Equifax Breaches 143M, refuses free freeze

It’s likely that the reason they tell you it’s a possible match is to protect real information. Otherwise malicious actors could just start filling in information and noting where it shows a hit as a legitimate starting point to harvest further information. That technique is a derivative of “account harvesting”, and there are a plethora of ways to exploit systems to get them to give up useful information without them actually giving up any information intentionally. The malicious hackers operating in the world today are far above what ordinary people know to look out for or protect against, so on anything holding critical data, they have to implement some really strange mechanics in order to actually protect that data from getting into a criminal’s hands.

An example of how this works is if I go to some company’s website and it has a login page, I can just start feeding that form random usernames, or usernames from a list, or usernames generated programmatically from lists of common names, and submitting them with a single letter password. If the page responds with something like “invalid user”, or “username does not exist” or the like when an invalid account is entered, but responds with “incorrect password” when it has a valid username and incorrect password, then I’ve just tricked the system into letting me harvest a list of all the user accounts that exist on that website. Now all I have to do is run that list of accounts with a list of common passwords, and I’ll pop open a good 60% of those accounts to do with whatever I please.

In order to prevent that, I have to give exactly the same response (which can include more than just the message it responds with— it has to also include identical HTTP headers, cookies, requests, and even response timing deltas) to ANY invalid or incorrect login information supplied regardless of whether it’s the username or the password, etc. That makes the only message I can offer a legitimate user something like “invalid username or password”, which is less helpful to the real user, but is also the only way I can allow a real user to log in without also making it possible for a hacker to figure out who all the legitimate users on the site are and making it that much easier for them to hack into those accounts or phish those users for credentials that would allow the hacker to pivot and hack those users’ accounts on other sites if they share the same passwords or similar usernames, etc.

What Equifax is likely doing here is preventing identity thieves from gathering an extra 2 digits of social security numbers to associate with last names that they might not otherwise be able to get. It would actually bother me a lot more if it DIDN’T respond that way to random letters and numbers.

Protecting from hackers today is very next level from where it was even just 2-3 years ago. The bad guys are now employing actual data scientists and state intelligence agency level techniques against pretty much everything that exists online. The days of a simple firewall or antivirus software protecting you are over. It has reached the point where multiple security experts are starting to question whether you’d actually be better off without any of those programs than you are with them, because they only protect against a narrow subset of simple threats while actually providing an additional avenue into your data and creating another potentially weak link in the security chain for the bad guys. It’s an ugly world out there today.