44m UK consumers on Equifax's books. How many pwned? Blighty eagerly awaits spex on the breach The impact of the Equifax data leak in the UK remains unclear days after the breach was first made public, amid reports estimating that the personal details of up to 44 million Brit could have been exposed. The credit reference agency and its UK subsidiaries provide services for UK companies including BT, Capital One and …
(AC, obviously)
the feature-creep of the credit reference agencies has certainly affected car and general insurance. Anyone who has used an aggregator service in the past 2 years will almost certainly have had their details verified using a service which goes back to Equifax/Experian.
Given that HMG is also an enthusiastic user of such services, WHAT ARE THEY DOING TO PROTECT THEIR CITIZENS, apart from the fuck-all currently on display.
Having been very closely involved with a lot of law-enforcement initiatives, it's painful to note that worldwide, UK citizens are a prize catch due to the useless nature of our government. As in so many other things, we could learn from the rest of Europe - particularly Germany.
"Given that HMG is also an enthusiastic user of such services, WHAT ARE THEY DOING TO PROTECT THEIR CITIZENS, apart from the fuck-all currently on display."
Probably nothing more than a couple of civil servants having a nice drinky poos around the westminster bar saying "I say, what a terrible business old man!", "Yes, isn't it what what. Never mind, another Glenfiddich?".
The government and the tax man only start giving a shit when THEY lose money, they don't give a monkeys if you lose any or all of yours either directly or indirectly through identity theft. Parties of all colours have shown the contempt they hold for the private details of UK citizens. Medical records to India? No problem. Data security? Who cares, we're saving a few quid.
Yes, isn't it what what. Never mind, another Glenfiddich?
I really hope our civil servants have better taste in whisky than Glenfiddich.
More on topic it's not entirely obvious what they can do. It's down to the ICO to figure out if there should be a prosecution and not really anybody else.
Nobody in the EU you guys all love so much wanted to put a requirement to notify in the EU data protection directives so we don't have one.. If we weren't in the EU we'd have had one years ago.
"More on topic it's not entirely obvious what they can do. It's down to the ICO to figure out if there should be a prosecution and not really anybody else."
Remove the exemption that allows the credit reference agencies to store incorrect information would be a start. And allow people to opt-out of data processing would help. And stop giving them access to the unfiltered electoral role.
Plenty of things the government could do if it weren't in the pay of the banks.
Actually, it's worse than worse than that (a fate worse than a fate worse than death ...)
Whilst fuck all progress has been made legitimately with "big data" (too many spivs), there has been a seismic shift in the illegitimate use of big data.
When miscreants around the world start marrying the Equifax data with *other* sources of data - probably all publicly visible (Facebook for a start), you have the perfect storm for some very intractable identity theft.
Echoing the PP about the UK government, bear in mind there have been victims of identity theft who have had to be issued with new NI numbers, as it wasn't possible to undo the damage associated with the old one.
"Given that HMG is also an enthusiastic user of such services, WHAT ARE THEY DOING TO PROTECT THEIR CITIZENS, apart from the fuck-all currently on display."
Working hard at getting out from under any sort of extra-territorial jurisdiction that could hold them to account (standard MP uselessness will make sure Parliament won't).
is what Equifax deserve for this if only 'Pour Encourager Les Autres'
I hope any business using Equifax stops and they fold.
I had a Captial One credit card for a while and refused the free offer of Equifax credit reporting and monitoring. I didn't think it worth the risk of giving them more personal information than they already had. I suppose I just have to keep my fingers crossed.
"I didn't think it worth the risk of giving them more personal information than they already had."
They probably had every bit of that information anyway. You'd be amazed at how much they know about you. It's probably up there with what the NSA has.
NSA here : Not quite, but close.
The quality of English in El Reg articles has gone seriously downhill in the last 12 months, did you sack all your proof readers or just not have any to begin with?
"BT has confirmed it was a user of Equifax services, with a spokesman adding it was in dialogue with credit reference agency about the matter. A BT spokesman courtesy told El Reg he wasn’t able to share any more at this point."
