You may have heard about a lawsuit filed regarding a data breach concerning social security numbers. I encourage you to read at least the first few pages of the linked class action complaint to see how massive a violation of privacy this is.
The data breach concerns National Public Data, a company which offers background checks. They collect personally identifiable information (PII) as a part of their business. The defendant claims that NPD scraped PII from non-public sources (¶11). NPD then stored the data in an insecure manner and did not adequately protect this personal information (¶25). Consequently, a hacking group by the name of “USDoD” stole records of 2.9 billion individuals from NPD. According to the document, the data was independently reviewed by VX-underground, the cybersecurity company. They confirmed the breach included full names, address and address history, and social security numbers. They were also able to identify familial connections, both living and deceased (¶ 22-24).
Based on this class action complaint, NPD’s conduct was grossly negligent, leading to potential identity theft for almost anyone in the United States. It was also a massive privacy violation by scraping data from non-public sources. Even after they took millions of Americans personal information, they failed to secure the data from hackers.
Criminals can ruin your life if they target you with this information. They can open lines of credit without you knowing. You might only find out until creditors call you, demanding that you pay them back (¶60).
So, yeah. I am very concerned. I’ll have to figure out how to defend against this identity theft. Overall, I’m new to the privacy community, but I’m feeling like “privacy” in the United States is an absolute mess. If your data wasn’t somewhere on the dark web, it might be now. Protect your data. Stay safe.
Freeze your credit:
Don’t forget these companies didn’t exist before the late 80’s and credit worked just fine without them.
Yeah, but we replaced welfare with credit cards so…
Everyone in the US should freeze their credit. Yes, it sucks that you have to unfreeze it to apply for new credit but it doesn’t actually suck that bad. Everything is done through the websites.
Also what ever email you use, enable 2 factor authentication. I think using OTA is better because people have had their numbers sim swapped.
No. I never opted into this system. They can opt me out.
I’ve never had an account with these. Do I need to create an account with them to freeze my credits? And what kinds of information should I give / not give when I do?
If they have your records, then you can request a freeze in a variety of ways. Online is just the easiest way to manage all that.
I tried w equifax recently and kept saying not available at this time
There’s no longer any restrictions on feeezing and thawing your credit from the big 3 agencies. All of them also offer temporary thawing that automatically freeze after a designated time. Do not under any circumstance permanently thaw them again. If you need new credit cards, credit checks from apartments or mortgaging / car loans, just work with your lender / seller to figure out which agency they will query and when. Set a temporary thaw for as small amount of time as you can, and all will be peachy. What’s more, after a temporary thaw, get a credit report in a couple months after that to verify nothing snuck in during that time.
What does freezing your credit do, exactly? Is this still something someone should do if they don’t even have any credit cards?
I’ve generally been pretty ignorant toward how credit reporting works.
Freezing your credits means you (or anyone else) cannot access your credit report to open new lines of credit. No credit cards, mortgages, car loans, nothing.
Exactly.
But it’s very easy and fast to temporarily thaw it when you want to apply for credit.
I’ve been doing it for years.
What are the chances that my attempt to thaw gets denied “for my protection”?
Because I’ve gotten locked out if every bank account I’ve ever owned at some point “for my protection” just because I tried to login. The only thing stopping me from freezing my credit is fear that I’ll never be able to thaw it because of these terrible anti-fraud systems that lock me out.
What is the data used to freeze your credit? Why couldn’t a bad actor with your SSN unfreeze it?
Edit: I just froze with the big 3 credit agencies. It took name, address, phone number, email, SSN, birthday.
So all the stuff that leaks. Why do people think this provides security if a bad actor has the same data to unfreeze?
The credit monitoring companies have your up-to-date contact information (and verified) when you put the freeze in place. Now, should a third party try to open an account, etc. in your name it should be blocked from happening and the credit monitoring company should contact you.
If a scammer tries to unfreeze or otherwise modify your account with them they should also contact you.
If/when they contact you or you request your account be unfrozen then they’ll use old credit history to confirm your identity. These are a series of three or four random questions that a scammer is unlikely to know. For example they might ask you what kind of car you purchased in 2005, then give you 4 options, like Ford, Honda, Jaguar, or BMW, and then also a “nine of the above” option. Then they might ask you which of the following street addresses you used to live at, and list 4 seemingly random addresses, one of which you might have lived at.
God damn it. F U C K!
I like how the only way to protect yourself is to freeze your credit but also the private websites to freeze your credit that also leak your data like a drippy faucet won’t let you create an account to freeze your credit.
Freeze your credit report at all three credit agencies and ChexSystems. That should protect you from most fraud that involves opening new accounts.
The news is kind blowing this up bigger than it really is. But I find this as a good thing because I’ve noticed a few people FINALLY taking the advice I’ve been giving for years now, and that’s to freeze your credit at the big bureaus and some, if not all, of the smaller ones.
That being said, I checked this data dump for my own data as well as a bunch of friends and family. Not a single person I checked was in it… Which is why I’m not finding this breach to be that frightening personally. The ATT breach was way worse. Also Krebs posted on this today… A good read for anyone interested. Main thing I took from it was a large number of these entries belong to people who have passed away already.
How would one check to see if they’re included?
Download the 300Gib CSV and then find a way to parse it. (It is on Tor)
deleted by creator
Permanent ban, bucko.
It is on Breach forms for anyone curious
I wonder if you and your social circle skews younger.
While I wasn’t able to find myself, my spouse, or my younger siblings, I was able to find both my parents, their friends, and older family.
Friends and I are in the upper 30s and 40s range so not young not old I guess lol. For the family side, I tend to look for all my closer relatives which range in all ages. While there were many many lines that matched our last names, the entries that were a match didn’t have the right phone numbers or addresses (so couldn’t really validate if they were us or others with the same name). Or it could always be that they were addresses so old that I don’t have a record of them to compare to… Considering a large chunk of the data is apparently old, it’s possible that could be a reason I didn’t see everyone, too? I’ll probably go back and dig a little deeper on the family side since I haven’t deleted the data yet.
This shouldn’t be our responsibility to “fix”.
Also be careful of having your experian account being compromised where hackers then attempt to unfreeze your credit.
What was the story on that? I remember reading but can’t recall, just anyone could provide a new email if “locked out” with no verification or something essentially invalidating all security setup to that point? Wasnt that fixed?
Was it actually a full 2.9 billion?
There aren’t even 2.9billion people in the US.
There is duplicate data and address history in the dump.
# of records ≠ # of people.
maybe there was a mixup of individual datapoints and individual persons.
lets see if that could fit.
as far as i read things in this thread, the whole security is based on exactly these datapoints: Full Name, Date of Birth and SSN (three datapoints) plus username and password for 3 sites (six datapoints) makes 3+6= 9 datapoints per person.
2.9 billion (us) should be 2.900.000.000 (correct me if i’m wrong, but where i live one “billion” is actually “1.000.000.000.000” thus a “bit” more)
divided by 9 those 2.9billion would be ~ 320 million.
on wikipedia they say the us had 331 million people in 2020…
that would fit like an ass on a bucket! lol just to mention that.
have a nice day!
I know
That’s why this seems megafishy. It would’ve had to be a international breach plus maybe some dead people
deleted by creator
Gosh damn Linyos Torovoltos!!!
