{"id":28849,"date":"2023-01-10T00:43:46","date_gmt":"2023-01-10T00:43:46","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/10\/identity-thieves-exploit-security-flaw-to-steal-credit-reports-from-experian\/"},"modified":"2023-01-10T00:43:46","modified_gmt":"2023-01-10T00:43:46","slug":"identity-thieves-exploit-security-flaw-to-steal-credit-reports-from-experian","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/10\/identity-thieves-exploit-security-flaw-to-steal-credit-reports-from-experian\/","title":{"rendered":"Identity thieves exploit security flaw to steal credit reports from Experian"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Credit reporting company Experian plc is in the news for the wrong reasons again, with a report claiming that identity thieves exploited a security weakness on its website to obtain credit reports.<\/p>\n

KrebsOnSecurity reported<\/a>\u00a0today that identity thieves are successfully exploiting the Experian website to obtain credit reports by using a person\u2019s name, address, birthday and Social Security number. The security flaw was first detected by a security researcher in Ukraine who discovered the method after spending time on Telegram chat groups dedicated to exploiting compromised identities.<\/p>\n

The Experian website ostensibly required several questions to be answered to obtain a credit report, but the identity thieves discovered that they could trick Experian into giving them access to credit reports. Obtaining access was as simple as editing the address displayed in the browser URL bar at a specific point in the identity verification process.<\/p>\n

Brian Krebs tested the method with his credit report and found it worked, \u201ceven though Experian said it couldn\u2019t tell that I was actually me.\u201d Dumbfounded by the result, Krebs asked a trusted security source to try the method to recreate his findings and the expert did.<\/p>\n

Krebs shared his findings with Experian on Dec. 23 with a confirmation that the email had been received on Dec. 27. At some point between those two dates, Experian changed its code to prohibit unconfirmed access to credit reports.<\/p>\n

How long this method was being exploited by identity thieves is unknown, nor is the number of potential credit reports stolen, but the implications are clear. Credit reports provide a rich trove of data that can be exploited in multiple ways, from phishing to extortion and just about any scam that utilizes personal information.<\/p>\n

This is not the first time Experian has made headlines for security issues and given its history. In 2021<\/a>, a security researcher uncovered an unprotected application programming interface that exposed the credit scores of almost every person in the U.S. Further back in 2015<\/a>, hackers stole personal information belonging to 15 million Americans.<\/p>\n

Experian is also not alone in the credit reporting industry for data leaks and hacks. Its main competitor Equifax Inc. was hacked in 2017<\/a>, resulting in a congressional inquiry<\/a> and a $700 million lawsuit settlement<\/a>.<\/p>\n

That yet another credit reporting agency has been exposing data raises questions about how the industry is being regulated.<\/p>\n

\u201cThe credit bureaus are poorly regulated, act as if they are above the law and have thumbed their noses at Congressional oversight,\u201d Senator Ron Wyden told Krebs. Wyden added that the U.S. Federal Trade Commission and the Consumer Financial Protection Bureau must do more to protect Americans from credit bureaus.<\/p>\n

Photo: Experian Thailand<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n