Hacker News Reader

Comment by jbotz | Hacker News Reader

The Brazilian blog "Tecnoblog" has the full details here[1], with a list of all the information allegedly included in this data. If they are correct that's pretty much everything about everybody... I mean personal info (like addresses and phones, family, education, employer), financial info (like bank accounts, salary, credit score, creditors, bounced checks, whether receiving government assistance), other background info... for some entries (over a million) there even mugshots!

[1] https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-2...

View on HN

Looks like it's Experian -- again.

https://www.serasaexperian.com.br/

https://en.wikipedia.org/wiki/Experian#2015_data_breach

https://en.wikipedia.org/wiki/Experian#2020_data_breach

They've certainly failed on a number of occasions.

Given the type of data they hold, you would expect they get targeted a lot more. Which is why they need to do better.

Much better

> It is one of the "Big Three" credit-reporting agencies, alongside TransUnion and Equifax.

It's an Equifax buddy.

Is there a way for someone to look up what leaked about them so they can determine how problematic this could be?

Yes. The hacker has a contact email where you can send queries using the CPF (unique for each Brazilian) of whoever you want. He'll then send you a bitcoin address for payment and send you back the info.

It would be pretty short-sighted to reward such an individual.

Would it? Hacking on the internet is pretty much immune to conventional systems that keep people honest, like being able to be caught and prosecuted or social norms. I think it's more useful to see hackers as like a force of nature to defend against but which it's useless to try to do any moralizing about. The more hacking that happens, the more secure computers will (hopefully) be made in defense, and the less vulnerable to future hacks. Hopefully it's not an endless arms race and eventually we figure out standard ways to keep things secure as a result.

I’ve already had to reward the government and credit bureaus to get access to my data. I don’t see anything too different about rewarding this hacker just because the law doesn’t bless this sort of data extortion like it does the rest.

Reply on news.ycombinator.com