#equifax hack

Who is Equifax?

Equifax is one of the three major credit-reporting companies (the others being TransUnion and Experian). Basically, they determine your ability to get anything credit related from cell phones to loans. They are one of three companies that determine your financial lifestyle and maybe your work life as well! Some employees use the system to check your credit as part of a background check, especially when dealing with money. 

There is legislation on the way to limited credit checks such as this, but it may be a while before (and if) it becomes a reality. (source) 

Long story short, if you’re an adult in the U.S.A., you’re likely at risk.

What is this “hack situation” as you put it?

The situation is that a group of hackers breached Equifax via a vulnerability in their Apache software. Apache is one of the many applications used to help run websites so that you can actually see the website via the HTTP protocol. 67% of the World Wide Web uses Apache because it’s “free” software... free as in “yes, you can run your own web server and never pay us a dime”. However, you have to be trained in it in order to set up and be secured. 

Since the software is free, Apache isn’t owned by a major corporation, but by a community of people called the “Apache Foundation”. Because of its open-source nature, there’s bound to be errors and security holes that can be exploited. When this happens, people will run to patch it up and issue it asap.

So, the Apache foundation placed a patch up for that particular problem in March. However, Equifax didn’t patch the software until July. The reason why they didn’t patch up a hole for five months is anyone’s guess at the moment. But one thing is certain: because this software help runs websites, you can take a clear guess of exactly how the breach happened: via the web.  (source)

They had patched up the issue. However, there’s a problem. 

Side Note: This is a summary for non-tech people, so this explanation is oversimplified. If you’re looking at the previous paragraphs and was like “that’s not exactly what happened”, you’re right. There are enterprise-software and a bunch of other things, but again, I’m writing this from a non-tech standpoint. 

So, if the patch is fixed, what’s the problem?

The problem is that Equifax didn’t make an announcement immediately upon discovery, which is in May - they made it in late July. That’s a window of 4 months and during that 4 months, they only alerted 5 organizations. (source) 

And this is problematic as in it leaves the door WIDE open for people like you and me.

Okay, how bad is this problem?

The people who are affected by this hack can be affected in more ways than one. First off, it’s more than basic information is stolen; there’s also credit card info and identifying information that can be used to create new credit accounts and even... whole new identities. We’re talking current and past addresses, social security numbers, driver’s license, the whole nine. Your information could be sold on the Black market and such to a point that it can wreak havoc on your financial life for weeks or years. It can take a long time to fix if you’re not aware.

Let me also mention a minor, yet important, note to talk about -  insider trading. Equifax executives sold $2 million in stock before announcing, which is being look into. (source)

What steps should I take to make sure I’m not affected?

As reported, the first step should be to see if you’re affected by this by going to a page, entering your info and seeing if you’re affected by checking the Equifax site. However, there are a few sites that have to clarify wither simply checking will automatically give up your rights to file a class-action lawsuit (aka, a suit where you’ll get money with a group of people that felt wrong by a service. And as you just read, the hack was preventable.). Even the lawyers are confused by the wording of the statements and which company provides the information since there are two separate companies providing the details (Equifax and TrustedID). (source) 

Not to mention that the site itself seems to not work, as shown here in this video. (source)

They have since removed the “class-action” line in their terms of the agreement.

However, it seems like an easy thing to do - a company gets breached, they offer you a year of “ID protection” free. 

There is a way to actually make sure you’re okay...

... but before I get into it I will say this: It’s not an easy one. It’s a project. It requires you to fill out a lot of web forms. Because this is your identity we’re talking about, this is a long process. 

However, I will break it down as simple as possible in as few amount of actionable steps as possible:

1) Assumed that you’re compromised.

As you read, there’s no way to check with certainity if you’re affected. And even if your credit is not that great, do you really want to take the chance of people messing it up even more? 

2) Check your credit report.

You can do it for free here: http://www.annualcreditreport.com/ you are able to check it annually (once a year). You can also check out your credit report/score using your bank if they provide you with a way to do it. HOWEVER, you won’t be able to get the report from all three credit beurus. The annual report is the way to do it.

3) Freeze your credit

Let’s put it out there. There’s no way to “opt out” of your credit reporting. However, you can freeze your credit. What this means is that you won’t be able to create new accounts and/or occur new debts. 

How can you do it? Here’s a lifehacker article to show you how: https://twocents.lifehacker.com/everything-you-need-to-know-about-a-credit-freeze-1803139061

Equifax is providing free credit freezes until October. The other two (TransUnion and Experian) is $10 each. While this maybe an extreme method, a lot of people recommend it.

4) File your taxes early

“Did you just told me to file my taxes early?”

Well... yes. If you’re expecting a tax return next year, then you better do it NICE and EARLY! Remember what I said about the information? Well... guess what? Sadly, it’s all out there and don’t think for a second that they won’t try to steal it.

Next year, just file it as early as possible.

5) Monitor your calls.

Now that your information is out in the open, you may get calls from strangers trying to exploit you to get more. So, the best thing to do is to keep your wits about you when answering calls. 

6) Take time to get your finanical education on.

Lastly, if this is your first time monitoring your own identitiy, then it’s time to take one step futhur and make sure you know every possible thing about credit reports and so on. 

Below are some people I highly recommend that can help you on a path to increase your Finanical IQ:

Tonya Rapley: http://myfabfinance.com/ - https://twitter.com/MyFabFinance

Latasha Kinnard: https://startyoungfinancial.com - https://twitter.com/prettypennys

I hope this “brief” (trust me, I tried cutting down on this) post helps you better understand the situation. I posted up sources to help you get a deeper understanding.

Public: We never asked you to collect that information in the first place.

Equifax: But we did, and it got stolen, but here's what we're going to do. We'll give you a free year of credit monitoring.

Public: But couldn't hackers just sit on my information for a year and then use it?

Equifax: But we offer a bargain basement rate of $16.95 per month to protect your information after that.

Public: You mean the information we never asked you to collect? The same information you failed to protect once already?

Equifax: ...

Public: So you're going to turn a profit from your own fuckup? I'm unsure if this is blackmail or extortion.

Bill Barr and other DOJ officials announced that they have charged four Chinese spies for the 2017 Equifax hack!

At a DOJ press conference this morning, Attorney General Bill Barr and other DOJ officials announced that they have charged four members of the Chinese military for the 2017 Equifax hack. The four spies managed to get access to data from around 150 million US customers and 1 million UK and Canadian customers.

https://twitter.com/TheJusticeDept/status/1226915712788312065

At the press…

Equifax filing reveals hack was somehow even worse than previous estimates

The 2017 hack of Equifax, already among the largest ever recorded, just got bigger. Well, they’re admitting that it was bigger than they had previously, which amounts to the same thing. Documents filed with the SEC reveal that more people, more IDs, and more info in general was stolen when the company utterly failed to protect its “users,” many of which didn’t even know they were in the database.

Equifax filing reveals hack was somehow even worse than previous estimates

The 2017 hack of Equifax, already among the largest ever recorded, just got bigger. Well, they’re admitting that it was bigger than they had previously, which amounts to the same thing. Documents filed with the SEC reveal that more people, more IDs, and more info in general was stolen when the company utterly failed to protect its “users,” many of which didn’t even know they were in the database.