Equifax Admits 38,000 Driver Licences Stolen In Breach

Credit checking specialist Equifax has revealed more details about its hugely damaging data breach that was only reported in September last year, even though it had been discovered in late July 2017.

The additional details of the breach was revealed in letters sent to several US Congressional committees.

It comes after Equifax in March this year warned that its forensic examination revealed that more customers had their personal data compromised than first thought.

Compromised data

In March Equifax said that it was able to identify approximately 2.4 million US consumers whose names and partial driver’s license information had been stolen.

This was in addition to the 146 million US consumers, as well as nearly 700,000 UK consumers, that had their data stolen when the firm revealed its data breach to the world in September last year.

But Equifax in its letters to the US Congress has now revealed that about 38,000 driver’s licenses and 3,200 passports details had been uploaded to the portal that was hacked.

Other compromised personal data includes 146.6 million names, 146.6 million dates of birth, 145.5 million social security numbers, 99 million address information and 209,000 payment card number and expiration dates.

All of this type of information is incredibly valuable to criminal gangs.

Breach Fallout

The data breach at Equifax took place between mid-May through July 2017, and affected nearly half the population of the United States.

Its fallout has triggered multiple investigations across the world, and the credit monitoring firm was hauled up before the US Congress, where former CEO Richard Smith faced a serious grilling from US Senators.

And to make matters worse, it seems that a security researcher had already warned the firm about its vulnerability to a cyberattack six months before it actually suffered the breach.

The unnamed researcher couldn’t believe it when one particular Equifax website he found he was able to access access the personal data of millions upon millions of Americans (names, dates of birth, social security numbers etc).

The website in question apparently looked like a portal made only for employees, but was completely exposed to anyone on the internet.

It displayed several search fields, and anyone with no authentication could force the site to display the personal data of Equifax’s customers, the researcher reportedly said.

The researcher then notified the company of the flaw, but Equifax failed to act on the warning.

Do you know all about security? Try our quiz!