Consumer complaint received 2017-09-08
Company: EQUIFAX, INC.
State: MI
Product: Credit reporting, credit repair services, or other personal consumer reports
Sub-product: Credit reporting
Issue: Improper use of your report
Sub-issue: Reporting company used your report improperly

Complaint:
I was alerted on Thursday XX/XX/XXXXthat Equifax ( hereafter reffered to as " The Company '' was the victim of a data breach which released the data of myself and over a hundred million other individuals. This data purportedly contains my name, address, credit card numbers, credit information and SSN. This data breach occured more than 30 days prior, and The Company has known about the breach since at least XXXX XXXX, according to reports. 

The Company did not reach out to me in any way, other than the generic press release, which seems to be negligent. 

I have validated on the website provided by The Company for such purposes ( XXXX XXXX XXXX ) that I am in fact a victim of the breach. However, not only am I unable to take remedial action immediately ( I was given an " enrollment date ' of XX/XX/XXXX ) but I am unable to automatically enroll upon that date, instead I am required to monitor that time myself, make note of the location to enroll, and simply hope that the process goes smoothly. 

Furthermore, it is evident that The Company has been unreasonably lack in their security standards. To allow this much sensitive data to be released is already uancceptable, but other security standards are lacking. It is clear that proper obfuscation ( one-way hash and salt ) was not performed, as evidenced here : XXXX XXXX XXXX   To be clear, it most certainly is not industry standard to store a password in plaintext or any form of reversible encryption. As evidence of this standard, see this article on XXXX 's standards from XXXX : XXXX XXXX XXXX An excerpt from the article demonstrates this " Theres more XXXX also provides some other very worthwhile advice. 

All passwords must be hashed, salted and stretched, as we explain in our article How to store your users password safely. 

You need a salt of 32 bits or more, a keyed XXXX hash using XXXX, XXXX or XXXX, and the stretching algorithm XXXX with at least 10,000 iterations. 
" Finally, it is clear that for the small subset of people who were able to take immediate action to remedy this grievous leak they were coerced into an unreasonable contract. The Company 's provided fraud monitoring service ( which will presumably be what I can enroll in on XX/XX/XXXX as mentioned above, and is reportedly owned and operated by The Company ) reportedly contains wording in their Terms of Use that prohibit the users from taking legal action against The Company. This is clearly an unenforceable contract, as the majority of users ( over half of the adult US population ) are doubtless not knowledgable of their rights in this matter, and are in an unreasonable state of mind as they panic over their valuable and irreplaceable personal data being released by The Company. This contract seems like a clear act of bad faith on the company, and a feeble attempt to stymie the flow of lawsuits, both class and individual, that they will be rightfully bombarded with in due course. If The Company were truly attempting to remedy this situation, caused by their shortsightedness and carelessness, they would offer this service without such burdensome strings attached to it.

Company response to consumer: Closed with explanation