Experian is at the center of another data breach involving its own records – this time it sold customer data to an ID theft ring based in Vietnam. Brian Kerbs has been investigating an underground ID Theft service called Superget.info, “a fraudster-friendly site that marketed the ability to look up full Social Security numbers, birthdays, drivers license records and financial information on millions of Americans.” After some weeks of investigating, Kerbs was able to track down the source of some of that data, Experian.
“According to Martin, the proprietors of Superget.info had gained access to Experian’s databases by posing as a U.S.-based private investigator. In reality, Martin said, the individuals apparently responsible for running Superget.info were based in Vietnam.”
“The issue in my mind was the fact that this went on for almost a year after Experian did their due diligence and purchased” Court Ventures, Martin said. “Why didn’t they question cash wires coming in every month? Experian portrays themselves as the data breach experts, and they sell identity theft protection services. How this could go on without them detecting it I don’t know. Our agreement with them was that our information was to be used for fraud prevention and ID verification, and was only to be sold to licensed and credentialed U.S. businesses, not to someone overseas.”
You can read the full report on KerbsonSecurity: Experian Sold Consumer Data to ID Theft Service
Another concern that was pointed out by Ars Technica
“Experian also sells its own line of services for preventing identity theft. That means the company was in a position to profit not only from the data it reportedly sold to underground service Superget.info but also from the demand the underground site created for Experian’s credit-monitoring and other identity theft protection services.”
You can read Ars’ full article here: Can we trust the data brokers who store our most intimate private details?