPUTES BY BINDING INDIVIDUAL ARBITRATION. PLEASE READ THIS ENTIRE SECTION CAREFULLY BECAUSE IT AFFECTS YOUR LEGAL RIGHTS BY REQUIRING ARBITRATION OF DISPUTES (EXCEPT AS SET FORTH BELOW) AND A WAIVER OF THE ABILITY TO BRING OR PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR OTHER REPRESENTATIVE ACTION. ARBITRATION PROVIDES A QUICK AND COST EFFECTIVE MECHANISM FOR RESOLVING DISPUTES, BUT YOU SHOULD BE AWARE THAT IT ALSO LIMITS YOUR RIGHTS TO DISCOVERY AND APPEAL.
Binding Arbitration. Any Claim (as defined below) raised by either You or Equifax against the other shall be subject to mandatory, binding arbitration. As used in this arbitration provision, the term "Claim" or "Claims" means any claim, dispute, or controversy between You and Us relating in any way to Your relationship with Equifax, including but not limited to any Claim arising from or relating to this Agreement, the Products or this Site, or any information You receive from Us, whether based on contract, statute, common law, regulation, ordinance, tort, or any other legal or equitable theory, regardless of what remedy is sought. This arbitration obligation extends to claims You may assert against Equifax’s parents, subsidiaries, affiliates, successors, assigns, employees, and agents. The term "Claim" shall have the broadest possible construction, except that it does not include any claim, dispute or controversy in which You contend that EIS violated the FCRA. Any claim, dispute, or controversy in which You contend that EIS violated the FCRA is not subject to this provision and shall not be resolved by arbitration. No Class or Representative Arbitrations. The arbitration will be conducted as an individual arbitration. Neither You nor We consent or agree to any arbitration on a class or representative basis, and the arbitrator shall have no authority to proceed with arbitration on a class or representative basis. No arbitration will be consolidated with any other arbitration proceeding without the consent of all parties. This arbitration provision applies to and includes any Claims made and remedies sought as part of any class action, private attorney general action, or other representative action. By consenting to submit Your Claims to arbitration, You will be forfeiting Your right to bring or participate in any class action (whether as a named plaintiff or a class member) or to share in any class action awards, including class claims where a class has not yet been certified, even if the facts and circumstances upon which the Claims are based already occurred or existed. Right to Opt-Out of this Arbitration Provision. IF YOU DO NOT WISH TO BE BOUND BY THE ARBITRATION PROVISION, YOU HAVE THE RIGHT TO EXCLUDE YOURSELF. Opting out of the arbitration provision will have no adverse effect on your relationship with Equifax or the delivery of Products to You by Equifax. In order to exclude Yourself from the arbitration provision, You must notify Equifax in writing within 30 days of the date that You first accept this Agreement on the Site (for Products purchased from Equifax on the Site). If You purchased Your Product other than on the Site, and thus this Agreement was mailed, emailed or otherwise delivered to You, then You must notify Equifax in writing within 30 days of the date that You receive this Agreement. To be effective, timely written notice of opt out must be delivered to Equifax Consumer Services LLC, Attn.: Arbitration Opt-Out, P.O. Box 105496, Atlanta, GA 30348, and must include Your name, address, and Equifax User ID, as well as a clear statement that You do not wish to resolve disputes with Equifax through arbitration. If You have previously notified Equifax that You wish to opt-out of arbitration, You are not required to do so again. Any opt-out request postmarked after the opt-out deadline or that fails to satisfy the other requirements above will not be valid, and You must pursue your Claim in arbitration or small claims court. Initiation of Arbitration. Arbitration shall be administered by the American Arbitration Association ("AAA") under its Consumer Arbitration Rules in effect at the time the arbitration is filed unless any portion of those rules is inconsistent with any