Cyber Risks · Krebs on Security

Equifax Reopens Salary Lookup Service

Summary: Equifax reopened The Work Number, its TALX division's salary and employment verification portal, eight days after taking it down hours following an October 8 report on how the site was accessed. Access required an employer code, a user ID that is usually the employee's Social Security number, and a PIN that in most cases was an eight-digit date of birth, yielding at least a decade of salary history and a list of prior requesters.

What you should know: Equifax told National Mortgage News that restored users must re-authenticate and set a unique PIN, yet the reporter and a source still reached records through a default PIN built from birth year and SSN digits plus knowledge-based questions answerable from sites like Zillow and Spokeo. The same breach notification confirmed card data was stolen from people who had used it at Equifax to request a freeze or credit report.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related