As Texas Gov. Rick Perry might say: “Oops.”
It appears that a service specializing in identity theft managed to get data from a very reliable source – a company owned by Experian, one of the Big Three credit bureaus.
According to security blog Krebs on Security, an underground operation with the fly-by-night name of Superget.info boasted of its skill in obtaining complete Social Security numbers, driver’s license numbers, financial information, and more on zillions of unknowing Americans, all purchaseable with untraceable Net-based currency like WebMoney. Its specialty was assembling and selling entire identity theft packages, enough for taking out a loan in someone else’s name.
InfoSearch, Court Ventures
Two year ago, Krebs ran a story about the outfit and asked readers to help identify the two- and three-letter data source identifiers he found in Social Security Number searches conducted on Superget – identifiers like TH or MV. One reader said the abbreviations were the same as ones in data sets from USInfoSearch.com, one of those services that uses public data for the verification of personal identity and for conducting, say, background checks.
Info Search said that it didn’t supply the data directly to Superget, but that the data was obtained from another company with which it had an info sharing agreement, Court Ventures. In 2012, Experian bought Court Ventures, which also trafficks in public data. Apparently, Superget was able to gain access to the data by posing as a U.S.-based private investigator. Info Search said that, contractually, its data through Court Ventures was only supposed to be sold to licensed businesses in the U.S.
Enter the Secret Service
Superget.info was actually based in Vietnam and was brazen enough to pay Experian through wire transfers from Singapore. The biggest eye-opener, of course, is not that an identity theft group tried to get confidential information; that’s what they do. The biggest eye-opener is that Experian is supposed to be in the business of protecting its critical data, and, in fact, it sells ID theft protection services.
The Secret Service got involved, since it’s “the primary federal agency tasked with investigating identity theft/fraud.” It eventually lured a 24-year-old Vietnamese national behind Superget named Hieu Minh Ngo out of Vietnam and into the U.S. territory of Guam, where he was arrested. He’s now facing 15 criminal charges and could reap substantial prison sentences.
Experian, which is not known to be facing any penalties, says that info from its credit database was never accessed and that Court Ventures no longer resells Info Search data.