>"Equifax must be dismantled and driven into bankruptcy."

I don't disagree with that sentiment but you have to deal with the whole triumvirate - Equifax, Experian and Transunion.

As well as ChexSystems which contains just as must personal data about deposit accounts instead of credit accounts. Also Lexis which collects from a wide range of private sources and has exclusive special arrangements with public sources.

I guess I am not as familiar with CheckSystems, is that pay roll data?

Does Lexis Nexus collect financial data on individuals? I thought it's focus was research

ChexSystem is bank accounts and contains very, very little information compared to credit bureaus. Just accounts you've opened (and attempted to open) recently and any negative information. You can (and should) request your report here: https://www.chexsystems.com/web/chexsystems/consumerdebit/pa...

Early Warning, however, contains way, way more information about bank accounts. It lists most of your accounts plus dates opened, dates closed, and other stuff. (I don't have my report on hand, so I'm going from memory) You can (and should) request your report here: https://www.earlywarning.com/consumer-information.html#instr...

I request both every year. (Because I churn bank account bonuses)

LexisNexis has a whole crapload of consumer reports. The big one is the CLUE report on insurance claims. They have employment databases as well and probably others, I'm not as familiar with them. You can request a copy of your CLUE report here: https://personalreports.lexisnexis.com/fact_act_disclosure.j...

I have to admit, I've never requested my CLUE report.

I've mentioned this in another comment but there's actually two more credit bureaus, SageStream (request report here: https://www.sagestreamllc.com/consumer-report/) and Innovis (request report here: https://www.innovis.com/personal/creditReport) I've never requested either myself but I am in the process of requesting both right now.

I have requested my CLUE report from LN. It contained basically no information.

The report I got had inaccurate information. Mostly about previous residents at this address.

It wouldn't unless you've had recent (<5 years) insurance claims.

That's a good thing to know that people aren't making insurance claims in your name.

ChexSystems does not have salary information. They contain information on bank accounts that have been overdrawn, bad checks, and checkbook orders. They also contain information on accounts in good standing, and the usual information like aliases, addresses, SSNs, and driver license numbers.

Lexis Nexis long since moved beyond newspaper and courthouse archiving. They have dozens of intelligence products and databases aimed at marketing, debt collection, private investigators, and law enforcement. They collect massive personal consumer (and business) data, including retail purchases and returns, and salaries, and associate it in a Facebook-style graph, loosely associated with SSN and DL#.

Interesting about both, thanks. I suppose it's just a matter of time before both of these are compromised. In fact is surprising that they haven't. I wonder if this is just because they aren't as well known as the big 3?

Lexis sells access to everything although some of the databases are pricey. I have not heard of a ChexSystems breach yet. They are integrated with most banks.

Even with normal use and no breaches, all these cross-referenced databases are hell for those of us who went through a gender transition. It is practically impossible to get rid of references to my old name. It outs me anytime I open a bank/credit account or arrange new insurance.

Lexis Nexis suffered a breach in 2013.

I only learned last week that there is also Innovis. I'd bet there are smaller firms doing the same thing, as well.

Innovis as well.

Sagestream is another (rarely used) credit bureau: https://www.sagestreamllc.com

Notably it's used by Bank of America

More information: http://www.latimes.com/business/lazarus/la-fi-lazarus-credit...

Interesting. I was unfamiliar with Innovis until last week where an article I read mentioned freezing your credit profile with the big 3 agencies and mentioned that it wouldn't hurt to contact Innovis as well.

Are they a distant 4th then?

If you put a security alert on on your profile with one of the big 3 agencies it automatically propagates to the other 2. I wonder why it doesn't propagate to this agency as well.

FWIW, the only major company that I know of that uses Innovis is US Bank.

Interesting, it's tempting to not be concerned about them then although if we've learned anything there is zero correlation between doing business with someone and them collecting data about you.

Companies that take this sort of thing seriously ALSO have breaches occur. They just do a better job of mitigating them, and messaging them.

Breaches occur. Negligent security, networking, and auditing missed or ignored network segmentation. I can forgive a small company dealing with my email when they lose it. Equifax is't a small company. They didn't just lose my email. They should be disbanded and their CTO, CIO, and CEO should be held personally responsible.

And Equifax's handling and messaging was truly abysmal. Security professionals are going to write songs about this and pass the knowledge on to their (older) children as scary camp fire stories.

Then perhaps the risk of allowing this kind of business - period - is too great.