specific terms of this arbitration provision or this Agreement, in which case the terms of this arbitration provision and this Agreement will govern. The AAA’s rules may be obtained at www.adr.org, or by calling the AAA at 1-88-778-7879. To commence an arbitration, you must file a copy of your written arbitration demand with the AAA (either online at www.adr.org or by mail addressed to AAA, Case Filing Services, 1101 Laurel Oak Road, Suite 100, Voorhees, NJ 08043). The arbitration shall be before a single arbitrator. The arbitrator will have the power to award a party any relief or remedy that the party could have received in court in accordance with the law or laws that apply to the dispute, subject to any limitations of liability or damages that exist under this Agreement. This agreement to arbitrate involves interstate commerce and is made pursuant to the Federal Arbitration Act, 9 U.S.C. sections 1-16 (the "FAA"). Any claim or dispute as to the enforceability of this arbitration provision's restrictions on your right to participate in or pursue a class action or class wide arbitration shall be decided by a court and not an arbitrator. Payment of Arbitration Fees and Costs. In the event You file a Claim in arbitration in accordance with these provisions, We will advance all arbitration filing fees if You ask that We do so, in writing, prior to the commencement of the arbitration. The payment of any such fees will be made directly by Us to the AAA. Such requests should be mailed to Equifax Consumer Services LLC, Attn: Request for Payment of Arbitration Filing Fees, P.O. Box 105496, Atlanta, GA 30348. We will also pay all arbitrator fees. If Equifax prevails in the arbitration, then the arbitrator shall have the authority to require that You reimburse Equifax for the filing fees advanced, but only to the extent such fees would be recoverable by Us in a judicial action. You are responsible for all other fees and costs You incur in the arbitration, including attorney's fees and expert witness fees, except that the arbitrator shall have the authority to award attorney's fees and costs to the prevailing party; (i) based on applicable law; (ii) under the rules of the arbitration administrator; or (iii) if the arbitrator rules in Your favor and the arbitrator expressly determines that there is a good reason for requiring Us to pay those fees and costs. Continuation. This arbitration provision shall survive: (i) termination or changes in this Agreement or the relationship between You and Us, including but not limited to the purchase of a new or additional Product by You; and (ii) termination or changes in Our providing any Product(s) to You. Small claims court. Notwithstanding anything in this Section, either You or Equifax may bring an individual action in small claims court as long as (i) the claim is not aggregated with the claim of any other person, and (ii) the small claims court is located in the same county and state as Your address that You most recently provided to Equifax according to Equifax’s records in connection with this Agreement. |
Originally Posted by smc333
(Post 28792157)
Issuing credit used to be based on the idea that the SSN was a secret that only the person identified by that number knew. That doesn't seem to be the case any more, with all the data breaches that have been occurring. At this point an SSN is barley any more 'secret' than your name. It's really frustrating that our legislators haven't done anything to encourage organizations to guard against these breaches (either via carrot or stick) and to tighten up security procedures around issuing credit.
Originally Posted by travlngeng
(Post 28792324)
So apparently, even checking if you were impacted waives any right to join a class action against Equifax. I've seen this all over the internet and Reddit, but I just don't see how checking one's status is "registering for the product", since I haven't signed up for the monitoring service. Anyone else think that even checking if you were affected constitutes using their TrustedId service?
EDIT: never mind, I missed that page lhrhappy posted above. |
The Opt Out clause does not exist for TrustID's Terms of Use, which is where the checker is.