The first sentence in that article is missing a definite article and the second just doesn't make any sense grammatically. There are also multiple references to Equinox in the article that I presume should be Equifax.
No more wrist slapping, take them to the cleaners and break them on the wheel and fine anyone who used them as well. Everybody involved is guilty except the victim who ends up paying for it all
All these agencies have been making money off our backs for years and when that is not enough for them then "oops, your data just slipped through our fingers and into the hands of the more orthodox criminals"
You don't appear to understand how credit reference agencies work, or you wouldn't be at all surprised that as part of the deal their customers (companies who provide credit) give them information on how you behave, such as missed/late payments.
Credit Reference Agencies get feeds from almost every major company that deals with the consumer on an account basis. They will get feeds from all the credit card companies about late payments, balance, from banks, things like unapproved overdrafts. They'll have feeds from you phone company about missing/late payments. If you've got a store card and are in deficit, they'll know about that too.
It's not just company data - they'll know if there are any county court judgements, or if you are on the electoral roll and probably if you owe money on your council tax.
There fingers are everywhere. What's worse, if there's a problem with the source that provide adverse information (as sometimes happens - maybe some company has reported a bad debt wrongly) then the credit bureaux washes its hands. It's up to you to get the error corrected by whoever reported it. There have been some horror stories about that.
If you want to find out what they know about you, then sign up for one of the free services, like Clearscore. You might learn something about how information passes around.
In any event, there are going to be some big, big fines levied here. Not just in the US, but in the EU and (I hope) the UK. After all, the various US finance regulatory bodies have been making quite a nice pile of money fining European banks for misdemeanours.
clearscore appear to be a bastard child of capital one and google. amongst other things they'll only answer a subject access request if you give them phone number (why?) and photocopies of passport & driving licence. no dl and passport? no subject access. if i thought it would make a difference I'd tell the ico.
Customers of these companies might therefore be affected by the attack despite not having signed up for Equifax's services. The US agency holds the personal details of 44 million UK citizens
I'd be curious on which legal basis they hold the data in the US. And I'd be even more curious how they are going to inform all non-customers about the data they kept and failed to secure. 44 million UK citizens, for Christ's sake. That's almost all of the adult population.
The Queen is entitled to vote in EU elections. It is less clear whether or not she is entitled to vote in Westminster or local elections, but she doesn't.
She certainly has financial products. I'm sure the electricity supplier did a credit check before deciding to open the account at Buckingham Palace, so Equifax will have a file on her.
Legal basis? Legal basis?? What is this "legal basis" of which you speak? American corporations don't need no stinkin' "legal basis". They have the Marines, drones, B-52s, F-16s, napalm and white phosphorus.
And the alphabet soup.
Just be grateful they haven't disappeared you - yet.
I'd be curious on which legal basis they hold the data in the US.
I'd be equally curious about the legal basis on which they contacted Equifax in connection with me in the first place. By way of example, when I added broadband to my telephone account all those years ago it was all done over the 'phone and there was certainly no caveat that "we are going to discuss you with Equifax just to be on the safe side"; similarly I have no recollection of any similar warnings when we have changed energy supplier.
So never mind holding the data in the US; what is the basis of it being shared with another party in the first place without my clear informed consent? Do I sue Equifax with which I have no contract, or do I sue the organisations that shared information about me with Equifax?
"It also said that the “arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident” in response to US consumer concerns that finding out if they had been affected by the breach might mean foregoing participation in a class action lawsuit."
Say what again? I'm sure that's not the get-out-of-jail card you're looking for...
Assuming you mean House *of Commons* (not Representatives) then you're a bit behind the times.
The next 5 or so years of UK parliamentary time are devoted to a single subject.
Brexit.
And like a badly written program, on a badly written OS, Brexit has ALREADY STARTED to consume resources at an alarming rate. Just wait until every single organ of government is at 100%, and you can't even process a hardware interrupt.
I seem to recall the clause "we may contact credit reference agencies ..." at the bottom of some contracts which I took to mean "we'll check to see if you've got a dodgy financial history". At no point do I recall "we will give data to credit reference agencies which will be stored in a database outside the 'safe harbour' agreements.