The alternative is higher interest rates, reduced unsecured credit, pay-in-advance for housing, and shutting "the masses" out of access to capital.

Correct, all companies face breaches, it's the management and response that should determine the course of action. This is where an independent investigation is crucial for determining basic failures vs systemic disregard. The harder part would be weighing it.

> The nihilistic implication that nothing can be done is maddening.

THIS. And in this case we have blatant evidence of negligence- There is absolutely zero excuse in this day and age to not keep operating systems patched up with security patches. There is no financial excuse, there is no logistical excuse, and given the sensitivity of the data, there is no ethical excuse. Take the responsibility seriously, or please just go off and die in a fire. (Or, if you're an Equifax executive, retire at the height of your incompetence.)

Which is why I shamelessly say: Fuck Richard Smith, fuck Equifax, fuck Susan Mauldin, and fuck their entire IT management staff. What the fuck is wrong with you people?

Disclaimer: I was recently hacked/had my identity stolen, and although I was fortunate to only have to wait 2 weeks to get back access to everything, I may be a little sore about stuff like this.

I agree that seeing Equifax go bankrupt over this would be great. But do you honestly believe your data will be safe? All that time you spent hardening your architecture makes it safer, but not 100% safe. If it's hacked because of one mistake that one person made, would it be right to hold you criminally responsible?

There should be no avenue for single points of failure to result in catastrophic data breach. Neither architecture nor procedures should allow a single person to compromise the system, willingly or accidentally.

If you can't guarantee that the data can be kept safe, then you shouldn't rely your business on it.

I don't disagree, either, but whatever data Equifax has collected would be part of the bankruptcy sale.

Equifax needs to wipe its data and all extant backups. Then it can be sold (for maybe ten dollars).

Were the companies you worked for dealing with data at the scale of Equifax? Were they under the kind of unceasing attack that the Equifax systems are? Do you think you could have withstood that kind of assault on your systems?

All the CRAs endure attacks at a scale that are difficult to comprehend. It's frankly a surprise that something like this hasn't happened before to any one of the big 3.

It's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection.

Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available if one happened to know the magic URL. This discovery was made through the process of a pen-test team sharing their findings back to development, who in turn extended their findings based on what developers knew about the system. Forensics done after the discovery revealed no cases of anyone actually finding the magic URL, which was a big relief for the company. So maybe the banks aren't as strong as we think, either. We have quite a few payment breaches to look back to as evidence.

> It's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection.

Can you cite a source for how we "now know how terribly fast and loose Equifax was operating"?

Equifax is a CRA and is treated as a financial institution under the applicable laws, like banks are.

> Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available

Then you should know better than to simply claim that a company that suffers a breach is somehow inherently incompetent or uncaring about security.

A banking company operating in 1999 is an entirely different context than Equifax operating in 2017. The web and its risks aren't new any more. Equifax's database being one webapp away from disclosure is entirely irresponsible - and if there is no alternative, then they'd need a kick-ass pen-testing, bug bounty, patching, WAF deploying, internal security program. If they had such a program, it would have caught this issue in multiple ways. If they weren't going to deploy the patch, they could have asserted rules in the WAF, for example. We can only assume, then, that this effort was either underfunded, poorly managed, or both.

Furthering their incompetence by linking to phishing sites in the aftermath, not offering data protection automatically, and suggesting US persons should pay them for protection (!) all point to the deeper corporate problem that is at the root of this issue, which is that they see US persons as suckers and don't really care about data privacy or information security. Otherwise, they'd have staff trained on response and they'd have social outreach folks validating URLs before posting as the company representatives.

It's totally appropriate for the CEO to resign.

> We can only assume, then, that this effort was either underfunded, poorly managed, or both.

Pure conjecture on your part. You have no insight into their security program. The only thing you can accurately infer is that they missed this one.

The phishing site thing was pretty stupid, though, I agree.

> Equifax was negligent to spill all that data, but a business model that requires all that data in one place is itself a form of negligence. - Matt Blaze

http://thehill.com/opinion/technology/350197-equifax-breach-...

I'm not sure how this opinion piece figures in to anything. He's entitled to his opinion like anyone else, but his saying it's negligence, without any legal basis for the claim, is just puffery.

You disagree that the business model itself is a form of negligence?

Of course. You don't?

> No, a rational company with accountability for its data doesn't outsource their IT security

There are a lot of irrational companies in the world by that standard.