Forest Global Training Partners

Cyber Risks · Krebs on Security

Experian, You Have Some Explaining to Do

Summary: Two KrebsOnSecurity readers reported that their Experian accounts were hijacked and their email addresses changed by someone who re-signed up using the victims' personal information and a different email address, despite both having used password managers for strong, unique passwords. A KrebsOnSecurity reproduction showed Experian changed the email on file after only an SSN, date of birth, and multiple-choice questions drawn largely from public records, without confirming the new address or getting approval from the old one, and then let the new PIN and secret questions replace the originals.

Bottom line: Experian's own statement calls these isolated incidents, but the reporter's test reproduced the takeover, and the account changes also unfroze a credit file that was supposed to be frozen - the exact protection consumers are told to rely on. Researcher Nicholas Weaver notes the fraud cost lands on lenders, who can choose Equifax or TransUnion instead.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related