Equifax Suffers Massive Data Breach- Your SSN May Be In the Hands of Thieves

Equifax, one of the big three credit monitoring companies, has experienced one of the most shocking data breaches in U.S. history. The breach has exposed the Social Security numbers, names, birth dates, addresses, driver’s license numbers, and other sensitive information of approximately 143 million Americans. Although there have been larger breaches in the United States, they typically do not involve Social Security numbers. The breach eclipses a 2015 hack at health insurer Anthem that involved the Social Security numbers of about 80 million people.

In addition to the personal information stolen in its breach, Equifax said the credit card numbers for about 209,000 U.S. consumers were also taken, as were "certain dispute documents" containing personal information for approximately 182,000 individuals.

It is believed that the thieves accessed files between mid-May and July of this year. Equifax discovered the hack July 29^th, but waited until September 7^th to warn consumers. However, it is not unusual for the government to ask a company hit in a major hack to delay public notice so that investigators can pursue the perpetrators. It does sound as if three Equifax executives profited from this early knowledge by selling shares worth a combined $1.8 million just a few days after the company discovered the breach on July 29th, according to documents filed with securities regulators.

The irony that Equifax, who is in charge of securing our personal information and the company we go to when our identity has been stolen, has had a major data breach has not gone unnoticed. As many as 50 lawsuits have been filed so far against the credit bureau.

Booth Samuels and the attorneys at Pittman, Dutton & Hellums, P.C. are currently investigating Equifax data breach cases. If you or someone you love has been a victim of this data breach, please contact Booth Samuels at 1-866-515-8880 or by email at booths@pittmandutton.com for a free consultation.

Anthem Sees First Lawsuits Over Data Breach

Another major data breach in our country has occurred, and unfortunately will not be the last. Anthem, one of the nation’s largest health insurance companies, first announced the hack on February 4^th, although it was detected on January 27^th. The unauthorized data quarries started as early as December 10^th of last year and is believed to have occurred through the discovery date. Anthem is based out of Indianapolis, Indiana.

The first lawsuits in the Anthem hack have been filed in Indiana, California, Alabama and Georgia. The suits allege that Anthem did not take adequate and reasonable measures to ensure its data systems were protected. It is estimated that 80 million Anthem customers whose information may have been affected could be harmed.

Hackers gained access to a company database that included members' names, birthdays, Social Security numbers, addresses and employment data, including income. Unlike some of the other data breaches covered in this blog such as the Target and Mapco breaches, credit card information was not among the data stolen.

How the hackers got the information is different as well. The hackers appear to have compromised the credentials of five different tech workers at Anthem, possibly through "phishing" e-mails that trick users into unwittingly revealing passwords or downloading malicious software. The malware used to break into Anthem's network has not shown up on other computer networks and does not appear to have been used in recent attack attempts on other companies.

One of the main questions for consumers is why Anthem would have maintained a single database containing information about 80 million current and former members. HIPPA violations could be a concern for Anthem due to the breach as well.

Two Banks Drop Lawsuits Against Target Over Data Breach

Two U.S. banks that sued Target and credit card security firm Trustwave Holdings, Inc., over responsibility for one of the largest data breaches in history have dropped their lawsuits. Both Trustmark National Bank, out of New York, and Houston-based Green BankNA filed dismissals without prejudice to re-filing on Friday and Monday in Federal court in Chicago.

The lawsuits accused Target and Trustwave of failing to properly secure customer data, leading to the theft of about 40 million payment card records and 70 million other records during last year's holiday shopping season. See my previous blog posts for more information on that story.

Trustwave’s position was that Target did not outsource data security to its Chicago-based company, and that Trustwave did not monitor Target's network or process its cardholder data. Agreements and associations between information technology services companies and retailers are often kept confidential, and neither Target nor Trustwave would confirm whether the companies have been partners.

The breach has cost banks millions of dollars in order to correct fraudulent charges and reissue cards. The breach could cost the banking industry more than $1 billion. It has also been reported that Target is offering free credit monitoring to any of its customers, however the program is limited to just one of the three credit reporting agencies.

Proposed Legislation Regarding Data Breaches Not Good For the Consumer

In the wake of massive security breaches that reportedly took place before and during the height of the holiday shopping season at Target, Nieman Marcus and, security experts say, probably other retailers as well, federal lawmakers have introduced a bipartisan bill that would impose new requirements on companies concerning the protection of confidential information related to credit and debit cards.

In actuality, what the proposed legislation, named the Data Security Act of 2014, would do is to greatly reduce consumer rights to seek redress for their damages through the courts. The legislation would ultimately ban private causes of actions, prohibit class actions, and prevent the consumer to sue under state law causes of action.

Introduced last week by Sens. Tom Carper (D.-Del.) and Roy Blount (R-Mo.), the Data Security Act would provide enhanced consumer security by providing uniform national standards in place of a patchwork of state laws that now exist, according to a press release. It would also require not only retailers but financial institutions and federal agencies to investigate security breaches and inform consumers. While this all sounds great, it leaves the individual who was actually harmed with little or no remedies through the courts at all.