To be honest, that one company can have so much personal data without the knowledge of the individual is damn scary ...
This post has been deleted by its author
A nightclub in Leicester Square London, (and others around the country with the same name) used to be next to the Empire cinema .
There are reports from the US that Equifax's "generous" offer of one year free after the breach was originally about even making money off the consequences as people were effectively signing up to a service which became payable in year 2. Of course, once that became public they quietly rolled that back, but those actions suggest they're not very sorry about the breach and its impact on customers.
"Scammers can now do identity theft of 144m people and get a few billion claiming to be them in the class action lawsuit."
No class action in the UK, here it will be "identity card or we don't know it is you" and some number number to remember along with your Nation insurance number.
That no real punishment will be applied to the industry and the companies we are forced to deal with is the main problem.
It would be nice to not have to tell you life history to untrustworthy strangers just to be able to drive to work but you are forced to deal with insurance companies or not drive. Although that youtube video of the chap that opted out of PACE was interesting. Sending back your DVLA documents stating "this is not a car", you still pay if you have an accident if is your fault but directly and you have the control of going to court or not.
Is that if it plays out, then a huge chunk of the British political class and civil service now has their data out in the wild. If they starr getting robbed by ID thieves, then maybe you will see some action against crooks, data aggregators and privacy invaders.
Pfft ......... these people you speak of (political class) don't need credit. They use dodgy accounts held in Bermuda along with Jimmy Carr. It's only us minions up to our eyeballs in debt that have their data in the hands of these types of companies.
I can't help but be glad a spotlight is being shone on these shoddy companies. They must cause misery for plenty of innocent souls.
16 years ago I applied for my first mobile phone contract - it wasn't extravagant, something like twenty pounds a month for some included minutes and texts. At the time I could have paid the entire 12 month contract from a single days earnings. But apparently I failed the credit check and was refused service. I actually did offer to pay the full contract up-front but was still refused (Thanks, Orange).
No-one could tell me 'why' I failed the credit check and I was only told I had to apply to three different companies to get hold of my credit records. Experian/Equifax were two of them.
I was astounded to find out they were legally allowed to charge me for the privilege of receiving the information they collated - and sold to others - about me.
Once I received said reports there was nothing negative on them at all. I always paid my credit card in full each month, never used an overdraft and yet these scoundrels had soured my good name.
For a mobile phone at the time it was just a minor annoyance and I've been on pre-pay happily ever after since then. But I imagine untold numbers of people are unfairly paying higher rates for essential utilities and insurances due to similar misinformation.
I'm sure some scoring goes on behind the scenes which might indicate bad risk. For example if someone whose only known job is to stack shelves in a supermarket runs a Ferrari then one has to ask the question as to where the money is coming from.
Governments should make a deal with the credit reporting companies that they can not refuse. As governments outside the USA rely primarily on fines in these situations, it would be appropriate for the fine to be in the billions of dollars, not hundreds of thousands. Law makers need to get a backbone and work across borders when cyber crimes are at the core of the issue. A few thousand dollars is not a deterrent and nor will it cover the damage it will do to the economy. The individual citizen impacted by security breaches never benefit from these fines. They are left to be victimized by criminals and have to bare the fallout and financial costs on their own.
Equifax will use the courts to shelter them from the fines, so the government(s) should offer them an out of court settlement (to appease the courts). Pay the fine or agree to all of the government's non-negotiable conditions that will be put in place clean up the mess they created.and meet new regulations for the industry. The fine will be incrementally reduced as each condition is met. The response to Equifax should make it clear that new laws and regulations that result from this breach will include criminal charges and mandatory jail time for company executives. Co-operate or face the consequences.
The agreement should be globally enforced. Under the FBI and Homeland Security, the USA could work with other countries to create a framework that would not allow private companies to drive the solution when cyber crime puts a country's economic stability at risk.
That link in the article to "Equifax’s dedicated breach-handling site" takes you to a site that is only for people in the US (asks for your social security number, required field). So far, I have not been able to find any way of credit freezing your record on-line at Equifax UK. Has anyone else found it?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
