7 mo. ago • 99%

Scary AT&T breach leaks up to 70 million Social Security numbers to the dark web

www.macworld.com Scary AT&T breach leaks up to 70 million Social Security numbers to the dark web

Data breach occurred two weeks ago.

cross-posted from: https://lemmy.world/post/13810367

News @lemmy.world Scary AT&T breach leaks up to 70 million Social Security numbers to the dark web

88 comments

Why exactly did a telecom company need SSNs anyway?

Edited to add, this was a rhetorical question and more a comment on the awful series of systems in the USA that leads a SSN to be used by telecom companies.

78
- To collaborate more effectively with the NSA and CIA.
  
  41
  
  Oh, so that explains where the cocaine comes from.
  
  1
- Credit checks.
  
  Nowadays they offer financing for devices. But even in the past it was required. They would determine the maximum number of lines you had available, and if there were any deposits to open new lines of service. Even before phone financing, those phone contracts came with hundreds of dollars of phone discounts at time of purchase and had hundreds of dollars worth of early termination fees and they want to make sure their customers had a good chance of paying if they left.
  
  26
- Antifraud
  
  6
- Most people get suckered into signing a contract and using a "postpaid" plan, where you get the service for a month and then pay for it. That requires a credit check and credit reporting, since you get the service before payment. You don't have to give out your SSN if you sign up for "prepaid" cell phone plans, which offer less discounts and benefits but are generally cheaper for the service they provide. The only catch is you pay for the month before you use it, but this makes canceling as easy as stopping payment.
  
  5
  
  I'm on a prepaid plan, and got in on a really good deal. They were offering $25/month off indefinitely for signing up for auto-pay (Basically 35% off, lol). It made the plan cheaper and better than most of their monthly plans. I'm happy to know it also saved me from giving out my SSN.
  
  2
  
  Problem is all prepaid plans are MVNOs that throttle speeds
  
  1
- I think it's related maybe to some anti terrorism law? In certain EU countries for example it's impossible to get an anonymous SIM due to some anti terrorism legislation. SSNs are the only legal identification I guess?
  
  This is a random guess off the top of my head. IANAL or know anything specific on US law.
  
  4
  
  SSN isn't supposed to be used as a form of ID. Even says so on an SS card.
  
  9
  
  What's IANAL? Is it some new Apple product I don't know about yet?
  
  6
- To run credit checks and be in compliance with anti-terrorism regulations.
  
  4
  
  But there's no need to store them in what I assume to be plain text, this is negligence
  
  4
- It could be worse, companies could be asking for phones and then treating them as a SSN. Oh wait....
  
  3
I have been informed my SSN, DOB, and payment information have been "compromised" at least 50 times in my life.

64
- Just keep your credit frozen
  
  1
Fight Club had it backwards. Instead of attacking the banks to wipe out people’s credit someone should release everyone’s SSN. The mass fraud will make credit useless.

46
- Isn't 70 million like 1/4 anyway?
  
  14
  
  Between this Anthem, Target, and OPM, it seems likely that most Americans have their SSN out there for criminals to buy.
  
  10
- Let's evolve, let the chips fall where they may.
  
  8
- This is brilliant. The government could put out a searchable database.
  
  7
- You first. Feel free to post it here.
  
  2
  
  420-69-8008
  
  2
It's almost like the gov should replace the SSN system with something that addresses modern security concerns.

29
- Social Security Numbers were never meant to be used for anything other than Social Security itself. Credit agencies use the SSN because they view it as an easy identifier and they didn't have to create anything themselves.
  
  38
  
  It's ridiculous how something that is supposed to be very confidential and kept private is asked everywhere you need services.
  
  9
- But then I can't google my number when I forget.
  
  17
- Like fingerprints
  
  Oh wait...
  
  -2
- It baffles the mind the the USA doesn't have a plain old photo ID
  
  -3
  
  There is, just on a state level which does nothing for a nation with 50 of the fuckers
  
  3
Good chance these were already leaked with the equifax debacle.

28
- @rdyoung @catculation
  
  Exactly what I was going to say. I froze everything after that will keep it frozen forever. So easy to temp thaw when I want to apply for something.
  
  Big 3 credit bureaus
  Chexsystems for banks
  Lexus Nexus for you know, everything
  And there's one for utilities too that escapes me at the moment
  
  Make a social security account if you haven't already so no one else can
  
  15
  
  What did you do to freeze your stuff? And how do you thaw it for stuff, and how long does it take? I did go ahead and make my My Social Security account after seeing your comment though!
  
  2
Tried to delete my shit from their website, but they make it impossible to do so. I tried for about 20 minutes then eventually the site straight up refused to let me continue. I don't even have AT&T anymore, I had their cellular back in 2013 and left them then, but the fuckers kept my info in their system this whole fucking time. No accountability for big corporations when they fuck up big like this. If it were one of us peasants, we would have been in prison for life.

