Latest / Privacy Please / S6, E251 - Digital Fallout: The Keepers of Your Secrets

Transcript

S6, E251 - Digital Fallout: The Keepers of Your Secrets · Privacy Please

• 0:00
  Speaker 1: Hi, welcome back to Privacy, Please.
• 0:02
  Speaker 1: I'm Cameron Ivey, and this is the second episode of our series, Digital Fallout.
• 0:07
  Speaker 1: Before we begin, the story you're about to hear is a true story based on extensive public reporting.
• 0:12
  Speaker 1: We've dramatized certain elements to bring the story to life.
• 0:15
  Speaker 1: For a full list of our resources, please see the show notes.
• 0:18
  Speaker 1: With that being said, let's get into the story.
• 0:21
  Speaker 1: Let's get into the story.
• 0:26
  Speaker 1: Have you ever had the strange feeling, that prickle on the back of your neck that tells you something is wrong, A feeling that someone somewhere knows something about you they shouldn't?
• 0:39
  Speaker 1: For a 32-year-old woman from Ohio named Sarah, that feeling began in the summer of 2017.
• 0:50
  Speaker 1: Sarah and her husband had been saving for years to buy their first house.
• 0:53
  Speaker 1: They had good jobs, they paid down their debts and their credit scores were pristine.
• 0:58
  Speaker 1: They were finally ready.
• 1:00
  Speaker 1: In late August, they walked into their bank to get pre-approved for a mortgage, a moment they had been dreaming about for years.
• 1:12
  Speaker 1: The loan officer typed their information into the computer.
• 1:14
  Speaker 1: He looked at his screen, looked back at them and then he had five words that made Sarah's blood run cold I'm sorry, I've been denied.
• 1:23
  Speaker 1: Confused, Sarah asked why.
• 1:26
  Speaker 1: The loan officer explained that her credit report showed a brand new car loan taken out in her name just three weeks prior from a dealership in California.
• 1:36
  Speaker 1: Sarah had never been to California.
• 1:39
  Speaker 1: She hadn't bought a car.
• 1:40
  Speaker 1: It was the first sign that a digital ghost was now living her life.
• 1:48
  Speaker 1: While Sarah was frantically trying to prove that she was in fact herself, a press release went out that shook the country.
• 1:55
  Speaker 1: One of the nation's three great credit bureaus the silent keepers of our financial identities announced that they had been the victim of a cybersecurity incident.
• 2:08
  Speaker 1: They didn't say much more.
• 2:09
  Speaker 1: The announcement was vague, clinical.
• 2:11
  Speaker 1: They assured the public they had the situation under control and directed everyone to a special website to see if they had been affected.
• 2:19
  Speaker 1: But when people like Sarah visited the site, the mystery only deepened.
• 2:23
  Speaker 1: The website looked amateurish.
• 2:26
  Speaker 1: It asked for the last six digits of your social security number, which felt like walking into a trap.
• 2:33
  Speaker 1: Worse, the website itself seemed to be guessing.
• 2:37
  Speaker 1: It would tell a person they were likely impacted one day and not impacted the next.
• 2:42
  Speaker 1: And then came the truly absurd.
• 2:45
  Speaker 1: The company's own official Twitter account, trying to be helpful, began sending its scared and confused customers to the wrong website, A fake phishing site that a security researcher had set up to prove a point.
• 2:58
  Speaker 1: The very institution that held the keys to their financial kingdom was now leading them astray, but the public still didn't know the full story.
• 3:04
  Speaker 1: They didn't know it was stolen.
• 3:05
  Speaker 1: The institution that held the keys to their financial kingdom was now leading them astray, but the public still didn't know the full story.
• 3:09
  Speaker 1: They didn't know it was stolen and they didn't know how the thieves got in.
• 3:14
  Speaker 1: Behind the scenes, a team of digital investigators was piecing together the timeline, and what they found was chilling.
• 3:21
  Speaker 1: The intrusion hadn't just happened.
• 3:24
  Speaker 1: It had been going on for months.
• 3:27
  Speaker 1: They discovered that back in March, a known vulnerability in a common piece of web software had been announced to the world.
• 3:34
  Speaker 1: A patch was issued.
• 3:36
  Speaker 1: It was a simple fix, but for some reason, at this one company, the memo was ignored.
• 3:42
  Speaker 1: The patch never applied.
• 3:44
  Speaker 1: It was the equivalent of a bank being told about a faulty lock and then leaving the door wide open for the entire summer, and for 76 days, from mid-May to the end of July, hackers had walked right through the open door.
• 3:58
  Speaker 1: They roamed the company's network completely undetected, mapping out the databases, locating the most sensitive information and then slowly, methodically siphoning it all out.
• 4:09
  Speaker 1: And when the investigators finally determined what exactly had been taken.
• 4:13
  Speaker 1: They understood the true scale of this disaster.
• 4:16
  Speaker 1: This wasn't just usernames and passwords.
• 4:20
  Speaker 1: The thieves had taken the crown, jewels Names, birthdates, addresses, driver's license numbers and, in most cases, social security numbers Everything someone would need to become you.
• 4:33
  Speaker 1: And who were the victims?
• 4:36
  Speaker 1: The company's final analysis revealed that the number was 147 million people, nearly half of the entire adult population of the United States.
• 4:47
  Speaker 1: This was not a sophisticated, state-of-the-art hack that no one could have prevented.
• 4:52
  Speaker 1: This was a catastrophic failure of the most basic security practices A failure to perform a single routine software update, A failure to notice that nearly half of the country's most sensitive data was walking right out the front door for two and a half months.
• 5:08
  Speaker 1: It was a breach of trust so profound, so complete, that it changed the landscape of privacy forever.
• 5:16
  Speaker 1: For people like Sarah, the mystery car loan was just the beginning of a lifelong battle to protect her own identity.
• 5:24
  Speaker 1: The mystery car loan was just the beginning of a lifelong battle to protect her own identity.
• 5:26
  Speaker 1: The damage was permanent and the name of this silent guardian, the keeper of secrets that failed.
• 5:39
  Speaker 1: Its one single duty was Equifax.
• 5:40
  Speaker 1: That brings us to the end of this episode of Digital Fallout.
• 5:43
  Speaker 1: Thank you so much to the journalists and researchers who meticulously documented the failures and fallout of this historic breach.
• 5:52
  Speaker 1: For a list of our primary sources, please check out the show notes.
• 5:56
  Speaker 1: Until next time, everyone, thank you so much for tuning in to Privacy, Please, and stay curious and safe out there.
• 6:03
  Speaker 1: No-transcript.