Heavy snow and difficult travel expected again, heaviest snow in southern Minnesota

MPR News helps you turn down the noise and build shared understanding. Turn up your support for this public resource and keep trusted journalism accessible to all. 

Turn Up Your Support

After a cyberattack that potentially exposed the personal information of 143 million people, the credit reporting agency Equifax set up 

, a website to help people determine whether they had been affected.

However, on multiple occasions over the span of weeks, the company's official Twitter account responded to customer inquiries by apparently directing them to a fake phishing site called www.securityequifax2017.com.

Luckily, the fake site — blocked or flagged by many Internet browsers, then taken down Wednesday afternoon — was set up by software engineer Nick Sweeting to educate people rather than steal their information. A banner on the top read: "Cybersecurity Incident & Important Consumer Information Which Is Totally Fake, Why Did Equifax Use A Domain That's So Easily Impersonated By Phishing Sites?"

2 million Minnesotans could be at risk in Equifax breach

Still, it's an embarrassing development for the company that is struggling to regain public trust, especially considering that customers may have been directed to the fake site at precisely the moment they were seeking reassurance about the safety of their data.

The personal information leaked earlier this month included names, Social Security numbers, birthdates, addresses and, in some cases, driver's license numbers and credit card information.

It's not clear exactly how many times Equifax tweeted the fake site. Sweeting posted a screenshot that appears to show three different tweets, dating to Sept. 9.

https://twitter.com/thesquashSH/status/910562884639436800

"All posts using the wrong link have been taken down. We apologize for the confusion," an Equifax spokesperson told NPR, adding:

Equifax is facing criticism because after the security incident it chose to create an entirely new domain for customers to check whether they were affected — www.equifaxsecurity2017.com — rather than keep the response page within its own primary domain, equifax.com.

That makes it more difficult for customers to determine whether it is a real Equifax site, even as they are being asked to provide their last name and a portion of their Social Security number to check the safety of their personal information. Equifax did not immediately respond to NPR's request for comment about its choice of domain.

"I recommend companies direct people to a site that is trusted and part of their main domain, in order to make sure that something like this doesn't happen," Tarah Wheeler, a cybersecurity consultant at Red Queen Technologies, told NPR. "I'm grateful that the domain was registered by someone who was doing educational work and pointing out a problem like this, and not someone who's malicious."

That's because she has seen multiple sites that are close in name to www.equifaxsecurity2017.com but are actually phishing scams. These schemes are "100 percent anticipated," Wheeler says, and a reason many large companies buy up domains that are common misspellings of their domain.

Getting up to speed on the Equifax data breach scandal


"It's in everyone's interest to get Equifax to change this site to a reputable domain," Sweeting, a software engineer based in Medellin, Colombia, told NPR in a written statement. He called the site "dangerously easy to impersonate," adding that it "only took me 20 minutes to build my clone."

Wheeler stresses that responding to a security incident like this is "extraordinarily difficult."

"The level of anger and hatred being directed at Equifax doesn't take into account how difficult good cybersecurity incident response is to pull off," she says, adding that it's crucial for companies to rehearse their response in advance. Equifax's response to this breach, she says, "showed I think very clearly that the kind of preparation that goes into good incident response hadn't been done in advance."

Business and Economic News

Crime, Law and Justice

The credit reporting agency set up a website to help people determine whether they had been affected by a cyberattack. But on Twitter, Equifax repeatedly pointed people to a phishing site.

After massive data breach, Equifax directed customers to fake site

Go Deeper.

Like this?