With the Equifax data breach that exposed the personal information of 147 million Americans in 2017 and the NationalPublicData.com breach in headlines the past two weeks, it is safe to assume that your customers’ personally identifiable information is available on the dark web for purchase.

While the number of records stolen and the accuracy of the records stolen in the NationalPublicData.com breach is in dispute, it is clear that it was a large breach of billions of records that included at least some accurate data.  The Equifax breach has been widely reported for years, and it is confirmed on the CFPB website that names, addresses, social security numbers, and dates of birth were leaked.

Well-known cyber-crime journalist Brian Krebs posted two excellent articles recently on the NationalPublicData.com breach, which are linked below.

In his article from August 19th, Krebs stated, “A [credit file] freeze is a good idea because all of the information that ID thieves need to assume your identity is now broadly available from multiple sources thanks to the multiplicity of data breaches we’ve seen involving SSN data and other key static data points about people.”

A credit file freeze is a good idea and should be passed on to your customers, family, and friends, but Krebs’s statement about credit freezes includes a point relevant to banks regarding customer identification.  With all the information that identity thieves need to assume identities now widely available, including SSNs, should your bank use this information to identify customers when they call the bank?

It is probably a good time for your bank to get serious about gathering passcodes, passphrases, or other unique means of identification from customers for front-line verification going forward.  Be sure to check out Krebs on Security’s articles for more information on the breach.

NationalPublicData.com Hack Exposes a Nations Data

National Public Data Published Its Own Passwords

Please contact us to learn more about CCI’s IT offerings at inquiries@completecompli.com.