Giant Equifax data breach: 143 million people could be affected

Equifax says a giant cybersecurity breach compromised the personal information of as many as 143 million Americans — almost half the country. Cyber criminals have accessed sensitive information -- including names, social security numbers, birth dates, addresses, and the numbers of some driver's licenses. Additionally, Equifax said that credit card numbers for about 209,000 U.S. customers were exposed, as was "personal identifying information" on roughly 182,000 U.S. customers involved in credit report disputes. Residents in the U.K. and Canada were also impacted. The breach occurred between mid-May and July, Equifax said. The company said it discovered the hack on July 29. The data breach is one of the worst ever, by its reach and by the kind of information exposed to the public. Read more http://archive.is/3bItX

With this having occured, I think that it could be used to coroborate data from previous breaches to verify the identieties of victims for nefarious reasons. On the other hand, it may just be to get money off the stolen data, like carding... form a security standpoint, I dont like ginving out data to anybody for exactly that reason, even if they are not activelt selling your information, there is no guarantee that your data is safe. People who gave really personal information to the US government for background checks and security clearances up to top secret (and even some more compartmentalized clearances for CIA/NSA) had all of their information stolen too when the OPM hack happened. Besides unironically living under a rock and using only cash what are some ways of strengthening your identity from being stolen? Do any lains think that this is just an increasingly more common occurrence of high stakes entities being compromised or is it just people specifically going after bigger fish (i.e. governments and financial institutions) instead of low stakes websites and fringe community organizations or marketing institutions?

>>2663 Thank for replying, already thought most people here don't want any new information to them. I personally heard many different conspiracy theories about who might be behind this and why. To talk about these ideas we have to mention that there were 3 executives in Equifax that sold their stocks of the firms before the information of hacking went out. Few probable theories emerge from this information: 1) A three letter agency of US had their hands into hacking to try and provoke an economic crisis and panic on banking system.THIS IS WHY, even though 3 execs sold their stock they got small amount of money relative to what they were getting before just by being employed, IS A DIVERSION. 3 execs are personification of economic distrust and anger towards capitalism, therefore making a possible focus and targets for possible revolution. Them getting so little amount of money from shooting themselves and their company in the foot IN FRONT OF 143 MILL ANGRY PEOPLE (which could have easily been saved by throwing responsability and outrage on demonized hackers that did it, like countless times did before) was therefore a possible coercion and psyops operation by the three letter agency. Equifax , by releasing this information right in peak of 3 hurricanes hitting US, might have saved their asses and US asses as well. 2) Foreign government three letter agency got involved in trying to steal US citizens personal information for political manipulation in future elections and/or economic crisis/economic terrorism. Obviously all information provided is more than enough to rig elections in future. Most of what and why happened could be meshed with above mentioned in 1) (with them being threatened and coerced into shotting themselves in the foot). 3) A honest screw up including few psychopaths wanting to profit from situation by screwing themselves even more. If this is really the case, which I don't trust is, we are bound to see the sales of the database/s stolen in near future (aprox 2 or 3 years tops) since the rogue hacker/s don't know what to do with information other than probable carding adventures (which if they do, they will most likely be apprehended). Better bet than selling databases whilly nilly to everyone is probably them selling databases to foreign government or trying to ransom bluff bait the Equifax/US government into giving them some money and only then selling database to the foreign government. This is more scary and chaotic plan since they will not only get caught but probably also killed since parties involved don't want anyone to talk about what happened. >Besides unironically living under a rock and using only cash what are some ways of strengthening your identity from being stolen? I would say "trusting certain people & certain companies" but today you really can't trust ANYONE with your information. Even your loved ones are likely to give out your secrets online to the whole world just for revenge, trusting a company is even worse in my honest opinion. I just hope in near future that we ascend to higher form of being all together and our social interactions become a "you can't fuarrrk me even if you tried" sort of like bitcoin. >Do any lains think that this is just an increasingly more common occurrence of high stakes entities being compromised or is it just people specifically going after bigger fish (i.e. governments and financial institutions) instead of low stakes websites and fringe community organizations or marketing institutions? I think it's a reply to current growth from centralization monopolies to decentralized mega giant international companies (working together as monopolies) taking form. It's making these companies take a step back and let other players get a honest share of the market, and making the whole market a little bit more reliable by doing so. I hope and I honestly believe that we will see more of these big companies getting hacked through out the few coming decades, even though they are likely to be either 1 shot rogue hacker groups or foreign political/economic adversaries trained especially for this purpose. I think we are slowly moving away from just "a lonely kid hacker slaving away at his computer through the night" and more to groups of grown adults with trained expertisee built on few years in their specialized fields working together for common goal ( <-- hard to achieve, and easily breakable hierachy and form, more easily controlable through government body like 3 letter agency, like we see with stuxnet)

btw this pic

>>2667 >MA music composition >MFA music composition PLEASE TELL ME THEY DIDN'T JUST HIRE HER BECAUSE OF HER SKILLS BLOWING (on instruments of course) but more realistically, that does seem rather suspicious, I would imagine an insider trading scheme dealing with a known exploit being abused , perhaps they were aware of the intrusion but chose to ignore (like the OPM hack) 3 letter might not be out of the question, but financial incentive seems to be hey here ransom also seems reasonable

>>2668 >neurosuggesting her BA/MFA matters When people get up that level of corporate ladder it's mostly like that show House of cards, internal politics and manipulations. But yea, them hiring her without her not knowing jack soykaf is obviously a bad thing. >financial incentive >1.8 million $ total on 3 execs You do realize these execs earn more than that over period of few months? Why the fuarrrk would they paint a bright red target on their backs with 143 million people angry at them, alongside shooting their whole company in the foot. They could have easily evade the whole situation by demonizing the enemy. That's just my point of view, I dunno.

