TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Perspectives | Data breach notifications may facilitate identity theft Related reading: Microsoft allowing companies to store all data in EU


It is a serious claim that data breach notification letters may facilitate identity theft. Rather than make an argument for that position, an explanation of how to accomplish identity theft using a data breach notification letter will be provided here and publicized elsewhere. When malicious actors begin performing the exploit, debate over the proposition reflected in the title will become moot.

The steps are not complicated and may be accomplished by nearly anyone; technical skills for hacking are not required.

  1. Obtain a copy of a breach notification letter that advertises free credit monitoring and provides contact information for a credit monitoring agency that will purportedly provide the service.
  2. Upon a news event proclaiming a data breach of a large retailer, financial institution, or company that provides payroll or accounting services to large employers, tailor the letter to appear to be from the breached entity. If the breached entity is a company that provides business services, rather than only consumer products, alter the letter to state that large retailers or employers use the company for payroll or other accounting services. Many people may readily accept that some large retailer uses a particular bank in an official-looking letter, because there may be no way for consumers to readily ascertain otherwise.
  3. In the contact information for the credit monitoring agency, put the website address for your own website – something that appears (at least superficially) to be legitimate and a phone number that will be forwarded somewhere outside the U.S. legal jurisdiction.
  4. Create a website that appears legitimate and both refers website visitors to your special phone number and also conveniently permits visitors to enter personal data in order to start their “free credit monitoring service” right away.
  5. Staff a call center where the phone number rings, with people trained to act as customer service representatives of the credit monitoring agency.
  6. Purchase a list of addresses, such as those commonly sold for direct mail advertising campaigns. Expect to pay more for lists that are advertised as having a higher rate of response. If possible, perhaps select a list that may be at least somewhat tailored geographically or demographically to coincide with likely customers of the breached entity or a retailer (which you had asserted in the letter to be a customer of the breached entity).
  7. Mail your breach notification letter to the addresses on the list, and wait for the phone calls to start coming in.
  8. Some consumers may investigate whether a breach had actually occurred. This is why it may be beneficial to send out your own letter under the cover of a legitimate breach event. When the consumers (who did bother to investigate) see news of the breach on the internet, they may be more likely to trust your letter and respond to your invitation to divulge important information.
  9. When your call center receives phone calls from panicked recipients of the letter, take in their personal information. Your call center staff may request all personal information that is necessary to perform credit monitoring and “verify” the callers’ identities. The callers will likely provide all the information necessary to accomplish a first-rate identity theft, without suspicion.

Why will this work?

Because your data breach notification letter will not urge the recipients to independently obtain the contact information for the credit monitoring agency by themselves. The serious problem here is that the consumers may have already received prior breach notification letters (from earlier breaches in which they were victims) – and most likely none of those letters urged the recipients to independently obtain the contact information, either.

A fundamental security concept is that an initial notification of an alleged security incident (or risk), and critical information regarding remediation resources, should arrive through different channels. Such a protocol can reduce the likelihood that a single compromise of one communication channel can induce someone to take actions that may be problematic. Unfortunately, however, many common data breach notification rules (whether law or regulation) mandate that the contact information for credit reporting agencies be included in the communication to breach victims. Companies (and vendors providing notification services) simply have no choice.

Although the intent is clearly for the victims’ convenience, the result is not entirely harmless: The current content of breach notification letters is conditioning consumers to become complacent in a poor security practice, trusting information regarding remediation within the same correspondence that provided the initial alert regarding a security incident or risk. Because many consumers have already seen at least one data breach notification letter, some may already be conditioned to improperly trust a single notice, and thus may be more susceptible to the exploit.

A solution, and reversal of the conditioning accomplished thus far, is not difficult: The requirement that the contact information for a credit reporting agency be included within breach notifications should be replaced with a requirement to encourage consumers to obtain the credit reporting agency’s contact information through independently verifiable sources. Additionally, it may be helpful to include an admonition to not trust company contact information found within any correspondence that arrives unexpectedly (as breach notification letters often do) in the future, and also a suggestion that consumers should generally use only contact information that the consumers had located with their own efforts, prior to disclosing information that could be used for identity theft.

If the requirement persists to include contact information for a credit reporting agency within breach notifications, companies that generate the notifications may wish to conspicuously note that the information is required by law, and also conspicuously inform consumers regarding independent verification being the more secure practice.

Photo credit: jakobnewman Envelope Patterns - 11 via photopin (license)


If you want to comment on this post, you need to login.

  • comment Richard Santalesa • Aug 23, 2018
    Seems like an Oceans 11-level effort for much less payoff potential. Have there been documented instances of this occurring?
  • comment Kelce Wilson • Aug 24, 2018
    Actually, it would be nothing close to a large effort, but instead a single day (or less) of effort one person, and likely under $1000 in fixed costs.  There will be an additional 15-20 minutes average marginal time cost (no additional financial expenses) for each successful target who calls in – less for targets who use the website.  Here is an estimate for each step: 
    1.	I already have a decent library of notification letters, and templates are in abundant supply.  The only cost is a few minutes of time to track one down.
    2.	Editing and formatting a letter to mimic a real breach event may require about 30 minutes.  
    3.	Reserving a website name costs another 30 minutes and about $20. 
    4.	Creating a spoof website is the most complex task, but is easily within the skillset of many people.  Perhaps 2 hours to get one up and running, hosting for $50 (only a single month is needed).  Cumulative so far is 3 hours, and under $100.
    5.	A call center really does not need to be anything more than a single person with one burner phone and one month of cellular service, for a small scope effort.  Maybe $100 and an hour or so to go to the store and wait in line, if you don’t want to wait for delivery of an on-line order.  Creating a convincing phone call script may take as much as 90 minutes.  Cumulative cost is now 5½ hours, and $200 or less.  For a larger effort, someone could spend more to get more call lines and hire people to staff them, if they wished.  But that is not necessary for a first attempt.
    6.	Mailing lists usually go for less than 4 cents per contact name, so maybe $400 for a list of 10,000 names.  Maybe 30 minutes to order one from one of the plethora of websites offering them. 
    7.	A printing and mailing service for about 1,000 targets (from your list of 10,000) would run another $400.  Perhaps an hour to set it up with one of the many services that are available.  So we’re now at 7 hours, and under $1000.  And, if your first run makes money, you have more contact names to use for a second batch.
    8.	Maybe a few minutes per target, for harvesting data that is taken in by the website. 
    9.	Maybe 15 minutes on the phone with each target who calls the burner phone. 
    Whenever a fundamental security principle is violated, as it is currently with many breach notification letter contents, the absence of a history of exploits should be interpreted as either good luck or lack of omniscience, rather than a sign that continued violation of the security principle is an acceptable option.  The security principle is clear:  An initial notification of an alleged security incident (or risk), and critical information regarding remediation resources, should arrive through different channels.  The violation of this privilege is equally clear. 
    Acting on a remediation recommendation that arrives in the same communication as a notification of a risk is rather bad idea.  Instead, at least some remediation information should be obtained through an alternate channel that is unlikely to have been compromised at the same time, in the same event.