Robert Siciliano and technology lawyer Mark Grossman discuss the Equifax breach that exposed 143 million people's data. They cover credit freezes, monitoring services, and whether Equifax's terms of service shield the company from liability.
Chapters
—in the S&P. Its shares struggling since revelations that hackers have gained access to 143 million people's personal information. We heard that news first around this time yesterday. Shares down 13.5% in the session today. In today's day and age, is there anything we really can do to protect ourselves from identity thieves? Joining me now is Mark Grossman. He's technology lawyer and author here with us at Post 9. And Robert Siciliano, who's a cybersecurity expert with Hotspot Shield. Welcome to you both, and Robert, I'll just start with you because, I mean, it's tricky here. So basically an agency whose job it is to know everything about us gets hacked. This doesn't feel to me like I need to worry about whether I'm changing my passwords enough. How would I protect myself against something like this? And according to them, I am potentially affected.
Yeah, definitely. I actually am a victim of this crime as well. I researched my information on the EquifaxSecurity2017.com address and there it popped up that they want me to invest in their credit monitoring service, which, you know, is kind of funny that they're offering credit monitoring where they got breached. Uh, the best thing to do here is to engage in what's called a credit freeze. A credit freeze locks down your social on your credit report, preventing anyone from opening up any new lines of credit via your social and your credit report. So a credit freeze really is the best way to go.
Okay, so a credit freeze, again, you're educating me here. If I do a credit freeze, Robert, what do I do? I go to a bank? Who do I initiate that with?
Perfect, great question. So if you go to all of the 3 major credit bureaus, Experian, TransUnion, Equifax, search the term credit freeze on the site. That way you'll get to the page in which you administer a credit freeze. So on their website, you go on, you plug in your information along with your social, which it's okay to do, And once you do that, they'll provide you a username and a password. So your credit is now frozen across the board. And when you want to get credit, let's say you're gonna go to an automobile dealership, they're gonna check your credit. You wanna thaw your credit prior to going to the dealership and then just for a day or two, and then it refreezes automatically and it does not negatively affect your credit scores.
What if you're in the process of buying a house, for example? I mean, there's a lot of things here to unpack. No problem. Mark, let me just bring you in for a moment because one of the interesting wrinkles that I'm reading about on CNBC's website right now is that if you were— if you entered your information into this Equifax website they put up to try to help people to figure out if you were affected, you could potentially be signing away your right to litigation.
Absolutely true. There's an inherent ambiguity in the online terms and conditions that Equifax has in connection with the service they're offering for free. You click I accept, and it is conceivable that you've given away remedies including to class action. It's outrageous. Is this clear from the language? No, it isn't. It's an ambiguity. If I were negotiating this agreement on behalf of a large company in a deal with Equifax, I'd ask them to clarify it. I would call upon the CEO of Equifax to just make the ambiguity go away. He can wave a magic wand, change the language of this. If his lawyers can't do it, call me. I'll be happy to do it.
I think the CFPB was also today trying to sort of push the company to not restrict this for consumers.
I mean, I've been wondering, just as a, as a broader legal matter, Mark, what is a company's responsibility in terms of putting up defenses to try to prevent an incursion like this? I mean, it seems to be no standard on that. There's no standard.
It's vague. Best practices, best of breed, we use words like that. But here's the problem. This is like the firehouse burned down. They are the credit reporting agency. They have all this data. There's already a class action filed in connection with this thing. And basically, the simplistic argument of this complaint is they were more concerned with their profits than spending money on proper cybersecurity. But here's the problem. It's a reality. No matter how much they spent on cybersecurity, there are no guarantees. This is like burglary. We don't like it. It hurts, but it's not going away. It's a part of life.
And so, Robert, you mentioned a moment ago that credit freeze is one thing people can do. Do you think the biggest risk from this hack would be something like that? We know obviously how to deal. Someone takes your credit card. Everybody's been through that. What are some of the other things you need to be watchful for?
So always be aware of activity on your credit cards, which a couple of hundred thousand credit cards were compromised in this particular breach as well. What I do is I sign up for alerts and notifications via my card company and bank's website, which means that every time there's a charge, every time there's a withdrawal, I get a text message or an email alerting me to that fact. So I know all of my charges in real time. That keeps me fully attuned. Every time. No problem. This way I know if my wife has just made a large charge, I get a text message and I'm aware of it when it happens, and I can contact her to make sure that that was her that did it.
I think that's why you're really doing it. You want to know You say, I don't think so. That looks like a pretty big charge. All right, guys, thank you. Robert Siciliano, Mark Grossman, very much appreciate it. Just really— thank you.
