Equifax - their silence - our complicity

[tw]

MarketWatch.com is asking what every informed person always asks. And then routinely finds reasons for failure. From Marketwatch on 15 Sept 2017:

Equifax "Chief Security Officer" Susan Mauldin has a bachelor's degree and a master of fine arts degree in music composition from the University of Georgia. Her LinkedIn professional profile lists no education related to technology or security.

Exactly what is taught in business schools. Management need not know how the work gets done. Only profits are relevant.

A major security hole was discovered and patched in March. Patches must be installed within 30 days. This security hole was so dangerous that others (who come from where the work gets done) implemented it with a 'hair on fire' attitude. But Equifax did nothing for four months after half of their secure database was downloaded.

Laws require such companies to implement security software that looks for access and changes of credit card databases. No such security requirement applies to other databases such as Social Security numbers. So Equifax cut costs; only implemented what was required. This breech was ongoing for four months undetected. When it was detected, Equifax did nothing to protect customers for another six weeks.

NBC News on 14 Sept 2017 asks damning questions:

When Congress hauls in Equifax CEO Richard Smith to grill him, it can start by asking why he put someone with degrees in music in charge of the company's data security.

And then they might also ask him if anyone at the company has been involved in efforts to cover up Susan Mauldin's lack of educational qualifications since the data breach became public.

... as soon as the Equifax data breach became public, someone began to scrub the internet of information about Mauldin.

qz.com also notes:

[Equifax] did not disclose the hack until weeks after it was discovered, and it turned out that some of its executives have sold nearly $2 million in company stock before the announcement, raising concerns about insider trading. (The company says the executives weren't aware of the breach.

Really. Security for half of America and some 400,000 UK citizens were compromised? And top management did not know about it?

The breech was discovered on 29 July. After security sealed the hole, that breech continued the next day. So Equifax hired a cybersecurity firm, Mandiant, on 2 Aug. Then never told anyone that their entire financial security had been compromised until this week - six weeks later.

Also from NBC News:

Equifax's apparent ignorance of standard security protocol doesn't even seem to be limited to its U.S.-based operations: Cybersecurity researcher Brian Krebs reported that an online tool used by Argentinian Equifax employees could be accessed just by typing "admin" as the login and password.

This is typical in any organization run by business school graduates. No different from those other business school graduates who intentionally put lead in Flint MI drinking water despite warnings from the people who know how the work gets done. Not one engineer said it was safe to launch space shuttle Challenger. So they launched it anyway. Even today, most do not even know that - foolishly believe it was an accident.

They only need do what the law requires. The product is irrelevant; only profits matter. Equifax successfully minimized costs. And so:

With unfettered access, hackers would have been able to execute commands just like they were the administrators.

Anybody ask why we need immigrants? People educated in how the work gets done rather than in business school degrees. Too many Americans want to enrich themselves rather than build something productive. Other Americans are accessories after the fact - assume business school philosophies are acceptable.

Equifax will provide a credit monitoring service for anyone in America who has been compromised. That is half of America. But only for one year. Once that data is out there, your personal security is lost for decades. But Equifax will only protect you from their intentional mistake for one year. And only for free if you apply for their service in 30 days. Otherwise you must pay Equifax for that now required protection.

This is not just an information breech. Someone now has all information needed to identify about half of America's secret security people, military officers, intelligence agents (ie spies), and the staff of most every American security organization. All because business schools say anyone even with a music degree is sufficiently trained to do technical work.

Want to know why jobs get lost and incomes do not increase - except among business school graduates? This is another perfect example.

[sexobon]

My information wasn't affected; but then, I use service providers that use another credit reporting agency, not Equifax.

Originally Posted by tw

... Equifax will provide a credit monitoring service for anyone in America who has been compromised. ...

The free monitoring service is offered whether one has been compromised or not.

Solution is simple: “Neither a borrower nor a lender be."

[Gravdigr]

Stopped reading at the first mention of business school.

[xoxoxoBruce]

Despite his hyperbole and personal loathing of MBAs, tw does offer some interesting information. You just have to apply the tw filter to his posts.

I was under the impression Equifax, Experian, and TransUnion have files on everyone who has a credit card, bank account, or ever borrowed money. You have no choice, you are not their customer, you are their commodity.
This doesn't seem right for them to have NSA power.

[sexobon]

People give them that right when they agree to the terms and conditions of those services that use credit reporting agencies.

[xoxoxoBruce]

Yeah, I know it's legal, but it ain't right.

[tw]

Originally Posted by xoxoxoBruce

I was under the impression Equifax, Experian, and TransUnion have files on everyone who has a credit card, bank account, or ever borrowed money.

Correct. Anyone who learns why these things happen quickly learn what education philosophy makes it possible (and acceptable). Those people also know you have no choice. All credit bureaus have you listed if you have a bank account, job, home ownership or rental, bills, etc. The informed have long known that.

Bureaus have the right to collect and report anything they want about you. You can only restrict that information if specifically following procedures unique to each credit bureau.

Everyone should also know that regulations were imposed on these agencies so that you can obtain a free credit report from each every year. They fought that law. Be careful. They lay traps. Freecreditreport.com is not free. Annualcreditreport.com is.

Anyone in denial of what is taught in business schools is an accessory after the fact. These financial institutions need heavy handed regulation. Since they believe their purpose is profit - not serving the economy with a product.

We still have a problem discussed here in detail over a decade ago. We still have no credit protection agency that works for you. All credit protection is shaded for the benefit of financial agencies. You should have the ability to view (verify, inspect like a monthly bank statement) every credit worthy event at any time you want. That still does not exist.

Once your Social Security number is compromised, all protection is compromised. A new Social Security number should be available just like a new credit card number. That protection still does not exist. Finance companies fear it might be too hard. They forget that they are supppose to work for (serve) you.

[sexobon]

Originally Posted by xoxoxoBruce

I was under the impression Equifax, Experian, and TransUnion have files on everyone who has a credit card, bank account, or ever borrowed money.

Each consumer reporting agency collects and aggregates personal information, financial data, and alternative data on individuals from a variety of sources with which that reporting agency has a relationship. A consumer's credit file may contain different information at each of the consumer reporting agencies evidenced by the fact that FICO scores can vary depending on which agency provides the information to FICO to generate the score.