{"id":1246,"date":"2017-10-03T20:00:53","date_gmt":"2017-10-04T00:00:53","guid":{"rendered":"https:\/\/www.techsolutionsinc.com\/blog\/what-you-can-learn-from-the-equifax-nightmare\/"},"modified":"2022-03-02T08:42:08","modified_gmt":"2022-03-02T13:42:08","slug":"what-you-can-learn-from-the-equifax-nightmare","status":"publish","type":"post","link":"https:\/\/www.techsolutionsinc.com\/blog\/what-you-can-learn-from-the-equifax-nightmare\/","title":{"rendered":"What you can learn from the Equifax Nightmare"},"content":{"rendered":"

\"\"When it comes to security, it\u2019s better to be safe than sorry. But as the Equifax leak case has taught us, once a security breach does happen, it\u2019s best not to be sorry twice. Read on so your business doesn’t experience the same fate as the giant, bumbling credit bureau.<\/p>\n

What happened to Equifax?<\/h3>\n

Equifax, the huge American credit agency announced in September 2017 that its database was hacked, resulting in a leak of tons of consumers’ private data, including personally identifiable information of around 143 million US citizens. It included names, social security numbers, addresses, birthdates, and credit card and driver\u2019s license numbers.<\/p>\n

Equifax responded by setting up a new site, www.equifaxsecurity2017.com<\/a>, to help its customers determine whether they had been affected and to provide more information about the incident.<\/p>\n

Soon after, Equifax\u2019s official Twitter account tweeted a link that directed customers to www.securityequifax2017.com, which is actually a fake site.<\/p>\n

Fortunately for Equifax\u2019s customers, the fake phishing site was set up by a software engineer who wanted to use it for educational purposes and to expose flaws in Equifax\u2019s incident response practice. So, no further harm was done to the already-damaged customers, and Equifax is left with even more embarrassment.<\/p>\n

So what did Equifax do wrong?<\/h3>\n

One of the huge mistakes Equifax made in responding to its data breach was setting up a new website to give updated information to its consumers outside<\/em> of its main domain, equifax.com.<\/p>\n

Why? You first need to know that since the invention of phishing scams, phishers have been creating fake versions of big companies\u2019 websites. That\u2019s why so many major corporations buy domains that are the common misspellings of their real domains.<\/p>\n

You should also know that phishers can\u2019t create a web page on the company\u2019s main domain, so if Equifax\u2019s new site was hosted there, it\u2019d be easy for customers to tell whether the new page was legitimate and not be fooled by a fake domain name.<\/p>\n

What\u2019s obvious from this embarrassing misstep is that Equifax had never planned for a data leak. And this is an unforgivable oversight by a company that handles the information of over 800 million consumers and more than 88 million businesses worldwide.<\/p>\n

Don\u2019t repeat Equifax\u2019s mistake<\/h3>\n

Whether your business is a small startup or as big as Equifax, it needs to prepare for a data breach. Besides having a comprehensive network defense plan, you also need to have the right incident response plan in place.<\/p>\n

So what you should do after you\u2019ve discovered the leak is, first of all, be upfront with your customers and notify them as soon as possible.<\/p>\n

You also need to establish a message that includes the following information:<\/p>\n