Feeds

Hackers crack Texan bank, Experian credit records come flooding out

Names, numbers, finances, EVERYTHING... and they weren't even customers

3 Big data security analytics techniques

Hackers managed to get login credentials for Experian's credit scoring reports after they broke into the systems of Abilene Telco Federal Credit Union last year, it has emerged.

Crooks gained access to the west Texan bank's systems after hacking into an employee's computer. The September 2011 breach allowed the hackers to get their hands on login credentials for the bank's account with Experian, exposing the details of millions to potential snooping in the process.

A subsequent audit revealed that the attackers had used the compromised account to download credit reports on 847 people, obtaining Social Security numbers, dates of birth and financial data on individuals across the US who had never held an account with the small Texan bank.

The breach is one of 86 incidents that have exposed data stored by credit reference agencies (Experian, Equifax and TransUnion) to snooping since 2006. Hackers have obtained this information not by going after the credit reference agencies directly but by targeting banks, auto-loan firms, data brokers, police departments and other organisations that have access to the sensitive information, which can be used by identity thieves to establish lines of credit under false names.

In total, more than 17,000 credit reports have been exposed by breaches at third-party firms over the last six years, according to an investigation by news agency Bloomberg. The figures come from breach notification letters unearthed by a privacy advocate who calls themselves “Dissent Doe”, and wishes to preserve their anonymity.

Most of the exposed records (15,500 credit reports) came as a result of 80 breaches against Experian’s database. Equifax was hit four times, resulting in the exposure of more than 1,200 reports. TransUnion’s was pwned twice, exposing 500 reports to unauthorised snooping, according to the DataLossDB.org website. The incidents all involved the theft of passwords and usernames from the credit bureaus' customers. Dissent Doe is campaigning for a national register of breach reports.

Experian blamed malware attacks against its customers for a majority of the breaches.

“We continue to invest in the security systems we have in place to protect our clients and consumers,” an Experian spokesman told Bloomberg. “Of course, the first line of defence lies with end users who are obligated to manage and protect their credentials, which in all these instances were compromised through malware that infected their hardware and other illegal means.”

Jay Foley, a partner with the consulting firm ID Theft Info Source, told Bloomberg that the volume of seriousness of the breaches raises concerns that credit bureau haven't invested enough in anti-fraud technologies capable of drawing attention to suspicious behaviour by their clients.

The wide range of data held by credit reference bureaus has become the focus of a Congressional investigation over recent weeks. ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.