Expert Comments

Experts on News: Experian scam leaves critical data on over 24 million customers exposed

Expert(s): Security Experts
Expert(s): Security Experts

It has been reported that the South African branch of consumer credit reporting agency Experian disclosed a data breach on Wednesday with the credit agency admitted to handing over the personal details of its South African customers to a fraudster posing as a client. While Experian did not disclose the number of impacted users, a report from South African Banking Risk Centre (SABRIC), an anti-fraud and banking non-profit, claimed the breach impacted 24 million South Africans and 793,749 local businesses.
Full story here: https://www.zdnet.com/article/experian-south-africa-discloses-data-breach-impacting-24-million-customers/

Experts Comments

Dot Your Expert Comments
Dan Piazza
August 21, 2020
Technical Product Manager
Stealthbits Technologies

Experian scam leaves critical data on over 24 million customers exposed
Once again, the human factor was the issue rather than network vulnerabilities or lax IT. Ultimately an Experian employee was tricked into handing personal information of customers over to someone posing as a legitimate client. While Experian claims no financial or credit-related information was involved, the overall scope of the breach is still concerning. A report from the South African Banking Risk Centre claimed the breach impacted 24 million South Africans and 793,749 local businesses;.....Read More
Once again, the human factor was the issue rather than network vulnerabilities or lax IT. Ultimately an Experian employee was tricked into handing personal information of customers over to someone posing as a legitimate client. While Experian claims no financial or credit-related information was involved, the overall scope of the breach is still concerning. A report from the South African Banking Risk Centre claimed the breach impacted 24 million South Africans and 793,749 local businesses; should the Experian employee have had access to all that data? It\'s tough to say without knowing more about Experian\'s internal structure and delegation of roles, however it does sound like overprovisioned access to data may have been an issue. Access to data should be continuously audited and limited to essential personnel, with permissions assigned at the lowest possible level. Furthermore, this incident shows the ongoing need for all employees to be educated for security awareness to avoid common social engineering attacks.  Read Less
Chris Hauk
August 21, 2020
Consumer Privacy Champion
Pixel Privacy

They can also use that same personal information to trick you into providing additional information.
Any compromise of personal information like this offers an opportunity for the bad guys to impersonate you to open accounts in your name or cause other financial havoc. They can also use that same personal information to trick you into providing additional information. That's why even though Experian South Africa claims no sensitive data was leaked, customers should still stay alert for any changes in their accounts, or for anyone claiming to be from a bank, credit agency, or other financial.....Read More
Any compromise of personal information like this offers an opportunity for the bad guys to impersonate you to open accounts in your name or cause other financial havoc. They can also use that same personal information to trick you into providing additional information. That's why even though Experian South Africa claims no sensitive data was leaked, customers should still stay alert for any changes in their accounts, or for anyone claiming to be from a bank, credit agency, or other financial institution asking for personal information.  Read Less
Saryu Nayyar
August 21, 2020
CEO
Gurucul

As a consumer credit reporting company, they are clearly a high value target for cybercriminals.
Experian is in the headlines again for suffering a major cyberattack. As a consumer credit reporting company, they are clearly a high value target for cybercriminals. Likely the company has an array of cybersecurity protections in place to prevent data breaches. Social Engineering, however, is a different animal. In this case, an individual fraudulently claimed to represent a client and gained access to Experian services. This person then made off with 24 million South African’s PII as well.....Read More
Experian is in the headlines again for suffering a major cyberattack. As a consumer credit reporting company, they are clearly a high value target for cybercriminals. Likely the company has an array of cybersecurity protections in place to prevent data breaches. Social Engineering, however, is a different animal. In this case, an individual fraudulently claimed to represent a client and gained access to Experian services. This person then made off with 24 million South African’s PII as well as information from 800,000 businesses. Fraud is malware's ugly cousin. You need different controls to detect and catch social engineering and fraudulent behavior because fraud isn't code. Fraud isn’t a malware application. People commit it.  Read Less
Javvad Malik
August 20, 2020
Security Awareness Advocate
KnowBe4

We continue to see more and more high-profile attacks take place with social engineering attacks.
Having robust technical security controls in place is essential for all organisations today. But in addition, it is equally important for organisations to have procedures that support security, and ensure all staff receive appropriate security awareness training. We continue to see more and more high-profile attacks take place with social engineering attacks - whether that be to get an employee to hand over credentials, set up a new payment, or send sensitive data. We will likely see more.....Read More
Having robust technical security controls in place is essential for all organisations today. But in addition, it is equally important for organisations to have procedures that support security, and ensure all staff receive appropriate security awareness training. We continue to see more and more high-profile attacks take place with social engineering attacks - whether that be to get an employee to hand over credentials, set up a new payment, or send sensitive data. We will likely see more organisations targeted by social engineers, and therefore investing in staff is of paramount importance.  Read Less
Dean Ferrando
August 20, 2020
Systems Engineer Manager – EMEA
Tripwire

Identity theft is just as bad as an attacker draining one’s bank account.
For those affected by this breach, I would strongly recommend they change their passwords and security information. Identity theft is just as bad as an attacker draining one’s bank account. Victims should continuously monitor their bank accounts as well as look for indicators of identity theft. The fact that this has occurred twice within a year means the organisation needs to evaluate its current security measures. Basic security hygiene needs to be adopted by all enterprises, not just.....Read More
For those affected by this breach, I would strongly recommend they change their passwords and security information. Identity theft is just as bad as an attacker draining one’s bank account. Victims should continuously monitor their bank accounts as well as look for indicators of identity theft. The fact that this has occurred twice within a year means the organisation needs to evaluate its current security measures. Basic security hygiene needs to be adopted by all enterprises, not just financial institutions and this includes secure configurations and vulnerability management, as well as performing specific threat assessment and countermeasures which will reduce the overall risk of future attacks.  Read Less

Dot Your Expert Comments


Only for registered and approved experts. Please register before providing comments. Register here
* By using this form you agree with the storage and handling of your data by this web site.
Submit
0
FacebookTwitterLinkedinWhatsappEmail

You may also like

Hackers Steal Wealth of Data from Game Giant EA

Researchers Create Un-hackable Quantum Network, Expert Weighs In

Italian Government Announces National Cybersecurity Agency

JBS Pays $11 Million Dollars in Cyber Ransom

Malware Stole 1.2TB Private Data From 3 Mil PCs

Experts React: RockYou2021, Largest Password Leak

Colonial Pipeline CEO Grilled by Senate but Experts Think Different

Experts Inisght On Security Threats Of VPN And What Organisations...

Kent School’s Suffer Cyberattack With Systems Offline And Data Stolen

NY City Law Dept Computer Systems Hacked & Shut Down...

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More

Privacy & Cookies Policy