The Latest on the massive breach at credit monitoring company Equifax (all times local) :
NEW YORK (AP) — The Latest on the massive breach at credit monitoring company Equifax (all times local) :
4: 15 p.m.
Equifax is blaming an unspecified «website application vulnerability» in hackers’ ability to get personal information on 143 million Americans. Security experts say it’s hard to say for sure without more information, but such vulnerabilities typically don’t require a lot of sophistication to exploit.
Rich Mogull, who runs the security research firm Securosis, says the web app breach suggests «things are broken down in a couple of different areas.» He says someone likely made a programming or configuration mistake, but corporate culture could also be a factor. Often, he says, corporate security is underfunded or isn’t given the authority it needs to make sure application developers do what’s right.
Ryan Kalember of the security company Proofpoint says that even if the vulnerability was known and fixable, «coordination between app developers and security teams in a lot of organizations are not on the best of terms.»
Equifax disclosed Thursday that a breach exposed personal information, including Social Security numbers, on 143 million Americans.
___
4: 15 p.m.
A second House committee has committed to holding a congressional hearing to examine an Equifax data breach compromising the personal data of millions of Americans.
Rep. Greg Walden, the Republican chairman of the House Energy and Commerce Committee, says that after receiving an initial briefing from Equifax, he has decided to hold a hearing examining what wrong and how to better protect against future hackings.
Walden calls the breach unprecedented and says it could affect tens of millions of Americans. He says the breach raises serious questions about the security of personal information online.
Walden says the committee will continue to get briefings from Equifax and work with company officials to determine an appropriate date for the hearing. The House Financial Services Committee has also announced plans for a hearing.
___
2: 15 p.m.
A security expert says a website created by credit monitoring company Equifax to help its customers find out if their personal information was stolen after a massive data breach raises its own security questions.
Georgia Weidman, the founder and chief technology officer for security firm Shevirah, says the website Equifax created looks like the kind of website set up by attackers to trick people into disclosing information.
Weidman says it’s teaching people «entirely the wrong things about using the internet securely.»
Weidman says she’s troubled by Equifax’s approach to security generally, including reports that it didn’t respond to basic scripting bugs it was warned about last year.
The website is, https: //www.equifaxsecurity2017.com/. Equifax says consumers can also call 866-447-7559 for more information about the breach.
___
2 p.m.:
Washington regulators and politicians swiftly criticized Equifax over the exposure of 143 million Americans’ personal information.
Jeb Hensarling, chairman of the House Financial Services Committee, said he will call for Congressional hearings on the Equifax breach.
Equifax’s requirement for affected customers to sign up for arbitration also drew a backlash. Democrats in the House and Senate called on the company to pull back on its requirement that anyone who signs up for credit monitoring give up their right to sue Equifax in a class-action lawsuit.
The Consumer Financial Protection Bureau, the nation’s chief watchdog for financial services, called the breach «troubling» and said Equifax should drop the arbitration requirement. The CFPB recently passed a rule requiring financial companies to let customers sue together when a large group has been wronged.
___
Noon:
There’s no way around it: The news from credit reporting company Equifax that 143 million Americans had their information exposed is very serious.
The crucial pieces of personal information that criminals may need to commit identity theft — Social Security numbers, birthdates, address histories, legal names — were all obtained.
For consumers, it may be time to take even more extreme measures to lock down their information, outside of routine advice like checking your credit reports regularly and seeing if there are any abnormal transactions on your accounts.
The strongest possible option a person can take immediately is placing what’s known as a credit freeze on their credit files with the major credit bureaus. That makes it impossible to open new accounts and bank cards — for thieves as well as yourself.
____
11: 40 a.m.
Investors were bailing out on Equifax a day after the credit monitoring company said a data breach exposed the Social Security numbers and other personal data of 143 million Americans.
Equifax shares fell about 13 percent to $123.75 in heavy trading. The decline equates to about $2.28 billion in lost market value.
The company is one of three major U. S. credit bureaus, the declines extended to its competitors. TransUnion fell 4 percent and Experian stock declined 1 percent in London.
Lenders rely on the information collected by the credit bureaus to help them decide whether to approve financing for homes, cars and credit cards. Credit checks are even sometimes done by employers when deciding whom to hire for a job.
____
12 a.m.
Credit monitoring company Equifax has been hit by a high-tech heist that exposed the Social Security numbers and other sensitive information about 143 million Americans.
Now the unwitting victims have to worry about the threat of having their identities stolen.
The Atlanta-based company, one of three major U. S. credit bureaus, said Thursday that «criminals» exploited a U. S. website application to access files between mid-May and July of this year.
The theft obtained consumers’ names, Social Security numbers, birth dates, addresses and, in some cases, driver’s license numbers.
