Forest Global Training Partners

Cyber Risks · Krebs on Security

Name+DOB+SSN=FAFSA Data Gold Mine

Summary: KrebsOnSecurity reported that the FAFSA login page let a visitor enter a student's first and last name, date of birth and Social Security Number to reach a record containing almost 200 data elements, including parents' SSNs, 2015 adjusted gross income, tax figures and bank and investment balances. The Education Department disputed the account, saying less sensitive fields may be viewable with SSN and date of birth but financial data requires a username and password or a save key, and Krebs noted the IRS disabled an automated FAFSA data retrieval tool in March 2017 after identity thieves used it to obtain applicant families' adjusted gross income for tax refund fraud, restoring it October 1 with added authentication and masking.

What you should know: The static details that unlocked this record - name, date of birth, SSN - sell for about $4-5 in Bitcoin on open and Dark Web sites, and the IRS already found thieves pulling FAFSA income data to file fraudulent refunds.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related