Comment by jstarfish | Hacker News Reader

Comment by jstarfish | Hacker News Reader

Parent Full thread

Your grievance is misguided.

Transunion can't do shit about some Belarusian teenager stealing your identity any more than anybody can indict them for deploying ransomware on government networks. The framework for prosecution of international cybercrime does not exist.

Domestically, Transunion absolutely will shut down access to data furnishers who do not vet employees, in cases where an employee is bored and looking up their exes and random celebrities. It is a violation of the FCRA and subjects the bureau and the furnisher to fines. The bored employee scenario usually just results in termination but if there are other factors at play like identity theft/fraud, law enforcement absolutely gets involved.

This rogue employee scenario is the mechanic I'm guessing is being exploited here, only it seems crowdsourced to obfuscate attribution (so one person isn't making hundreds of fraudulent requests that gets them noticed).

This stuff happens at Equifax all the time too. People are always trying to look up Donald Trump, athletes and rappers in misguided attempts to see how much money they have or where they live. (Celebs have taken to getting around this by buying properties in relatives' names.)

> Your grievance is misguided.

I'm not sure what makes you think that, given you don't know any of the details involved.

In my case, TransUnion received credit checks for me with dates of birth 1 Jan, 2 Jan, 3 Jan, 4 Jan and so on until they hit upon my date of birth, then a credit account was opened that same day, then later in the day a third party credit monitoring agency accessed my credit report and they were allowed to pass 'knowledge based authentication' using their knowledge of that credit account.

I am completely sure TransUnion could have detected and foiled this incredibly obvious attack. I'm also completely sure they could have identified other victims of the same attackers and informed them, but they chose not to.

KBA must die.

TransUnion also has full control over what authentication mechanism they use. On the extreme end, they could require a Yubikey to be used. However, they deem the hassle to implement better auth not to be worth it while it's users who carry the cost of TransUnion's inability to properly authenticate people.

They also see zero reason to spend even a dime on better security of processes when they saw that the entire company could be pwned and distributed on the dark web and you end up losing zero revenue, maybe a million bucks in a class action suit.

Are they vulnerable to SSPR Abuse? I'm having great fun reporting to Very Large Services and being rebuffed because they don't understand or care.

> I am completely sure TransUnion could have detected and foiled this incredibly obvious attack. I'm also completely sure they could have identified other victims of the same attackers and informed them, but they chose not to.

It's entirely possible that nobody at TransUnion knows how to achieve this given the state of their databases' and/or staff. For example, maybe their system was set up before constraints were a thing and they stopped development once it started printing money, so the only person "working" on it does light maintenance as a portion of their other duties.

> Transunion can't do shit

They can but they don't. There being no framework for prosecution doesn't mean it's impossible to not hand out data to anybody that asks with minimal info provided.

That kind of unbounded massive privacy violation would result in million € fines (if not dozen or hundreds of millions) under GDPR law. And it was already not possible at scale in major European countries before GDPR. What permit it to happen in the USA at scale, is that the baseline of protections is so low compared to Europe. Depending on the state it is getting better, but there is still this culture about making massive files on everybody about everything and then selling them to anybody who ask and pay. Such databases are often forbidden in Europe to begin with because we think of what could happen if they are misused.

The notion that the fault would completely be on a "Belarusian teenager stealing your identity" and no responsibility whatsoever on people organising a system of massive private data collection in the first place, and then not even able to keep such data secure, is ludicrous. And even when you know that privacy invasion is attempted all the time you don't reach the conclusion that at the very least better securing the data would be needed, that task I'm not sure can be done by any "Belarusian teenager" - and that task has de-facto not be done by whoever is collecting and maintaining the private data that has leaked and is still leaking.

> That kind of unbounded massive privacy violation would result in million € fines (if not dozen or hundreds of millions) under GDPR law

No they wouldn't. GDPR enforcement is severely lacking and the regulators tasked with enforcing it are either incompetent or corrupt.

If they aren't responsible enough to handle the data, then they shouldn't have it in the first place. The end. Fine them out of existence if they hand over PII to random 3rd parties.

lolwut?

The criminal made a false request for credit report. TU released the credit history without confirming ID. The bank relied on that credit report to extend credit.

The problem is, as a whole, ruining the credit of a few thousand people/year (and making them jump through hoops to regain their ID) is less costly than clamping down. TU absolutely contributes to the problem; they just have no incentive to fix it.

Reply on news.ycombinator.com