Equifax Fixes Woefully Insecure PINs Issued To Hack Victims Attempting To Freeze Credit Reports

Equifax is still trying to dig its way out from under the bad press and an angry public after a hack of its database gave access to personal information on 143 million Americans. Equifax offered those affected by the security breach the ability to lock their credit reports to prevent the stolen information leaked in the hack from being used to open new credit in their names. However, things just keep going from bad to worse for Equifax (and everyone in general).

Equifax used a PIN that "protected" each user's credit report to prevent the information from being used, but the PINs were reportedly generated in such a way that they were left vulnerable to brute force hacking. Customers have found that these PINs aren't randomly generated and were nothing more than a timestamp of the time the user enrolled.

Tony Webster tweeted, "OMG, Equifax security freeze PINs are worse than I thought. If you froze your credit today 2:15pm ET for example, you'd get PIN 0908171415."

OMG, Equifax security freeze PINs are worse than I thought. If you froze your credit today 2:15pm ET for example, you'd get PIN 0908171415.

— Tony Webster (@webster) September 9, 2017

Since the PINs were found to be vulnerable to brute force hacking, Equifax has stated that its is now working on a process that would give the user a randomly generated PIN. Equifax told Ars Technica in a statement, "While we have confidence in the current system, we understand and appreciate that consumers have questions about how PINs are currently generated. We are engaged in a process that will provide consumers a randomly generated PIN. We expect this change to be effective within 24 hours. A consumer has an option, and will continue to have an option, to change an existing PIN. The requested new PIN is sent to the consumer by US Mail to their address of record."

Three Equifax executives sold over $1.8 million in shares before the hack was disclosed to the public. Over the weekend, the alleged hackers behind the attack posted on the dark web that for $2.6 million in Bitcoin, they would delete the data.

Image courtesy InvestmentZen/flickr