topic Re: I finally did it. in General Credit Topics

I finally did it.

Aim_High — Sun, 08 Sep 2024 21:37:58 GMT

Okay, I admit I'm spooked. For years, I thought about freezing my credit reports and miscellaneous parts of my identity has been posted on the dark webz. I was concerned, but not overly concerned. I keep tabs on my report and get alerts on credit report changes through many sources including Experian and numerous lenders.

Last night, I was reviewing my AMEX credit reporting for dark web activity. I don't scour all my various credit report sources regularly, but I do sometimes. I was alarmed to see three new entries with my full name, Social Security Number, Date of Birth, and three addresses I have used in the past 25 years. One of my primary email addresses has also been released in several data breaches. The combination of aggregated data made me almost literally sick to my stomach.

Apparently, I'm part of the National Public Data Breach that was just publicized which could be impacting up to 3 BILLION consumers.

In the past 24 hours, I have frozen all three credit reports. I had accounts at two of the bureaus, and created a third. I had to find my login information and make sure it was current.

Fortunately, I have separate email address I use for financial data which appears not to have been leaked.

I found a free link to check your exposed data in the leak and was shocked to find myself listed (14) times including my current street address, current mailing address (PO Box which I used for financial data security), SSN, full name, and all prior addresses from recent history. If you want to check yours, go to: https://npd.pentester.com/

I'm planning to change my financial data and email passwords again, as it's been awhile since I did that. I'm also debating whether changing my phone number, mailing address, and email address would be a good idea. The tech industry needs to come up with better safeguards to prevent the ability of cyber thiefs to access our private data and perpetrate fraud. This is becoming far too common and dangerous.

Re: I finally did it.

CreditCuriosity — Sun, 08 Sep 2024 22:28:45 GMT

Always have your credit locked and monitored and with most companies best practices as an example you should change you password every 3 months approximately although a big pain. Big companies have these measures for a reason just like a regular person should be proactive as well. Your data has been out in the dark web, etc for quite some time due to all the data breaches the best thing you can do is keep your credit locked and change your password and for personal safety whatever you deem is needed as your address and phone can easily be found as well. Sucks we have to live this way but it is what it is I suppose and the times we live in.

Re: I finally did it.

pizzadude — Sun, 08 Sep 2024 22:28:43 GMT

Agree that it's unfortunate that we can't trust companies to retain "our" data and secure it, but the current regulatory environment here in the US doesn't provide customers much control over this ( if any ) and there are few / de minimus penalties when breeches occur, so there isn't really much pressure on companies to take the appropriate measures and have controls in place.

Re: I finally did it.

Aim_High — Sun, 08 Sep 2024 23:38:24 GMT

I also just renewed my passwords at IRS.gov and Social Security (SSA.gov).

I think those may be the two most important government websites to secure for fraud purposes.

I authorized and created a PIN to file my income taxes since there has been fraud related to that in recent years.

And I verified there were no social security benefits paid or applications pending by selecting the "Verification Letter" link on my dashboard.

Re: I finally did it.

markbeiser — Mon, 09 Sep 2024 00:49:47 GMT

I got alerts last week about stuff that included some old addresses too, as well as email, SSN, etc..
It would be nice if the National Public Data breach lead to some legislation stomping on the faces of some of these legal data brokers that keep having breaches, but probably won't.

Credit reports were already locked, probably should change some passwords.
I'm migrating all of my financial stuff to new email addresses.
I have my own domain, so can create as many new addresses as I want.

Re: I finally did it.

JoeRockhead — Mon, 09 Sep 2024 13:10:08 GMT

I was part of this latest data breach where my cell phone number was released. My reports are all frozen but about a week ago, or so I get a phone call from a blocked (private caller) number.

Her: (speaking broken English) Hello, I'm agent Sarah Johnson from U.S. Customs and Border Patrol, your phone number has been linked to an illegal shipment from Mexico we intercepted. Were you expecting a shipment from Mexico sir?

Me: No

Her: Well sir, we'll need to verify some information. Are you prepared to help us verify that information?

Me: No

Her: Sir, this is a serious matter. If you're refusing to cooperate we'll have no choice but to issue a warrant for your arrest. Are you going to cooperate or not?

Me: No I'm not going to cooperate so please send the agents, and send that package with them as I have, you know... customers anxiously awaiting it's arrival.

Her: hangs up phone

In addition to trying to outright steal identities to steal money, they'll also use this information to try to scam people out of money by either gaining more information from them directly to steal from you, or to get you to willingly give them money.

Re: I finally did it.

SeaProbe — Mon, 09 Sep 2024 16:41:11 GMT

@Aim_High wrote:
I'm planning to change my financial data and email passwords again, as it's been awhile since I did that. I'm also debating whether changing my phone number, mailing address, and email address would be a good idea. The tech industry needs to come up with better safeguards to prevent the ability of cyber thiefs to access our private data and perpetrate fraud. This is becoming far too common and dangerous.

Changing phone number, email, and so on will only help until the next breach is revealed. As the saying goes "there are two kinds of companies. those who know they've been hacked and those who don't yet know they've been hacked."

