Identity Thieves Bypassed Experian Security to View Credit Reports
Summary: Until the end of 2022, Experian's website let anyone skip its multiple-choice identity verification questions and view a consumer's full credit report by editing the URL from "/acr/oow/" to "/acr/report" after applying through annualcreditreport.com, needing only a name, address, birthday and Social Security number. KrebsOnSecurity confirmed the method on his own file and a colleague's, shared it with Experian on Dec. 23, 2022, and by the time Experian acknowledged receipt on Dec. 27 the flaw had been patched, with no word on how long it was exploitable.
What you should know: The only barrier between an identity thief and a full credit file was a set of knowledge-based authentication questions drawn from public records, and the URL edit bypassed even those - so a name, address, birthday and SSN were enough to pull anyone's report.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026