26
- I think the problem is there isn't any law protecting your data
  
  17
  
  And that's a huge problem. Only form of protection I have is freezing my credit with the three credit reporting assholes. I know it's not much, but at least no one can apply for shit with my social.
  
  11
The SSA should just set a time limit, (let’s say 3 years,) and then publish a database of every single name, DOB, and SSN. Force the banks to figure out a new system of identification, by making the current system useless.

The current system is already insecure; SSNs were never intended to be secure. So why has the SSA tolerated this for so long? Just make the “in three years we’ll publish this live database for anyone to search” announcement, so banks are forced to develop a better system. It gives them the time to work on a new system, eliminates the need to keep SSNs secret, and the SSA can keep operating as normal.

25
- Permanently Deleted
  
  4
- This is one of those ideas I'd love to agree with, but I know the reality of the situation would mean negative consequences for the most vulnerable and disadvantaged, just like how current ID systems are now.
  
  2
I have so much "free credit monitoring" from data breaches, I could leave it to my grandkids and they'd be set for life.

18
Mine is 075-21-9556 in case anyone wants it.

10
- 086-07-5309
  
  12
  
  Interesting, your SSN matches my phone number.
  
  4
  
  I see what you did there.
  
  3
- Hey, wait a minute! That one's mine, too!
  
  5
- I have your IP and your SSN
  
  Hands up
  
  4
- Glad that you guys think that you're so bold but why don't you post this in hacker forums instead?
  
  1
  
  I have a T shirt with it on the back in large font.
  
  1
- Permanently Deleted
  
  -1
I keep reading "social security number", but still don't understand why it's possible to steal a person's identity with their SSN. Is that all that's required for identification? Some number?

10
- Basically. It wasn't meant to act as an identification, but people kept using it that way (probably because every citizen gets one at birth, so it's the easiest proof of citizenship).
  
  6
- It's a key component. You need other information, but the SSN is supposed to be secret.
  
  5
- Getting names, emails, addresses, etc is pretty available. If you can link those up + an SSN you can open accounts pretty easily
  
  4
  
  Damn... that seems like a pretty bad system. Have there not been attempts to remedy that?
  
  CC BY-NC-SA 4.0
  
  1
Compensations should be paid out, watch how security grows

9
Is there any way we could do some sort of certificate based authentication? Instead of a social security number. I know people get really dodgy whenever you talk about ways to identify them but there has to be a better way than this.

Identity fraud can ruin your life permanently and at this point I'm pretty sure more people have been compromised than haven't.

8
- Bill Gates has been trying for awhile.
  
  6
- World coin!
  
  (Not really world coin is a terrible idea)
  
  2
  
  Something like a ssh key or what they are now calling passkeys could work. The question is then who holds the verification database and how do individuals (especially those who can't turn on their pc) keep their part of the key safe and do we also have some other kind of verification questions like we do now to make sure that it's the right person when so many small details are shared or similar across people.
  
  3
and this is why i refused to give you my social back when i lived in your service area and had a land line installed.

8
Will there be consequences??

6
- SSNs are not secure and were never intended to be used that way. Just because companies misuse it for security to cut costs and apply credit ratings we never voted for doesn't mean we should necessarily punish someone for leaking that data that is already like 99% public data because of all the previous leaks. It would be better if everyone treated it as public data and not some secret identity key. They should be punished for poor security and fix their shit, but SSNs are not private, not intended to be used for identity, and not secure.
  
  5
whoopsie doopsie!

ssns are probably useless by this point. cant wait for these people to leak our biometric data next, so we cant even change our 'passwords' anymore.

5
Everyone's data is now public knowledge

3
This was probably orchestrated on purpose as part of a long term operation

The goal would be to make things like this happen over and over and over again so as to eventually get people outraged enough so that they can push for everyone to get on board with CBDCs, forced nerulink implants, digital identity like the EU, and basically anything that helps the government make you a total slave to surveillance and tracking

It's another one of those, "it's for your safety!!!!!!" deals

-6
- Or maybe they just need to practice better security. Never assume malice when something can be explained with inconfidence.
  
  To be fair the threat actors are getting much harder to defend against
  
  1
  
  People must learn to open their eyes. We already know that the government, big tech, and corporations lie all the time. Yet somehow, when I suggest that they are lying, I get told off?? Give me a break.
  
  I am not assuming, more or less just strongly suggesting. There is a major benefit to the larger agenda here.
  
  Anyway I'm not frustrated at you, just majority of so-called privacy people who can't see a bigger picture. Same kind of people that would have torn you to shreds for suggesting some things pre-2014 that Snowden later revealed to be true. Somehow we forgotten about him.
  
  2

You've viewed 88 comments.