Who is ”they” and from where were the ss numbers stolen?

I've received two notices in the last week about my info being stolen, one from Change Healthcare and one from Ticketmaster. I plan to set up free montoring and credit freeze sometime this week. I should've done it by now but have been lazy.

I got the one from Ticketmaster as well. What I found disturbing about that one was that this one was pretty extensive. "The personal information that may have been obtained ........ your name, basic contact information, and payment information such as ENCRYPTED CREDIT OR DEBIT CARD NUMBERS AND EXPIRATION DATES."

Nyuk, what else is new?

So glad I locked (I said freeze earlier, but I remembered, I locked it) my credit and keep my cards locked. Let's see if that helps. I'm hoping beyond hope!

https://www.experian.com/blogs/ask-experian/whats-the-difference-between-credit-freeze-and-a-credit-lock/

I'm with vgkg.

Something that affects everybody will ultimately affect nobody. Whether it leads to ubiquitous multi-factor authentication or whatever other approaches smart people come up with, the world will continue to function relying on the internet/IT and financial systems ecosystems now in place and to come.

There's no reason to lose sleep but neither is there any to discontinue normal prudent monitoring of one's financial accounts.

bragu, is this what you're referring to?

A new lawsuit is claiming hackers have gained access to the personal information of "billions of individuals," including their Social Security numbers, current and past addresses and the names of siblings and parents — personal data that could allow fraudsters to infiltrate financial accounts or take out loans in their names.
The allegation arose in a lawsuit filed earlier this month by Christopher Hofmann, a California resident who claims his identity theft protection service alerted him that his personal information had been leaked to the dark web by the "nationalpublicdata.com" breach. The lawsuit was earlier reported by Bloomberg Law. https://www.cbsnews.com/news/social-security-number-leak-npd-breach-what-to-know/

I hate that this is what it's come to, but I would best most of the people in the USA have their information - including DOB and SSN - stolen long before now. I think both of those for me were first breached well over a decade ago.

Just in the last month my demographics were stolen from Ticketmaster and Rite Aid. A few months ago it was an old insurance policy where I had coverage through Blue Cross. And so it goes.

Freezing your credit isn't a bad idea, use 2-FA whenever you can, as Elmer said monitor your financials...but I agree, not worth losing sleep over. If this is your first go-around, welcome to the club. :-)

@Ally De - what is 2FA? I got a notice this week from Change Healthcare (who apparently works with health insurance plans, including Medicare) about a massive data breach of their system. They are offering free credit monitoring and identity theft protection services for 2 years. What a PIA. S0 many hoops to jump through.

Does anyone have experience using LifeLock? I have no idea what to do.

So sorry Seagrass for using an acronym. It's 2 factor authentication, mentioned farther up-thread. Online portals/accounts/companies which have any sensitive personal information about you should be offering it. Some people find it annoying and disable it or don't opt into it when it is optional.

When 2FA is enabled, you need to go through 2 steps to gain account access. Set 1 is having the right password. After the password is successfully entered, then there is another hurdle to clear before your account information is available. Different companies offer different forms of 2FA. Whether it's entering a code which is texted to your phone, or clicking on an "approve" button via an app on your phone - it makes it harder for people who only have your password to gain access.

Take the free credit monitoring and identity theft protection. I don't personally see the value in LifeLock but everyone evaluates services like that differently.

About 10 years ago we got our first notice of an account being hacked, that one was from our health ins co. Since that time we've gotten about 1 hacking notice every other year that one account or another was hacked along with millions of other peoples. These last 4 years or so we've been offered 1 free year of credit monitoring from company X which will notify us if something suspicious is going on with our credit. So far so good. One can keep a low profile on the web but we have zero control of others who have a direct connection with us. More than likely it will only get worse.

My SSN has been "out there" for YEARS. I have had my ID stolen more than once. And there is no help for it. I wish I could be issued a new one, but the Government refuses for whatever reason. I have had my credit locked for many years, there are 5 to lock, not just the big 3, and even that does not stop it all. Online payday lenders are largely operating illegally anyway and do not do the proper checks and will issue the loan to anyone, so a lock on the credit does not help.

I have Lifelock free through my employer, but would not pay for it otherwise. They DO send alerts sometimes. I have a whole archive about alerts for online payday loans, but they do NOTHING about it. When you tell them "no, that was not me" they advise you to lock your credit reports, but do nothing to help "clear your name" I guess would be the description I am looking for. Also, over the years with LifeLock I have easily, unlocked my credit and opened new accounts, and never heard a peep from them about it. So I am not sure what the point of it is. My employer brags that they pay for the highest tier of protection from them, but I am not sure they should be wasting their money on it.

I've been seeing that news for a while now - and The Verge has a very interesting article about it:

"...National Public Data, a company that collects personal data to resell and process background checks, is the target of a proposed class action lawsuit alleging it is the source of a massive data leak that includes information like Social Security numbers and more on reportedly “3 billion people,” according to Bloomberg Law.

As reported by BleepingComputer, the alleged stolen database was offered for sale on the dark web in April by a hacker group known as USDoD for $3.5 million. It advertised the haul as 2.9 billion rows of data originating from National Public Data (NPD) — a reported DBA name of Jerico Pictures, Inc. NPD has not commented publicly on the alleged leak or responded to questions.

BleepingComputer reports multiple sources have released partial copies and that each record contains a name, mailing addresses, and social security number, as well as possible aliases in some cases for people in the US, Canada, and UK. Many of the records are duplicates, so how many people that may impact is a much smaller number. The hacker and malware tracker @vxunderground on X also looked at the data and noted it didn’t contain records for people who use data opt-out services, supporting the idea that it came from a data aggregator.

If you’ve received an alert that your information is included in the data leak, other than keeping an eye out for any suspicious activity on your credit report, BleepingComputer also warns people to be vigilant of scams and phishing attacks using leaked information that might try to get you to reveal more private info.

Have I Been Pwned operator Troy Hunt has experience looking at similar data leaks. He tracks and sorts their information for his site to alert people if their information has been compromised, and he says there are some weird things about this set of data that make the whole thing “...informational only, an intriguing story that doesn’t require any further action.”

On Hunt’s blog, he writes there’s “no concise way to explain the nuances” of the breach since the alleged source of the breach is a company with personal data that was not given to it directly, making it hard to trace back.

Hunt looked at the data and found one set with Social Security numbers but no email addresses, while another one has 100 million unique email addresses, but the rest of the data is “pretty random in appearance.” He found his email in the list but confirmed the information next to it was inaccurate. Hunt adds:
Lastly, I want to re-emphasise a point I made earlier on: there were no email addresses in the social security number files. If you find yourself in this data breach via HIBP, there’s no evidence your SSN was leaked, and if you’re in the same boat as me, the data next to your record may not even be correct."

https://www.theverge.com/2024/8/14/24220212/national-public-data-breach-social-security-3-billion

Who are the five AmyLou? I have only heard of the three. I'm happy to do it with the other two 😉

Of course anybody can break into your car. They can smash your window. But there are some that just try the lock. If it's locked they move on, if it's not they'll take what's in there. I would, at the very least, like to put an obstacle in their way

I just feel overwhelmed by the whole process but also have heard horror stories about people having their bank accounts emptied. My DH is a "what, me worry?" kind of guy - so he's of no help to me.

And yet like sheep to the slaughter we continue to, we are forced more and more to to business on line.

Time.com has a helpful article and link to check for your compromised info:

https://time.com/7011872/social-security-data-breach-information/

I just checked and found 6 sites with passwords that have been compromised - they're all sites I haven't used in years - one is myspace.