Consumer complaint received 2017-09-08
Company: EQUIFAX, INC.
State: OR
Product: Credit reporting, credit repair services, or other personal consumer reports
Sub-product: Credit reporting
Issue: Improper use of your report
Sub-issue: Reporting company used your report improperly

Complaint:
Massive data breach by Equifax announced on XXXX/XXXX/XXXX that included full names, dates of birth, social security numbers and other personally identifying information, including possibly driver 's license and credit card numbers. 

Equifax says the breach begin in mid-XX/XX/XXXX and was not detected until XX/XX/XXXX. Equifax did not notify the media until XX/XX/XXXX, and I have still not been personally notified. 

To add insult to injury, they offer one year of credit monitoring, but make me wait another 3 days to enroll ( they gave me an enrollment date of XX/XX/XXXX ). How does one year of credit monitoring help? My full name, social security number, date of birth, and possibly other details will be freely available from now until the end of time, and none of those details are changing anytime soon. There 's no way to scrub that information from the internet, and by now thousands, if not millions of downloads of that data will have taken place. 

I wo n't be surprised if we find that the data was in plain text, as Equifax makes no mention that the data was encrypted, and it would have every reason to publicize that fact if it were true. If they did store them in plaintext, or the passwords to unlock said encrypted files in plaintext, that 's beyond negligent. It 's downright reckless. 

It appears they have not learned their lesson on security. See the below quoted text. 

I am appalled when an organization whose services I use has a data breach, but this is beyond the pale because I did n't volunteer any information at all to Equifax, and yet they stored all these details in an apparently insecure fashion, and the details themselves are so, so, so much more damaging than even a banking website breach would be. At least changing password ( and possible username ) would likely prevent any further damage, but this is damage that is indefinite and immeasurable. 

From this url ( not my words from this point forward ) : https : XXXX " What 's more, the website www.equifaxsecurity2017.com/, which Equifax created to notify people of the breach, is highly problematic for a variety of reasons. It runs on a stock installation XXXX, a content management system that does n't provide the enterprise-grade security required for a site that asks people to provide their last name and all but three digits of their Social Security number. The TLS certificate does n't perform proper revocation checks. Worse still, the domain name is n't registered to Equifax, and its format looks like precisely the kind of thing a criminal operation might use to steal people 's details. It 's no surprise that XXXX-owned Open DNS was blocking access to the site and warning it was a suspected phishing threat. 

Another indications of sloppiness : a username for administering the site has been left in a page that was hosted here. Here 's what it looked like before it was taken down at about XXXX am California time : ''

Company response to consumer: Closed with explanation