Forest Global Training Partners

Cyber Risks · Krebs on Security

Class Action Targets Experian Over Account Security

Summary: A class action filed July 28, 2022 in California Central District Court alleges Experian violated the Fair Credit Reporting Act by letting identity thieves take over existing accounts through re-registration using the victim's personal information and a different email address, without first verifying the change with the existing account holder. KrebsOnSecurity reproduced the hijack on its own account using its SSN, date of birth, and answers drawn largely from public records, after which Experian changed the email on file, sent an alert to the old address, and prompted new secret questions and a new PIN.

Why it matters: Experian's own statement called the reported hijacks 'isolated incidents of fraud,' yet Krebs reported hearing from several more readers who had unique, password-manager-generated credentials and still lost their accounts. The control that failed here is account recovery, not password strength, and it sits in front of the credit file that lenders use to decide loans and jobs.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related