It has been over two years since Equifax disclosed a data breach which exposed the details of nearly 150 million Americans. The breach is ranks as one of the worst security failures. now, new details have out showing how careless Equifax may have been at the time.
A class action lawsuit (PDF) filed in the United States District Court for the Northern District of Georgia, Atlanta Division, alleges Equifax used the default username “admin” to protect a portal used to manage credit disputes. Same goes for the password at the time of the breach it too! It was still the default “admin,” according to the lawsuit.
“This portal contained a vast trove of personal information. According to cybersecurity experts, these shortcomings demonstrated ‘poor security policy and a lack of due diligence’. Equifax’s authentication practices fell short of the data security standards, which recommend the use of multi-factor authentication,” the lawsuit states.
The class-action lawsuit says using the default password “is a surefire way to get hacked.” It’s certainly boneheaded, if in fact Equifax never bothered to change either the username or password, as the lawsuit alleges.
Other claims of security lapses are made in the lawsuit as well, each representative of a company that “allegedly failed to take some of the most basic precautions to protect its computer systems from hackers.”
According to the lawsuit, a breach of this size “would not have occurred if Equifax had implemented better monitoring systems.”
Equifax is one of three major US credit monitoring bureaus. When first disclosing the breach, Equifax said it impacted around 143 million Americans. A year later, however, Equifax said it discovered at least 2.4 million more names that may have potentially been affected as well.