https://trustedidpremier.com/static/terms ARBITRATION. PLEASE READ THIS ENTIRE SECTION CAREFULLY BECAUSE IT AFFECTS YOUR LEGAL RIGHTS BY REQUIRING ARBITRATION OF DISPUTES (EXCEPT AS SET FORTH BELOW) AND A WAIVER OF THE ABILITY TO BRING OR PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR OTHER REPRESENTATIVE ACTION. ARBITRATION PROVIDES A QUICK AND COST EFFECTIVE MECHANISM FOR RESOLVING DISPUTES, BUT YOU SHOULD BE AWARE THAT IT ALSO LIMITS YOUR RIGHTS TO DISCOVERY AND APPEAL. Except as otherwise expressly provided in this Agreement, all claims, disputes, or controversies raised by either You or TrustedID, Inc. arising from or relating to the subject matter of this Agreement or the Products (“Claim” or “Claims”) shall be finally settled by arbitration in the county (or parish) where you live or where You and TrustedID, Inc. otherwise agree using the English language in accordance with the Arbitration Rules and Procedures of JAMS then in effect, by one commercial arbitrator with substantial experience in resolving complex commercial contract disputes, who may or may not be selected from the appropriate list of JAMS arbitrators. This arbitration will be conducted as an individual arbitration. Neither You nor We consent or agree to any arbitration on a class or representative basis, and the arbitrator shall have no authority to proceed with arbitration on a class or representative basis. No arbitration will be consolidated with any other arbitration proceeding without the consent of all parties. This class action waiver provision applies to and includes any Claims made and remedies sought as part of any class action, private attorney general action, or other representative action. By consenting to submit Your Claims to arbitration, You will be forfeiting Your right to bring or participate in any class action (whether as a named plaintiff or a class member) or to share in any class action awards, including class claims where a class has not yet been certified, even if the facts and circumstances upon which the Claims are based already occurred or existed. If the parties cannot agree upon the identity of the arbitrator within fifteen (15) days following the date, then a single arbitrator shall be selected on an expedited basis in accordance with the Arbitration Rules and Procedures of JAMS. Any arbitrator so selected shall have substantial experience in complex commercial contract disputes. Judgment upon the award so rendered may be entered in a court having jurisdiction or application may be made to such court for judicial acceptance of any award and an order of enforcement, as the case may be. Notwithstanding the foregoing, each party shall have the right to institute injunctive or other forms of equitable relief at any time in any court of competent jurisdiction. This agreement to arbitrate involves interstate commerce and is made pursuant to the Federal Arbitration Act, 9 U.S.C. sections 1-16 (the "FAA"). Any claim or dispute as to the enforceability of this arbitration provision's restrictions on your right to participate in or pursue a class action or class wide arbitration shall be decided by a court and not an arbitrator. Notwithstanding anything in this Section, either You or TrustedID, Inc. may bring an individual action in small claims court as long as (i) the claim is not aggregated with the claim of any other person, and (ii) the small claims court is located in the same county (or parish) and state as Your address that You most recently provided to TrustedID, Inc. according to TrustedID, Inc.’s records in connection with this Agreement. |
So, I agree with you and someone on Reddit said as much. Basically since there's no checkbox to say "I Agree", it likely doesn't hold up in court. But that doesn't change the fact that if their Terms of Use is such that just checking to see if you were compromised constitutes agreeing to their terms even without physical acknowledgement of them, then they are forcing the affected public to waive their rights to sue collectively.
Which is shady as all get out. |
Originally Posted by travlngeng
(Post 28792455)
The Opt Out clause does not exist for TrustID's Terms of Use, which is where the checker is.
https://trustedidpremier.com/static/terms You're opting out of Equifax's arbitration. They are the company who wronged you. |
Originally Posted by lhrhappy
(Post 28792472)
Turnabout is fair play: TrustedID, Inc. is not the company who wronged you. Who cares if you can't opt out of their arbitration?
You're opting out of Equifax's arbitration. They are the company who wronged you. |
Actually, if one has ever taken advantage of the free annual credit report from them (or otherwise purchased anything), wouldn't they possibly be unable to opt-out of arbitration by now? Then again, I don't know how long that language has been in their T&C.
|
Originally Posted by tmiw
(Post 28792518)
Actually, if one has ever taken advantage of the free annual credit report from them (or otherwise purchased anything), wouldn't they possibly be unable to opt-out of arbitration by now? Then again, I don't know how long that language has been in their T&C.