With that said, there are some things you can do that will harden you against fraud. First, strong and unique random passwords for each site. A trusted password manager such as Bitwarden is invaluable for this. Second, use two-factor whenever available, and if possible the one-time password option (requires a password manager or google authenticator). Third, start using passkeys for sites that offer them.

Re: I finally did it.

TrapLine — Mon, 09 Sep 2024 19:38:29 GMT

@JoeRockhead wrote:
I was part of this latest data breach where my cell phone number was released. My reports are all frozen but about a week ago, or so I get a phone call from a blocked (private caller) number.

Her: (speaking broken English) Hello, I'm agent Sarah Johnson from U.S. Customs and Border Patrol, your phone number has been linked to an illegal shipment from Mexico we intercepted. Were you expecting a shipment from Mexico sir?
Me: No
Her: Well sir, we'll need to verify some information. Are you prepared to help us verify that information?
Me: No
Her: Sir, this is a serious matter. If you're refusing to cooperate we'll have no choice but to issue a warrant for your arrest. Are you going to cooperate or not?
Me: No I'm not going to cooperate so please send the agents, and send that package with them as I have, you know... customers anxiously awaiting it's arrival.
Her: hangs up phone

In addition to trying to outright steal identities to steal money, they'll also use this information to try to scam people out of money by either gaining more information from them directly to steal from you, or to get you to willingly give them money.

Com'mon Joe ... the caller is just trying to earn a living?

Re: I finally did it.

TrapLine — Mon, 09 Sep 2024 19:46:32 GMT

A little side trip ... two bank systems where I live were both off line and dealing with some vary strange happenings (you could access the bank externally) but the internal staff had no phones, computer access or software to use and it took them three week days to fix). The other bank had strange problems with part of the banking software ... really strange and it took them three days. No one can admit what happened for security reasons but strange. This all happened last week.

As an extended side trip, external access to various utilities is getting nebulous due to the ramifications of software intruders. Presently, I sit on a utility board and it is almost to the point of no external access. Will need to use a "pony express" rider to carry the needed information around.

Finally the modern age got us

Re: I finally did it.

Aim_High — Mon, 09 Sep 2024 19:51:56 GMT

@JoeRockhead wrote:

Me: No I'm not going to cooperate so please send the agents, and send that package with them as I have, you know... customers anxiously awaiting it's arrival.

LMAO ... That's awesome @JoeRockhead !!!

Re: I finally did it.

Aim_High — Mon, 09 Sep 2024 20:05:04 GMT

@TrapLine wrote:
A little side trip ... two bank systems where I live were both off line and dealing with some vary strange happenings (you could access the bank externally) but the internal staff had no phones, computer access or software to use and it took them three week days to fix). The other bank had strange problems with part of the banking software ... really strange and it took them three days. No one can admit what happened for security reasons but strange. This all happened last week.

As an extended side trip, external access to various utilities is getting nebulous due to the ramifications of software intruders. Presently, I sit on a utility board and it is almost to the point of no external access. Will need to use a "pony express" rider to carry the needed information around.

Finally the modern age got us

Just my personal opinion, @TrapLine.

Re: I finally did it.

JoeRockhead — Mon, 09 Sep 2024 20:13:51 GMT

I have a problem @Aim_High. I used to just hang up on spam/scam callers immediately, and get really aggravated they were calling. More recently, I've found myself becoming increasingly disappointed when there isn't a live person to have a "conversation" with... Those always end with them hanging up on me. So much more enjoyable... Bonus points if they get so aggravated they use foul language before ending the call.

Re: I finally did it.

Aim_High — Mon, 09 Sep 2024 20:14:41 GMT

@SeaProbe wrote:
Changing phone number, email, and so on will only help until the next breach is revealed.

True, @SeaProbe. But at least it keeps you one step ahead and makes some of that data worthless to hackers.

With that said, there are some things you can do that will harden you against fraud. First, strong and unique random passwords for each site. A trusted password manager such as Bitwarden is invaluable for this. Second, use two-factor whenever available, and if possible the one-time password option (requires a password manager or google authenticator). Third, start using passkeys for sites that offer them.

I have some good passwords and have minimal overlap-reuse unlike some consumers, but I know I don't change them often enough. (And yes, I know you shouldn't reuse them at all; I have just chosen to compartmentalize them or make various modifications to the root passwords.) I've resisted the password manager applications since I don't like having my access tied to a program, having it generate passwords that I can't keep up with or remember, trusting the password manager itself not to be compromised, and locking myself into an indefinite subscription once I begin using it. But after reading up on the topic, I'm coming to the realization that a password manager may be a necessary evil, unfortunately. Too many websites with logins and too much to individually change and manage to the degree of complexity it requires for the best security.

Re: I finally did it.

TrapLine — Mon, 09 Sep 2024 20:14:48 GMT

Aim_High

Some others to look into:

Lexis Nexis

ARS IDA

NCTUE (telephone)

MIB (Medical Reports)

INNOVIS

Early Warning Systems (Note they pass themselves off as a non-credit bureau) so no ability to freeze

A few that you can have stolen. You already noted the IRS and Social Security which September 2024 are mandating a switch to LOGIN.GOV or ID.me with no exceptions. The VA already made the transition.

