Forest Global Training Partners

Cyber Risks · Krebs on Security

Experian Lapse Allowed ID Theft Service Access to 200 Million Consumer Records

Summary: Vietnamese national Hieu Minh Ngo pleaded guilty to running the identity theft service Superget.info, which he used to obtain access to personal and financial data on more than 200 million Americans through a contract with Court Ventures, a company Experian acquired in March 2012. Ngo's service attracted more than 1,300 customers who paid at least $1.9 million between 2007 and February 2013 and made roughly 3.1 million queries over an 18-month period, and Experian continued selling him data for almost ten months after the acquisition until the U.S. Secret Service notified the company.

Bottom line: Experian's own government affairs executive told a Senate committee the company lacked the due diligence to detect Ngo before or after buying Court Ventures, and it learned of the scheme only when the Secret Service came to it - meaning 200 million consumers' records sat behind a contract nobody vetted for nearly a year after the acquisition closed.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related