Experian’s Credit Freeze Security is Still a Joke
Summary: A Sacramento software engineer's Experian credit freeze was thawed without authorization after someone used the site's "request your PIN" feature, then applied for new credit in his name at the same Washington state address thieves had used before. KrebsOnSecurity found the PIN retrieval process asks for address, Social Security Number and date of birth, then poses five questions of which only one concerned information specific to the consumer's credit history, and Experian's free accounts offer no multi-factor authentication.
What you should know: The PIN that stands between an identity thief and a thawed credit file can be retrieved with data already exposed in the Equifax breach and others, and the multi-factor authentication that would blunt it is reserved for subscribers paying $14.99 to $24.99 a month for CreditLock.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026