At this point, their lack of basic security practices has endangered national security by weakening the banking and credit systems.

On top of that, this company is massively unpopular. Their only purpose is to potentially slander Americans en masse. Make a fucking example out of them so the rest of the finance industry takes notice.

Not on a whim, but for (e.g., in Delaware) “abuse, misuse or nonuse of its corporate powers, privileges or franchises.” (Delaware Code Title 8, § 284.)

> We have due process and the rule of law.

While rarely used in practice currently (it was more used in the past, and there is a movement to revive the practice), the law provides for charter revocation for corporate misconduct.

Basically, however appalling the unaccountable power of credit bureaus is, it was legal yesterday and it's not the job of either the executive branch or the judicial to decide today that such power isn't legal today. The judicial system especially is oriented towards prevent that kind of thing. Rather, deciding that is the job of (even more dysfunctional) legislative branch.

This, of course, doesn't guarantee that executive or judicial branch couldn't "get religion" and try to get end this situation but it would have it own messiness.

And there you have it - an American legal/government system very much resembling a well built car driven far too long without an overhaul.

But the problem is:

A. If Equifax gets a judgment for close to or for more than the company is worth, the simplest way one could assure the suit is paid to sell the company, keeping the operation going rather than ending it.

B. Many businesses integrate credit checks into their operations - it's ridiculous and despicable as mentioned by other but most of these companies and individuals (landlord for example) at least imagine they couldn't survive without the credit agencies so this large group would push for another solution then just getting rid of the credit agencies.

C. Getting rid of one credit agencies leaves the other two even stronger.

It is also unlikely a $17 billion market cap = $17 billion in assets during an emergency sale. Especially with the shadow of a $17 billion judgement that could encumber the acquired assets.

It's bad business to acquire assets from someone with a judgement against them, unless you're getting a great deal.

If there is a judgment against a company which that company cannot pay, that company enters bankruptcy.

What happens when a corporation enter bankruptcy is the assets of the corporation are assigned to a receiver. The receiver then disposes of those assets with the aim of raising as much money as possible to pay the creditors involved. In the case of a credit bureau, keeping the bureau functioning would arguably be the best way to earn money to pay the individuals who the corporation owes money to - both the people who the got the judgment (first priority), other creditors(second priority) and then the share-holder (third priority).

This situation means that corporation that produces toxic waste, dumps it in a river and goes bankrupt from a private suit against it could continue to produce toxic in order keep producing and making money, in order to pay that judgment (it would probably be argued that the toxic-waste leak was a one-time thing).

Part of the problem is a private lawsuit isn't a substitute for state regulation even if it's often presented as such. Part of the problem is the very worst that happen to the owners, the shareholder, is their shares become worthless so their incentive for stopping truly bad behavior by organizations is limited.

You might say this is fucked-up and I would agree with you. Don't confuse my comments with statements of support for how things. I simply want to thorough, accurate and complete summary of just what a messy we're in.

In Project Mayhem we have no names.

Europe operates just fine without the notion of credit or credit agencies.

Some of the legislative branch dysfunction is due to interference from the same corporate interests they should govern.

Corporations are able to DoS their oversight.

You are correct there will be unexpected messiness. The question becomes whether our current trend is sustainable over the long term; many believe the second order effects cannot be worse than the path we are currently on.

But with the current administration as well as Congress (we're likely to see a Federal gov't shutdown over the budget even though the Republicans control the legislature and White House), I wouldn't anticipate seeing any regulation down the pike because of this.

They mention the Struts vuln, but not which one... did an attacker access the info directly via a naive attack, or was this a campaign? Having worked on Enterprise-Ready(tm) systems I wouldn't be surprised if Equifax had an unsegmented network...

Not yet. People might be annoyed but not many of them have been harmed yet. They're harmed when their identity is actually stolen (i.e. used by someone else), not merely when someone gets access to their data.

(Not saying I like this system. Just saying this it how the system works.)

So this would only work if you can find a clause permitting them to do this. I assume this would be the commerce clause?

In reality 1. You can be shot by a cop even if you do not pose a real threat (they just need to claim they though you might have a gun, simple) 2. People are routinely kept in jail for unreasonably long time because their families cannot afford bail often on things charges are dropped for later 3. Ever hear of civil forfeiture?

The whole thing is a nice story that we love to repeat to each other. Maybe it was easier to accept that during the cold war when the other guys were worse and news traveled slowly (or didn't). It's pretty apparently that isn't true given the quick news cycle... and opening any US history book.

Sometimes I wish I could myself become a corporation. Seams it's much easier to exercise your rights as a corporation.

Yes, a process in which the government has to prove to the same standard of evidence as someone suing you. That is due process.

In practice this is a huge difference.

That's not quite true. They don't make a claim against _you_. They make a claim against the property.

So, it's the same level of evidence and adversarial hearings as someone suing $1,000. This is not due process. It's a farce.

And federal civil asset forfeiture almost always starts out as administrative forfeiture which doesn't involve the judiciary at all.

When the feds seize an asset the owner has 60 days to file a claim. If no claim is filed the government keeps the asset.

If a claim is filed, the government can either pursue civil or criminal forfeiture. In the case of civil forfeiture there is a right to a trial by jury.

However, as I said previously this isn't automatic. The person has to either have the legal knowledge to know how to file a claim, or they need a lawyer. In the majority of cases no claim is filed in many cases because the legal fees necessary to recover the asset will be greater than the value of the asset.

