Equifax Hackers Enjoyed Leisurely Tour Inside Your Credit History

When Equifax announced Sept. 7 that about 143 million consumer credit records had been breached hackers, it was telling only part of the story. What Equifax didn’t say at the time was that the hackers could leisurely explore the records for nearly five months.

The company also didn’t publicly admit at the time that these hackers had apparently breached the company network a few months previously.

There was a lot that Equifax didn’t disclose, including the fact that it had delayed making official notification of the breach by six weeks and that the company had never revealed the earlier breaches at the time they occurred.

Equifax hack

Equifax had reportedly been breached at least three other times previously. So far the company has offered no explanation for the delays or for the lack of notice regarding earlier breaches.

One possible reason that the company didn’t mention the earlier breaches is that its highly inept security team didn’t know the company had been breached. Or it may be that Equifax security executives simply didn’t know they were legally required to report such breaches of private information.

When the hackers broke in to Equifax, they apparently found no real security. In one instance, the password to get in was “admin” which worked well with the user name, which was also “admin.”

In another instance, according to security researcher Brian Krebs, authentication was based on a user logging in with their email address and on that system, all email addresses were composed of the first initial and last name of the user.

By now you probably know that the executives in charge of security at Equifax have been fired, which almost doesn’t matter, because it’s hard to imagine that things could get any worse than they already were. Who knows, they might have done less damage than the executives who tried to manage the response by among other things, sending customers seeking help to a fake website.

Loading ...
In fact, where Equifax customer support employees were sending customers to check if they were breached was a website made to look like the official site, but which was in fact a fake phishing site. By now you’re probably wondering what a fake phishing site is, and I’ll get to that in a moment.
But first, what happened is that Equifax created a new site with a domain outside of the normal Equifax site called www.equifaxsecurity2017.com. The fact that it was outside of Equifax meant that it was easier for hackers to set up bogus sites that take advantage of typos and misunderstandings. One such site was www.securityequifax2017.com.

As it happens, securityequifax2017 is the site that was being given out by Equifax support staff. That’s a fake site.

Originally published on eWeek

Continues on Page 2…

Page: 1 2

Wayne Rash

Wayne Rash is senior correspondent for eWEEK and a writer with 30 years of experience. His career includes IT work for the US Air Force.

Recent Posts

Spyware Maker NSO Group Found Liable In US Court

Landmark ruling finds NSO Group liable on hacking charges in US federal court, after Pegasus…

1 day ago

Microsoft Diversifying 365 Copilot Away From OpenAI

Microsoft reportedly adding internal and third-party AI models to enterprise 365 Copilot offering as it…

1 day ago

Albania Bans TikTok For One Year After Stabbing

Albania to ban access to TikTok for one year after schoolboy stabbed to death, as…

1 day ago

Foldable Shipments Slow In China Amidst Global Growth Pains

Shipments of foldable smartphones show dramatic slowdown in world's biggest smartphone market amidst broader growth…

1 day ago

Google Proposes Remedies After Antitrust Defeat

Google proposes modest remedies to restore search competition, while decrying government overreach and planning appeal

1 day ago

Sega Considers Starting Own Game Subscription Service

Sega 'evaluating' starting its own game subscription service, as on-demand business model makes headway in…

1 day ago