Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'

US attorneys general roll up sleeves, snap on gloves


Several US states have launched an investigation into a subsidiary of credit reference bureau Experian after a fraudster allegedly bought millions of consumers' personal data from it.

Vietnamese national Hieu Minh Ngo allegedly used information obtained through Experian subsidiary Court Ventures to run two identity fraud-enabling websites, Superget.info and Findget.me.

Information offered for anonymous sale on these websites consists of personal information packages on hundreds of thousands of Americans. These packages (or fullz) include names, addresses, social security numbers, dates of birth, driver’s license number, mother’s maiden name, bank account numbers and other information.

Ngo was charged with conspiracy to commit wire fraud, aggravated identity theft, conspiracy to commit access device fraud and other offences over the alleged scam last year. He pleaded guilty to various offences a few weeks ago, and is due to be sentenced in June.

The alleged fraud ran for at least 18 months before it was exposed by investigative journalist Brian Krebs.

Ngo posed as a private investigator to buy information from Court Ventures, paying the fees by monthly wire transfers from Singapore. He then resold this information to crooks who made "3.1 million queries of the US Info Search database over an 18-month period" up until early 2012, according to Reuters.

The 24-year-old was arrested when he was lured into visiting the US territory of Guam in February 2013, on the pretext of signing a lucrative business deal.

KrebsOnSecurity reports Ngo's ID theft business attracted at least 1,300 clients who paid at least $1.9m between 2007 his February 2013 arrest, based on court records of his sentencing hearing (PDF).

Court Ventures' role in the matter has now resulted in an investigation by attorneys general in multiple US states, Reuters reports. The investigation involves Illinois and Connecticut, amongst others.

"We are investigating," Maura Possley, a spokeswoman for Illinois attorney general Lisa Madigan, told Reuters on Thursday. "It's part of a multi-state investigation."

In a statement, Experian sought to distance itself from the investigation, arguing that the sensitive data that had been improperly offered for sale came from US Info Search.

Court Ventures, a firm that collects and aggregates information from public records that was acquired by Experian in March 2012, had a data-share deal with US Info Search, a link exploited by Ngo for nefarious purposes.

No Experian database was accessed in this incident. In fact, the database that was accessed in this criminal scheme was owned and controlled by US Info Search, a company that is completely separate from Experian.

Court Ventures, at the time of acquisition, had a contract with US Info Search. That contract allowed customers of Court Ventures to access US Info Search’s data to find the address of a person in order to determine which court records to review.

After Experian’s acquisition of Court Ventures, the U.S. Secret Service notified us that Court Ventures had been and was continuing to resell data from a U.S. Info Search database to a third party, possibly engaged in illegal activity. The suspect in this case posed as a legitimate business owner and obtained access to U.S. Info Search data through Court Ventures prior to the time Experian acquired the company.

Experian has since ceased the resell of US Info Search data. The credit reference agency hit out at suggestions that the fraud exposed the personal details of 200 million Americans.

Some news reports and sensational headlines are saying that Experian lost 200 million consumer records. This is not the case, as it was not Experian’s database that was accessed, but rather US Info Search’s database. Although we do not know the exact number of US Info Search’s records actually accessed at this point, we know that 200 million is false and that the actual number is much lower.

The credit reference agency "acknowledge[d] the concern consumers may have about this illegal access". "We are actively pursuing the facts and we are working with investigators to help uncover what records may have been affected," its statement concluded. ®


Other stories you might like

  • Experts: AI should be recognized as inventors in patent law
    Plus: Police release deepfake of murdered teen in cold case, and more

    In-brief Governments around the world should pass intellectual property laws that grant rights to AI systems, two academics at the University of New South Wales in Australia argued.

    Alexandra George, and Toby Walsh, professors of law and AI, respectively, believe failing to recognize machines as inventors could have long-lasting impacts on economies and societies. 

    "If courts and governments decide that AI-made inventions cannot be patented, the implications could be huge," they wrote in a comment article published in Nature. "Funders and businesses would be less incentivized to pursue useful research using AI inventors when a return on their investment could be limited. Society could miss out on the development of worthwhile and life-saving inventions."

    Continue reading
  • Declassified and released: More secret files on US govt's emergency doomsday powers
    Nuke incoming? Quick break out the plans for rationing, censorship, property seizures, and more

    More papers describing the orders and messages the US President can issue in the event of apocalyptic crises, such as a devastating nuclear attack, have been declassified and released for all to see.

    These government files are part of a larger collection of records that discuss the nature, reach, and use of secret Presidential Emergency Action Documents: these are executive orders, announcements, and statements to Congress that are all ready to sign and send out as soon as a doomsday scenario occurs. PEADs are supposed to give America's commander-in-chief immediate extraordinary powers to overcome extraordinary events.

    PEADs have never been declassified or revealed before. They remain hush-hush, and their exact details are not publicly known.

    Continue reading
  • Stolen university credentials up for sale by Russian crooks, FBI warns
    Forget dark-web souks, thousands of these are already being traded on public bazaars

    Russian crooks are selling network credentials and virtual private network access for a "multitude" of US universities and colleges on criminal marketplaces, according to the FBI.

    According to a warning issued on Thursday, these stolen credentials sell for thousands of dollars on both dark web and public internet forums, and could lead to subsequent cyberattacks against individual employees or the schools themselves.

    "The exposure of usernames and passwords can lead to brute force credential stuffing computer network attacks, whereby attackers attempt logins across various internet sites or exploit them for subsequent cyber attacks as criminal actors take advantage of users recycling the same credentials across multiple accounts, internet sites, and services," the Feds' alert [PDF] said.

    Continue reading

Biting the hand that feeds IT © 1998–2022