Basically if the government sizes a few grand in cash, it will cost you too much to recover it to make it worth it.

In states like Tennessee, police can seize your cash and you have to sue to get it back. They automatically get to keep the assets unless you sue them. They don't need to convince a jury of anything unless you sue them.

This is not the same thing as a person suing you and then using a replevin action to force you to give up your property. This is like if a person broke into your house, took your TV, and then you were forced to initiate a lawsuit to get it back. Plus you couldn't recover legal fees, it was significantly more complicated and costly than small claims court, and the thief suffered no consequences beyond returning the TV even if they lost the case.

Even Clarence Thomas, the most conservative member of the the Supreme Court, indicated in recent statement that he believes the current way civil asset forfeiture is practiced is unconstitutional.

I'm as emotionally upset as anyone else, but if in fact this was a zero-day, I also lose the basic lack of security practices argument.

https://qz.com/1073221/the-hackers-who-broke-into-equifax-ex...

If you have the most sensitive information for millions of people, maybe don't only worry about perimeter defense?

Given the number of FS sites running on IBM Websphere and Struts, this may only be the tip of iceberg.

This is what pisses me off - I never gave them authorization to collect information on me. I have no business relationship with these companies. To me they look a lot like parasites even when they're not giving away my data.

yes, I realize that the definition of "coercion" here is complicated and nuanced, but I feel the point stands.

It basically just forces an auth flow for a credit application, which is quite sane. You can also do the whole process - enrollment and manual authorization - online. It was quite painless for me to do it a couple of years back.

Yes, and I think it's a bigger question of why we have so little control over or access to our own data in the first place? It's a racket that they monetize our data by selling it to others, then charge us again to access and protect it. And, if you've ever had to go through the pain of having something corrected in a timely fashion, then you know it's doubly-maddening. They are purposely opaque and byzantine.

Yet, without our data, they'd have no business.

Yet, without credit rating agencies, you'd get no loans.

Loans existed for millenia before credit rating agencies, so that seems unlikely. It's more likely that the people getting the best loans terms today would pay a higher cost for borrowing without credit rating agencies, and that credit references would be more important, though.

https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq...

    Equifax — 1-800-349-9960
    Experian — 1‑888‑397‑3742
    TransUnion — 1-888-909-8872

It's mildly interesting how different the experience was across the three. Experian gave me the choice between choosing a PIN and getting a generated one, Equifax just gave me a PIN, and for TransUnion I had to choose the PIN (shorter than for the other reports) myself.

https://www.freeze.equifax.com/ https://freeze.transunion.com/ https://www.experian.com/freeze/center.html

You and your wife just did it 1 minute apart...

https://www.experian.com/fraud/center.html#content-01

"You'll need to supply your name, address, date of birth, Social Security number and other personal information. Fees vary based on where you live, but commonly range from $5 to $10."

So depending on where you live, you probably have to pay.

I've just been skimming search result for lawyer... You're pretty much the only one actually asking for one...

Edit: well, you have to pay with a credit card so it's traceable, so not that bad.

f no I'm not paying them anything

Federal Law allows a fee, some states have passed laws mandating no fee, or no fee to freeze but a fee to unfreeze, etc

Indeed. This is now no longer something that would be nice to have; it's the only way the system can possibly work. If a credit agency can no longer verify your identity by asking you questions about your history -- the criminals now have all that information -- there's going to have to be another way.

Sounds like a great YC application! Someone should do it!

Also, although they offer 1 free year, the problem here (social insurance number, etc) is a lot longer than that, so you'd be paying a recurring amount, wouldn't you?

>2). NO WAIVER OF RIGHTS FOR THIS CYBER SECURITY INCIDENT In response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident.

Equifax: https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo... Experian: https://www.experian.com/consumer/cac/InvalidateSession.do?c... TransUnion: https://annualcreditreport.transunion.com/fa/securityFreeze/...

http://clark.com/personal-finance-credit/credit-freeze-and-t...

Of course, Equifax just gave me a 500 AND charged my card anyway, so that was nice. The other two worked fine though. Equifax is a steaming pile of garbage.

Edit to mention that I only used burner cards for the payments.

"This is not financial advise:

I remember a few commentors on HN recently saying they have made large gains by buying stock of companies after the news of cyber security breaches significantly reduced the share value, then waiting for the dust to settle(reaction-news-cycle to complete) and price to return to similar value after a few months."

Hopefully this time will be different, but I doubt it.

http://www.ncdoj.gov/freefreeze

https://www.reddit.com/r/personalfinance/wiki/identity_theft

Fees vary by state. I think I paid ~$20 total and not all of them charged me.

(In theory if someone steals money through your debit card you can get it back... in theory. I'd like to avoid ever having to find out how well this works in practice).

They charge interest, but you don't pay any interest if you settle the full balance every month, which I always do.

Most merchants/payment processors include a premium for handling the edge cases that arise from credit-linked misbehaviour. In the same way you sometimes get a cash discount, removing the merchant/provider protections should show up in your wallet as a good (and surprisingly high) surprise.

As I understand it (please correct me), the party who gains for the furtherance of this agenda is the financial service sector who has another opportunity to insert marginal fees and more importantly, a direct access to your transactions without necessarily having the same fiduciary duty or alignement of goals than a bank teller/account manager would have.

FYI. That is a satire / parody site and not the real one.