The Equifax hack news of the day seems unbelievable. After all the beating that the company and its ex-CEO has taken, you’d expect that it would have its act together by now. Right? Not so fast… On closer inspection, today’s news is predictable-–once you understand that problems will continue for Equifax as long as it has the same corporate mindset that led to the mammoth breaches of May-July 2017.
A closer look at the latest hack…
The problem starts from the fact that Equifax apparently uses a 3rd party, FireClick, as its provider for hosted application service. The purpose of using FireClick is to collect and store Web analytics re usage and data for its clients, like Equifax.
BTW: If you try to visit FireClick’s site right now, don’t bother. It’s apparently a defunct company still listed as a wholly owned subsidiary of Digital River:
The issue stems from how Digital River/FireClick integrated its ad network, including bad adware (i.e., Adware.Eorezo) in tracking, collecting and reporting Equifax’s site activity. To boil this down to the most basic terms:
- The unsuspecting consumers visit Equifax’s site
- When wanting to get details on Equifax’s Credit Report Assistance,
- The visitors are prompted to complete a form on a separate page—NOT on the original Equifax website. This is where the third party ad network comes into play. This is why Equifax is crying, “Not our system!”
- Of course, most unsuspecting visitors will proceed to fill this out and then get a prompt to download Adobe Flash Player.
- Once downloading this malware, voila! The website visitor’s machine is the happy new home of the newly acquired malicious program(s) (e.g., spyware, ransomware, etc.)
As with the Equifax breaches, one can always point to a third party (Apache struts for the May – July 2017 breaches). But the brutal fact is that the buck needs to stop with Equifax. For those naysayers who want to say that class actions don’t help, I will direct them to the Anthem Data Breach settlement terms, which requires Anthem to spend tens of millions of dollars and subject itself to security audits for years. As a class action attorney, you can bet that one of my major goals is to have Equifax (and hopefully all credit reporting agencies) subjected to external, rigorous security standards. And, as with my other data breach cases, I will fight for my clients tooth and nail (they’ll speak to you, if you are still incredulous).
A key takeaway for consumers for now (& especially for my many Equifax clients) – you are wise to steer clear of websites that Equifax and its competitors direct you to for now.
P.S. Check out Digital River’s site below. Yep – they claim that they are the “Industry Leading (sic) Fraud Prevention.” #Irony
A Seattle law firm is announcing a class action lawsuit against Equifax after a data breach exposed information of 143 million customers.
Posted by KING 5 on Tuesday, September 12, 2017
The Equifax data breach has sent shock waves like we’ve never seen before. Some consumers are only now starting to realize the lasting damage and harm that this breach will have on their lives. Thank you for all of your calls and emails. Please continue to send concerned family, friends, co-workers to us at Equifax@Stritmatter.com. Yes – we have heard from folks from New York, Florida, Virginia, Arizona, California, etc.– a former employee of Equifax, data privacy experts, and reporters who are trying to separate fact from fiction.
I promise to write more soon, as I continue to try to respond personally to as many emails/calls as I can. But please let me address one pesky fiction that occasionally rears its head on corporate-leaning media outlets and individual’s social media posts: A class action against Equifax will address a deep-rooted systemic problem that puts all of us at risk. I cannot speak for all lawyers. But please think twice before rushing to judgement against those of us who are committed to advancing consumer rights. I will point to our work in the massive Anthem data breach litigation: Significantly, as a result of the Anthem settlement, a team of us have helped all affected from the breach by holding Anthem accountable. The agreement includes a court enforced term that will hold Anthem to a more rigorous standard in its safeguarding of Personally Identifiable Information (PII). Anthem will have to spend at least $90 million annually on beefing up its cybersecurity practices for the coming years. At minimum, my clients will get awarded between $5K -$15K each. Then, there are dozens of attorneys like myself who have invested countless hours and dollars (yes – pursuing class actions costs money) and we will not want to retire anytime soon because we love fighting for consumers. BTW: note that federal law has a strict limit on attorneys’ fees.
Thanks to all of you who have contacted us with your stories, questions and concerns. As with our many other clients, we want to help give you a voice and make sure that you recover from this historic data breach.
Top Democrat Senator Sherrod Brown (D-OH) on the Senate Banking Committee demands that credit agency Experian provide more details about a data breach in which personal information on millions of T-Mobile customers was stolen.
“Protection of this information is of the utmost importance, especially because the scope of the information is vast and virtually no consumer can apply for credit without entering your system,” Brown wrote in a letter sent to Experian today.
Experian said earlier this month hackers had broken into a server containing data on T-Mobile customers. The breach exposed personal information of 15 million customers and possible customers, including Social Security numbers of those who might have applied for T-Mobile cell service between Sept. 1, 2013 and Sept. 16, 2015.
Experian’s main consumer credit database was not broken into, Experian says, and T-Mobile and Experian are providing two years of credit monitoring services and identity theft recovery services for free.
Along with increased disclosure about the breach, Brown also asks Experian to provide “credit freezes” to affected customers for free. Credit freezes allow customers to restrict access to their credit reports in cases of potential identity theft, but typically credit agencies charge for this service. Brown also asked Experian to explain how well its credit monitoring and identity theft protection services work.
Data breaches, identity theft and cyber security have become a priority as more companies have disclosed breaches of their systems. Lawmakers have attempted to legislation to address the issue, including a bill that would require companies to inform their customers about a breach within 30 days of learning about it themselves.
Experian, in a statement, said they had received Brown’s letter, “understand the concerns raised” and will respond accordingly.