There are several competing bills which have also been proposed. Those bills seek more severe criminal penalties against the computer hackers and those who conceal security breaches. Unfortunately, the hackers who cause the mayhem are seldom caught and prosecuted, hiding behind the anonymity of the internet and remote areas where U.S. law enforcement has little or no reach.

Some States have no statutes that protect the individual consumer, letting claimants rely on common law causes of action. This bill would potentially strip consumers from even those tools to recover against a company like Target.

What Happens To Your Personal Information After a Data Breach?

What happens to your personal information that is compromised in a data breach? That is the question a lot of us are asking right now after the massive data breach that occurred at Target. Of course, Target is not the only retailer to have been hit by one of the most prevalent crimes of the new economy. Just this year, Mapco customers were also the victims of a data breach.

We know that our banks have to reissue our cards, reimburse us for cash that was illegally debited out of our bank accounts, and that we have to monitor our credit files for unauthorized credit-line openings in our names.

But what are the thieves doing with our personal information? The answer to that question is astonishing. There is a criminal underground economy with websites and chat rooms dedicated to data breaches. Data breach thieves have websites devoted solely to the trafficking of our personal information. These auction sites mirror legitimate consumer websites like ebay or amazon. For a thorough and articulate expose on this underground culture, click on the link below.

http://krebsonsecurity.com/2013/12/cards-stolen-in-target-breach-flood-underground-markets/

TARGET CONFIRMS MASSIVE DATA BREACH

Target, one of the nation’s largest retailers, acknowledged Thursday that data connected to about 40 million credit and debit card accounts was stolen as part of a breach that began over the Thanksgiving weekend.

The theft is the second-largest credit card breach in U.S. history. The largest on record was at Heartland Payment Systems, which revealed in 2009 that roughly 130 million credit and debit cards had been exposed. The second-biggest attack struck TJX Companies, the parent company of TJMaxx and Marshall’s, which said in 2007 that about 45 million credit cards and debit cards had been compromised. The retail giant later negotiated a $40.9 million settlement with Visa over the incident. The TJX data was reportedly stolen by criminals who gained access to payment systems through the wireless networks of individual stores.

Customers who made purchases by swiping their cards at Target’s U.S. stores between November 27 and December 15 may have had their accounts exposed. Target confirmed that the stolen data included customer names, credit and debit card numbers, card expiration dates and the embedded code on the magnetic strip found on the backs of cards. As of yet, there was no indication the three- or four-digit security numbers visible on the back of the card were affected. The information stolen could allow criminals to make fraudulent purchases almost anywhere in the world either on the internet or by making phony cards. The massive data breach did not affect online purchases.

Target has not disclosed exactly how the breach occurred. In any event, the hackers gained access to as many as 40 million credit and debit cards used by customers of Target during the height of the holiday shopping season.

The breach highlighted vulnerabilities in the massive, interconnected shopping systems used for billions of dollars of retail transactions every day. Customers at Target’s nearly 1,800 stores in the United States were potentially affected.

Everyday consumers have had to scramble to cancel compromised cards and have new cards issued. This obviously threatens to cause disruptions as shoppers move into the final days of the busiest time of year for retailers.

The Secret Service has even gotten into the investigation. Major breaches in the past have drawn scrutiny, and in some cases, fines from federal and state officials when they determined that companies did not adequately protect private customer information.

It is estimated that Target will have to spend at least $100 million to cover legal costs and to fix whatever went wrong. Target will owe money to card brands, like Visa and American Express, to reimburse customers for fraudulent transactions.

Target said it notified law enforcement authorities and financial institutions after discovering the breach. The company said it also has hired an outside forensics firm to investigate the incident and strengthen its systems.

The payment systems used in modern retailing are sprawling, with countless card readers in individual stores gathering data, transmitting them on internal corporate networks and communicating with banks before approving purchases. Hackers could potentially find weaknesses at any point in the system. Often, hackers insert a “worm” into the system, which continually accumulates data in hidden folders. The hackers then retrieve the worm, which is full of card holder data.

The massive extent of the breach probably means that hackers reached deeply into Target’s corporate networks rather than accessing systems at individual stores. Criminals also obtained pin codes for debit cards, which conceivably could be used to withdraw cash directly from user bank accounts.

Although not on the same scale, the Mapco breach is extremely similar. The threat of data breaches is a constant threat in the new economy and must be taken seriously. See my previous blog posts in regards to the Mapco breach.

Pittman, Dutton & Hellums, P.C. is currently investigating claims against Target as it relates to their data breach. The breach affects individuals and banking institutions alike. If you were affected by the Target data breach, please contact Booth Samuels at booths@pittmandutton.com or 1-866-515-8880.