Experian Glitch Exposing Credit Files Lasted 47 Days
Summary: Identity thieves bypassed Experian's identity verification by editing the address in the browser URL bar at a specific point in the process, reaching any consumer's full credit report with only a name, address, date of birth, and Social Security number. Experian confirmed the weakness persisted from Nov. 9 to Dec. 26, 2022, roughly seven weeks, and notified Krebs by mail about a month after he reported it on Dec. 23.
Bottom line: The entire barrier between an identity thief and a full credit file was four data points and one URL edit, and the bureau stayed silent for a month after being told. For seven weeks, the only credential required to pull anyone's report was information already circulating in breach dumps.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026