Equifax Breach

[pinzgauer]

I agree...she's had 14 years in the private sector since her Master's degree. Can't completely judge her qualifications....BUT, her counterparts at Transunion and Experion have through-and-through cybersecurity credentials.

And that means virtually nothing...

You are right, you can't judge her qualifications at all, since I know what your profession is.

I have zero direct knowledge of Susan's involvement or not in this particular event. Doesn't matter, just like Admirals or similar she will take the bullet for this event, already has.

What I do know is that she hired and developed experts in their respective fields. One particular example got into the computer security field under Susan and has since been at three of the top industry leaders, names ot only would you know, but you use their products daily most likely. Not just worked there, became Chief scientist or similar in the field of computer security.

So independent of who and how it happened, I will just flat-out state as fact from first-hand knowledge it would not be because she was not qualified.

Furthermore, most of her online data, including profiles, articles, even YouTube interviews, have been scrubbed from the internet. All signs, including the end result if her tenure, point to her being underqualified for the job she had.

Meaningless. If anything she should not have had them there to start with. (Linked in for sure).

She and others had to take them down because of personal threats.

In large corporations above a certain level you are not supposed to have any of that information publicly available except through the corporate sources. Carefully managed, etc for this exact reason.

That's not to hide their qualifications, that information is on corporate bios. It's more to prevent witch hunts based on perception rather than fact, and to put these leaders at risk, both physical or other.

I'm below C level in a big corporation, but not by much, and I'm already at the point that the information available on Linked-in or similar is beyond what corporate officially approves of.

Equifax will pay for their sins. Whether Susan had any hand in it or not I don't know, but she's already paid her price. She's just like the admiral of the 7th Fleet, may or may not have had anything to do with the issue. But it happened on her watch, so she's gone.

What I do know is that anyone involved in this field is sweating bullets because it could have been them. And may still have turned out to be.

The article below starts out on the music aspect, which is really a canard, just click bait. But they get into the real issue, and that's where the real problem is.

https://www.nbcnews.com/business/con...ureaus-n801706

[Hmac]

Yeah, that's all very interesting. Just idle speculation on my part - I certainly have no expertise in this arena. My bottom-line concern is how it affects me, if at all. I'll see what my advisors have to say later this week and what they think I should do. We'll just move forward from there.

[pinzgauer]

Another interesting twist, a friend who has all his credit proactively locked with all three providers needed to have it unlocked couple days ago to do a loan. Of course the website for Equifax was broken due to overload, phone lines were nonresponsive, Etc

The next day he talks to the bank, and they say hey no problem we were able to pull Equifax anyway. And yet they're all supposed to be locked.

What a mess. We both think there will be Congressional hearings before it's over with. And sad to say, for the first time ever, I might be on the same side of an issue as Senator Warren.

[BrigandTwoFour]

This one is close to home for many reasons...

First, as an expert in derogatory UGA jokes, I have to painfully admit that their school of business, and specifically their MIS degree is very highly regarded, with good reason.

Also, I know Susan, worked with her indirectly over a decade, and briefly for her, a decade ago. Solid technical manager, strong business acumen and a great people manager. So I gave her a pass on her school and degree. Been out of touch for a while, but if this was on her watch I'll tell you it's bigger then her, has to be.

Which leads to the real issue... This problem was not just a matter of just applying patches, and after the patch was applied the entire subsystems had to be rebuilt. Essentially rebuilding your entire site and code.

Many, many companies with sensitive information were vulnerable to this issue. Likewise, many businesses do not fully understand that code is a liability. It has to be maintained, actively managed. Most likely there was not budget or permission to do an outage, or something like that to get the patch in place.

And they got bit.

The real issue is that these companies (credit agencies) are allowed to maintain the type of information they have and there's no real negative consequences for allowing a problem to occur.

Equifax will pay big time for this, but it still probably less than what it would be trying to maintain a Fail-Safe environment. No code can be managed to the level of protection needed and still allow consumer and Industry access the way the credit services do.

Meanwhile the government routinely has leaks that are as bad or worse. If you have a family member in the military or has ever gotten a security clearance, your info has been hacked.

It's been pretty much a yearly event for us between medical industry, the OPM hack, merchandise/vendors, etc., your information is vulnerable.

The only thing that makes this even notable is its scale. You're still most likely at risk from someone like a car salesman having access to your information through credit reporting agencies when they should not.