Another day brightner ... had check information stolen at the Chicago IL Federal Reserve Processing Center and charges of several hundred dollars were made to my account for 900 calls. Caught the person and the Feds asked if I wanted them prosecuted and I signed the legals and fraud became part of their life style. So ... o ... the return to paper checks is not the security we might suspect?

Re: I finally did it.

TrapLine — Mon, 09 Sep 2024 20:21:41 GMT

Aim_High

Something that I find really distressing is getting a notice from my former University. No involvement since 1968 and I get a notice my information was stolen?

For real? Must be flying saucers?

Re: I finally did it.

Aim_High — Mon, 09 Sep 2024 20:30:50 GMT

@TrapLine wrote:
Aim_High

Some others to look into:

Lexis Nexis
ARS IDA
NCTUE (telephone)
MIB (Medical Reports)
INNOVIS
Early Warning Systems (Note they pass themselves off as a non-credit bureau) so no ability to freeze

A few that you can have stolen. You already noted the IRS and Social Security which September 2024 are mandating a switch to LOGIN.GOV or ID.me with no exceptions. The VA already made the transition.

Another day brightner ... had check information stolen at the Chicago IL Federal Reserve Processing Center and charges of several hundred dollars were made to my account for 900 calls. Caught the person and the Feds asked if I wanted them prosecuted and I signed the legals and fraud became part of their life style. So ... o ... the return to paper checks is not the security we might suspect?

Yes, @TrapLine, just like the credit report freeze I have long considered getting copies of some of my personal data at some of those other websites. Last night, I created an account at CHEX Systems and considering a lock on new banking accounts. I requested a Lexis Nexis report but I hesitate to ask them to purge my data since I wonder if that is unnecessary for anyone using them for legitimate purposes, and whether it might cause me some future issues.

On the same topic (National Public Data breach) but on a different sub-forum, @Anonymous posted many links including one to a REDDIT forum about the same topic. Members had posted a very long and inclusive list of other bureaus to consider checking or locking, I believe including all the ones you mentioned above. See THIS LINK to go to REDDIT.

Re: I finally did it.

Aim_High — Mon, 09 Sep 2024 20:34:59 GMT

@JoeRockhead wrote:
I have a problem @Aim_High. I used to just hang up on spam/scam callers immediately, and get really aggravated they were calling. More recently, I've found myself becoming increasingly disappointed when there isn't a live person to have a "conversation" with... Those always end with them hanging up on me. So much more enjoyable... Bonus points if they get so aggravated they use foul language before ending the call.

Lol @JoeRockhead. You got right to the point (and tipped her off by your response) but some of the funniest responses I've read about is where someone plays along for a long time, gives false information, delays the conversation, and basically just wastes their time until they get frustrated or realize they are being played too.

Re: I finally did it.

TrapLine — Tue, 10 Sep 2024 20:20:39 GMT

Aim_High

As to Lexis Nexis ...

I noticed and it was mentioned recently here on MF that many of my 52+ pages were addresses with a number that was different, a letter in a street name that was off. In considering trying to clean all of the truly straight reporting errors I said "Nutz" and let it go.

As long as it did not affect my ability to conduct business ... so be it. Yes, I could reduce my report by a massive number of pages but the time and effort did not seem worth it. Besides it is costing them web space and my heart is bleeding!

Re: I finally did it.

TrapLine — Tue, 10 Sep 2024 21:16:29 GMT

@Aim_High wrote:
@TrapLine wrote:
Aim_High

Some others to look into:

Lexis Nexis
ARS IDA
NCTUE (telephone)
MIB (Medical Reports)
INNOVIS
Early Warning Systems (Note they pass themselves off as a non-credit bureau) so no ability to freeze

A few that you can have stolen. You already noted the IRS and Social Security which September 2024 are mandating a switch to LOGIN.GOV or ID.me with no exceptions. The VA already made the transition.

Another day brightner ... had check information stolen at the Chicago IL Federal Reserve Processing Center and charges of several hundred dollars were made to my account for 900 calls. Caught the person and the Feds asked if I wanted them prosecuted and I signed the legals and fraud became part of their life style. So ... o ... the return to paper checks is not the security we might suspect?
Yes, @TrapLine, just like the credit report freeze I have long considered getting copies of some of my personal data at some of those other websites. Last night, I created an account at CHEX Systems and considering a lock on new banking accounts. I requested a Lexis Nexis report but I hesitate to ask them to purge my data since I wonder if that is unnecessary for anyone using them for legitimate purposes, and whether it might cause me some future issues.

On the same topic (National Public Data breach) but on a different sub-forum, @Anonymous posted many links including one to a REDDIT forum about the same topic. Members had posted a very long and inclusive list of other bureaus to consider checking or locking, I believe including all the ones you mentioned above. See THIS LINK to go to REDDIT.

Good info on your "THIS LINK" and the IRS Protection Pin (did not know)!