You may have heard about a lawsuit filed regarding a data breach concerning social security numbers. I encourage you to read at least the first few pages of the linked class action complaint to see how massive a violation of privacy this is.
The data breach concerns National Public Data, a company which offers background checks. They collect personally identifiable information (PII) as a part of their business. The defendant claims that NPD scraped PII from non-public sources (¶11). NPD then stored the data in an insecure manner and did not adequately protect this personal information (¶25). Consequently, a hacking group by the name of “USDoD” stole records of 2.9 billion individuals from NPD. According to the document, the data was independently reviewed by VX-underground, the cybersecurity company. They confirmed the breach included full names, address and address history, and social security numbers. They were also able to identify familial connections, both living and deceased (¶ 22-24).
Based on this class action complaint, NPD’s conduct was grossly negligent, leading to potential identity theft for almost anyone in the United States. It was also a massive privacy violation by scraping data from non-public sources. Even after they took millions of Americans personal information, they failed to secure the data from hackers.
Criminals can ruin your life if they target you with this information. They can open lines of credit without you knowing. You might only find out until creditors call you, demanding that you pay them back (¶60).
So, yeah. I am very concerned. I’ll have to figure out how to defend against this identity theft. Overall, I’m new to the privacy community, but I’m feeling like “privacy” in the United States is an absolute mess. If your data wasn’t somewhere on the dark web, it might be now. Protect your data. Stay safe.
@ChaosCoati @Chozo
Exactly.
But it’s very easy and fast to temporarily thaw it when you want to apply for credit.
I’ve been doing it for years.
And just as easy for crooks with this same data to thaw it for you.
@refalo
Not really. Online they’ll need my user/pass, 2fa for starters.
If they try to do it by phone they’ll need to first answer a bunch of questions (which yes they can probably get), but then upload a photo of my license…
There have been several leaks with driver license and passport photos of people from all over the world, usually from sites or services that need to verify identity like for stock trading or porn.
What are the chances that my attempt to thaw gets denied “for my protection”?
Because I’ve gotten locked out if every bank account I’ve ever owned at some point “for my protection” just because I tried to login. The only thing stopping me from freezing my credit is fear that I’ll never be able to thaw it because of these terrible anti-fraud systems that lock me out.