How many times are you asked for the last 4 digits of your social as some form of authorization? Totally bogus check, that's the real issue.

The problem is not how to keep info like your social security number or bank account numbers private. It's making the systems that leverage that information robust so that knowing the ID does not compromise it.

Technology exists now that totally secured credit card transactions even if you have the card number. Want to know why it's not been implemented in the US? Look to the big retailers and the big Banks.

Meanwhile Europeans easily send cash directly from their accounts to other individuals or vendors in a very secure fashion.

Why can't the banks confirm and transact a certified check instantaneously instead of you being stuck with the problem if it turns out to be counterfeit? They choose not to, can't be bothered.

This stuff happens. It will happen again as it's systematic in the collective Industries. They won't fix it unless forced, and the current system will never make that happen.

At high levels, it's less about technical skill and more about balancing vision, strategy, resources, and people.

When I was in the nuclear weapons realm, I saw the same thing play out over and over again. Some problem happens much lower down the chain, but the person at the top will get hung for it.

I once had a O-5 mentor tell me, "the burden of command is knowing that at any given moment, somebody, somewhere, is doing something that can get you fired."

Ultimately, whatever happened will get blamed on some strategic oversight, misplaced priority, or leadership failing. Whether or not it is actually the fault of the person who is getting fired is immaterial. Examples must be set.

[Doc Safari]

I'll briefly discuss what I did:

1. I put a permanent credit freeze on my account through Experian.
2. I signed up for Zander Identity Theft insurance (recommended by Dave Ramsey)
3. I signed up for LifeLock's basic service
4. I plan to always file my tax returns as soon as feasible from this day forward.

Supposedly LifeLock has had some issues in the past, but they have a reputation as being the best. This data breach is supposedly so bad that the thieves got the motherload of enough info to really screw you.

To my mind, the credit freeze is the best insurance. My credit card company contacted me immediately BEFORE the breach was announced to say they had canceled by card as a precaution and sent me another one in a few days.

Unless I'm mistaken an outfit like Equifax wouldn't have my bank account number, but I signed up to have LifeLock monitor it anyway. Ditto my debit card number.

I can't think of much else to do except maybe change passwords.

[kerplode]

I can't think of much else to do except maybe change passwords.

You should also place a freeze with Equifax and TransUnion. It's not like a Fraud Alert...Freezing one doesn't automatically freeze the others and it doesn't do much good to lock Experian if creditors can pull a report from TransUnion and open an account in your name.

[Doc Safari]

You should also place a freeze with Equifax and TransUnion. It's not like a Fraud Alert...Freezing one doesn't automatically freeze the others and it doesn't do much good to lock Experian if creditors can pull a report from TransUnion and open an account in your name.

Fine. Did and did.

[Whiskey_Bravo]

I'll briefly discuss what I did:

1. I put a permanent credit freeze on my account through Experian.
2. I signed up for Zander Identity Theft insurance (recommended by Dave Ramsey)
3. I signed up for LifeLock's basic service
4. I plan to always file my tax returns as soon as feasible from this day forward.

Supposedly LifeLock has had some issues in the past, but they have a reputation as being the best. This data breach is supposedly so bad that the thieves got the motherload of enough info to really screw you.

To my mind, the credit freeze is the best insurance. My credit card company contacted me immediately BEFORE the breach was announced to say they had canceled by card as a precaution and sent me another one in a few days.

Unless I'm mistaken an outfit like Equifax wouldn't have my bank account number, but I signed up to have LifeLock monitor it anyway. Ditto my debit card number.

I can't think of much else to do except maybe change passwords.

All good info, thank you.

[WillBrink]

Does the fail with this company ever stop?! This is truly unbelievable. They directed people to a fake site!

http://wlrn.org/post/after-massive-d...mers-fake-site

[glocktogo]

Does the fail with this company ever stop?! This is truly unbelievable. They directed people to a fake site!

http://wlrn.org/post/after-massive-d...mers-fake-site

Which is another reason why I haven't gone to their site at all. A company hides the fact that they've been hacked so their senior executives can dump their stock, THEN they announce they've been hacked because of internal incompetence. So the first thing they want all consumers to do is visit their system? Lunacy.

How about they PROVE they've corrected their problems with an independent audit and THEN assist the people they affected?