>>2669 >Why the fuarrrk would they paint a bright red target on their backs with 143 million people angry at them, alongside shooting their whole company in the foot. They could have easily evade the whole situation by demonizing the enemy. "were sorry?" No way she was hired without connections, but i wonder if she had connections for 3 letter (i.e interned with them or something) but based on her job description, thats like hiring the lead cook at McDonalds to had corporate security... Tax incentives might be on the table, have locations for them been established? Once more information gets released on how the data was stolen, or if it was leaked, i think it might become more clear, VIP phishing and even smsishing are are on the rise

I hope to god it was/is not part of a false flag cyber op

>>2670 >smsishing holy soykaf, I remember all those youtube vlog or celebs that all got hacked (and their yt channels either scrubbed or "hacked by [x]" ) through their sms and with that their phones a while back. And most of them were from UK, right? I can't imagine the amount of intricate knowledge of social engineering (stealing the sms from the telecorp) and IC dissasembly (I assume they got the Ki through serial bus of the sms? I don't think sms cloning techniques work on modern sms cards ) What happened with those? Where are they now I wonder.

>>2672 >>smsishing my bad, this is just phishing through SMS. Although I wonder about those yt peeps that got hacked through their sms-s....

>>2671 >false flaggin your own company and potentially your own life

>>2674 lets put on our tinfoil hats for a moment >agent smith with the ABC is tasked with creating a false flag to blame the land of OZ >decided to have "the land of OZ" hack a major financial institution >agent smith and his team socially engineer or otherwise gain access to financial institution >leave "mistakes" traces that indicate "the land of OZ" wuz here >now there is a political reason for the country to launch a cyberstrike against OZ, >the CSO gets a slap on the wrist, and possibly money in the bank and a different job

>>2675 that might have worked out for those Sony Picture hack that happened not too long ago with framing of N.Korea, but this? They would come out to PR boost the story and demonize the supposed enemy, not try to hush down the story or even profit on it by selling stock shares.

>>2676 which indicates that insider dealings or genuine hack were probably the more likely cause

>>2672 >I can't imagine the amount of intricate knowledge of social engineering (stealing the sms from the telecorp) and IC dissasembly (I assume they got the Ki through serial bus of the sms? I don't think sms cloning techniques work on modern sms cards ) It's far easier than you think. You tell a cell tower "hey I'm SIM #12345678", cell tower says "okie dokie" and promptly sends you a copy of every SMS. Also rings both phones at once. Cell towers assume it's fine for a SIM to exist in multiple places at once for limited periods of time (ie while you're transitioning between towers). The hard part is getting the actual SIM ID, which you'd have to SE out of the victim or telco, or otherwise get malware onto the device.

>>2639 Part two is unfolding https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-login-and-password-of-a-non-us-database.html http://www.reuters.com/article/us-equifax-cyber-moves/equifax-two-top-technology-executives-leave-company-effective-immediately-idUSKCN1BQ2WN >Lawmakers, regulators and consumers have complained that Equifax’s response to the breach, which exposed sensitive data like Social Security numbers of up to 143 million people, had been slow, inadequate and confusing. >Equifax on Friday said that Susan Mauldin, chief security officer, and David Webb, chief information officer, were retiring. >The company named Mark Rohrwasser as interim chief information office and Russ Ayres as interim chief security officer, saying in its statement, “The personnel changes are effective immediately.” >Rohrwasser has led the company’s international IT operations, and Ayres was a vice president in the IT organization. >The company also confirmed that Mandiant, the threat intelligence arm of the cyber firm FireEye, has been brought on to help investigate the breach. It said Mandiant was brought in on Aug. 2 after Equifax’s security team initially observed “suspicious network traffic” on July 29. incredible how that much responsibility and the only repercussion for destroying lives is "retirement"

>>2740 The disclosure of the U.S. data breach prompted Holden to take a look at Equifax's web security outside the U.S., he said. After first exploring the Argentine website, which initially required a national identification number, the researchers arrived at a different login interface after shortening the site's URL. "We put in admin, admin [as credentials] and to our surprise we were in," he continued. "We obviously did not state that there was a breach. We highlighted a horrendous security practice which, perhaps, was indicative of the overall data care that led to the breach in the US. But in my professional opinion, if any hacker would look at this part of the website, it would be breached," Holden told CNBC. After making the initial discovery, Holden turned to security researcher Brian Krebs to assess his findings. "Worse still," Krebs said, "each employee's username appears to be nothing more than their last name, or a combination of their first initial and last name. In other words, if you knew an Equifax Argentina employee's last name, you also could work out their password for this credit dispute portal quite easily." https://krebsonsecurity.com/tag/ayuda/ >Once inside the portal, the researchers found they could view the names of more than 100 Equifax employees in Argentina, as well as their employee ID and email address. The “list of users” page also featured a clickable button that anyone authenticated with the “admin/admin” username and password could use to add, modify or delete user accounts on the system. A search on “Equifax Veraz” at Linkedin indicates the unit currently has approximately 111 employees in Argentina.

>>2741 >"We put in admin, admin [as credentials] and to our surprise we were in," he continued. I fuarrrking hate sysadmins. Do your god damn jobs.

>>2928 >What are the 4 most used passwords? >Love, Sex, Secret and God