Articles Posted in Internet Law

Equifax presents an interesting question to consumers. Somehow, an entity that no consumer may have had an actual interaction with has their information, and had leaked it out onto the world. For example, names, phone numbers, credit card numbers, social security numbers, addresses, e-mails were collected and released to unauthorized individuals. They may not have given consent, at least none they could remember. Yet, the information was with Equifax. How did the breach occur? What exactly is Equifax? How did it obtain your personal information? And perhaps most importantly, what comes next?

What is Equifax?

Equifax is a credit reporting agency. The purpose of entities like Equifax (as well as Experian and TransUnion) is to collect and share credit information on consumers. The credit reporting agency tells businesses which consumers are worthy of credit. Effectively, it is a way to outsource due diligence that may otherwise be more costly or time consuming for the business to perform on its own.

Now that we’ve discussed Catfishing as a scam, let’s go into further detail regarding the motives.  Like any scam, there must be some benefit to the scammer. This benefit is the primary motive for anyone to commit a catfishing scam.  Previously, we mentioned that among other things, the perpetrator may ask for photographs, or for some information to “verify” a person’s age, or to enable their transportation to be “closer” to their target. So, what are the major risks to these actions? What exactly does a catfishing perpetrator want to get from a victim? How might the information provided be used against you?

For Financial Information

The more dangerous elements of catfishing tend to prompt for, as we discussed before, a financial component. This would include asking for money–to get transportation to the person’s location, clothing, or whatever reason the scammer may present–or for credit card information. In the case of the latter, this is usually done in conjunction with asking the individual to sign up through a different, new dating site compared to what the potential victim may be using, and generally to “verify” the age or identity of the person involved.

In March 2017, the WannaCry ransomware attack occurred which was believed to be one of the largest ransomware attacks in history. Discussions of this past attack and who should take the blame has been previously discussed in our blog and newsletter. Now, just a few months later there has been another major cyberattack. At the end of June 2017, another large ransomware attack occurred, which has been called Petya. This ransomware attack is similar to WannaCry in that it locks up the computer files using encryption and demands a ransom in order to unlock the files. This ransomware also takes advantage of the vulnerability within the Microsoft Windows computers that have not yet updated to the latest software.

This attack began in Europe and spread to the United States. The North American Treaty Organization (NATO) says that a “state actor” was behind the Petya ransomware attack. NATO also stated that there is a possibility that the attack was not done by a state actor, but that it would have been done by a non-state actor who had the approval and support from another state. They believe this because Petya was very complex and expensive to run.  According to NATO, if it is found that Petya was done by a state actor, then it would mean that this cyberattack could potentially be viewed as an act of war.

The Petya attack has hit over 12,000 different devices in 65 countries. More than 30% of the institutions that were affected by this attack were financial organizations.  Industrial organizations, such as, utilities, oil and gas, transportation, and other companies were also targeted and it is believed that they made up half of the targets.

Identity theft is an epidemic impacting people across America. During 2016, an estimated 15.4 million consumers experienced some kind of identity theft. This is an increase from 13.1 million in 2015. Another staggering statistic is that 1 in every 16 adults in the United States is a victim of identity theft.

This increase in identity theft notwithstanding the fact that 2016 was the first year that retailers were forced to accept EMV chip cards. The belief was that by switching to these EMV chip cards it would almost entirely eliminate card cloning, which is a major type of identity theft.  Instead of lessening the amount of credit card fraud this switch has made criminals move away from card cloning and into different types of fraud. More criminals are starting to make online purchases where swiping or inserting a physical card is no longer necessary.

Over the past few years, we have seen numerous data breaches. Data breaches have been hitting financial, health, commercial, government, and education institutions. These breaches have ranged from password management services like LastPass, the OneLogin security breach, and Target security breach.  All of these different breaches compromise our data and our identity. The above companies are just a few that have been hit by a security breach.