Experian sold personal information on the black market--October 2013 report

Experian sold personal information on the black market--October 2013 report

In October 2013, investigative news media in the United States revealed that Experian, a global credit bureau, had allowed Vietnamese hackers with false identities to gain access to data. The problem began with a website called "SuperGet.info" operated by a Vietnamese named Hieu Minh Ngo, where so-called complete personal information, including names, birth dates, social security numbers, driver's license numbers, addresses, and bank account numbers of US citizens were traded using virtual currency .

The source of this information was a company called Court Ventures, which Experian acquired in 2012. Court Ventures was originally partnered with another information provider, US Info Search, and they used each other's personal databases. Experian then acquired Court Ventures, but Gault continued to contract with the company under the guise of a "legitimate investigator," a contract that was renewed after the acquisition and continued to provide a large amount of personal information to criminals for over 10 months.

An investigation by the U.S. Secret Service brought this shocking revelation to light. Gault accessed more than 2 million records and sold the information to approximately 1,300 customers. During that time, a cumulative total of more than 3.1 million information inquiries were made. Although the full extent of the damage has not been determined, it is possible that millions of U.S. citizens were affected in a number of cases of tax fraud and credit fraud misuse.

Experian claimed that "no evidence of actual harm has been identified," but was strongly criticized by congressional officials and privacy experts. Experian's screening system was questioned as to why proper identification was not done and whether there were any indications that the data could be used for criminal purposes. This was compared to a similar incident at ChoicePoint in the early 2000s, which rekindled distrust of the credit bureaus industry as a whole.

What became clear through this case was that no matter how legitimate the framework is, if the monitoring and verification system is not functioning, the system itself can become a breeding ground for crime. Even a giant company like Experian was proven to be vulnerable to a sophisticated intrusion from the outside, sparking a social debate over the handling of personal information.