|
https://arstechnica.com/information-...nal-info-ever/
What's more, the website www.equifaxsecurity2017.com, which Equifax created to notify people of the breach, is highly problematic for a variety of reasons. It runs on a stock installation WordPress, a content management system that doesn't provide the enterprise-grade security required for a site that asks people to provide their last name and all but three digits of their Social Security number. The TLS certificate doesn't perform proper revocation checks. Worse still, the domain name isn't registered to Equifax, and its format looks like precisely the kind of thing a criminal operation might use to steal people's details. It's no surprise that Cisco-owned Open DNS was blocking access to the site and warning it was a suspected phishing threat. Meanwhile, in the hours immediately following the breach disclosure, the main Equifax website was displaying debug codes, which for security reasons, is something that should never happen on any production server, especially one that is a server or two away from so much sensitive data. A mistake this serious does little to instill confidence company engineers have hardened the site against future devastating attacks. |
amateurs. Who gave them the right to compile our personal data anyways?
I never gave my social security numbers to any of the bureaus yet they have them. |
I got # 2 also, is everybody signing up ? I imagine this will make getting IA ( or maybe approval at all a lot more difficult.
|
From the breach website FAQ page at https://www.equifaxsecurity2017.com/...ked-questions/
Originally Posted by Losers
The arbitration clause and class action wavier included in the TrustedID Premier Terms of Use applies to the free credit file monitoring and identity theft protection products, and not the cybersecurity incident.
I would also guess that they're working feverishly to recall their lawyers from the links so that they can remove the opt-out provision from the Equifax.com T&C. |
Originally Posted by justforfun
(Post 28791554)
I got #2 . Lovely.
|
Class action suit filed in Portland.
They're pulling in a celebrity LA firm with talk of $70 billion national damages. Good, this should kill Equifax and ge the other bureaus to beef up security. |
With almost half of the US population affected, the class action suit would settle for $50 per person. Anymore than that and Equifax goes bankrupt.
I hope Equifax is barred from the credit bureau business for atleast 2 years, but the credit monitoring program seems to be the better deal here. Ofcourse the smart move is to freeze all your credit reports. |
My date to signup is Sept 12, since the data was stolen weeks ago I would think the hackers have already been using it.
|
Originally Posted by SanDiego1K
(Post 28793157)
As did my husband. Just lovely.
Quoting Brian Krebs here: "I have long urged consumers to assume that all of the personal information jeopardized in this breach is already compromised and for sale many times over in the cybercrime underground (because it demonstrably is for a significant portion of Americans)." Krebs offers specific advice and lots of general background info on how to protect your interests. And it makes for fascinating reading too. https://krebsonsecurity.com |
Originally Posted by tmiw
(Post 28792450)
Really, trusting that kind of data to a set of private companies is a bit suspect to me. Maybe it's time for some sort of national ID system (despite a lot of Americans' very likely objections to such a concept).
Anything that requires a social security number now would be replaced with this new ID credentials. Maybe the way to get around it is to make it opt-in and not require the national ID number for anything essential. For instance, you'd be able to register to vote, get a passport or apply using this new national ID but it wouldn't be the only way to identify yourself. It would be an additional way. The only stick they might apply might be that if you get hacked and your social security number is used to rob you, you would have liability as long as you had the option to use this national ID instead. Of course the govt. would have to build up a system to issue and then authenticate this national ID, each time you used it to get credit of some kind, apply for a job, apply for a driver's license, etc. |
Not really
Originally Posted by 889
(Post 28790427)
I just got the message, "Based on the information provided, we believe that your personal information was not impacted by this incident." So apparently they are doing some sifting out when you first try to enrol.
|
Well, all to the good. Maybe I'm not in Equifax's fiendish files at all.
|
I logged in to freeze our credit. Not sure I opted into or out of anything but I did have to agree to terms.
|
Originally Posted by umonk2014
(Post 28793886)
Try putting any junk name and any random number ... it will say the same thing !
|
| All times are GMT -6. The time now is 11:21 am. |
This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.