KrebsOnSecurity reports that Experian, one of the three major credit bureaus, sold financial data on Americans to an identity theft service “that sold Social Security and drivers license numbers â€” as well as bank account and credit card data on millions of Americans.”
In November 2011, this publication ranÂ a story about an underground service called Superget.info, a fraudster-friendly site that marketed the ability to look up full Social Security numbers, birthdays, drivers license records and financial information on millions of Americans. Registration was free, and accounts were funded viaÂ WebMoneyÂ and otherÂ virtual currencies that are popular in the cybercriminal underground.
Each SSN search on Superget.info returned consumer records that were marked with a set of varying and mysterious two- and three-letter â€œsourceid:â€ identifiers, including â€œTH,â€ â€œMV,â€ and â€œNCO,â€ among others. I asked readers who may have a clue about the meaning or source of those abbreviations to contact me. […]
That changed in the past week. An individual who read a story about the operators ofÂ a similar ID theft service online having broken into the networks of LexisNexis and other major data brokersÂ wrote to say that heâ€™d gone back and reviewed my previous stories on this topic, and that heâ€™d identified the source of the data being resold by Superget.info. The reader said the abbreviations matched data sets produced by Columbus, Ohio-basedÂ USInfoSearch.com.
Contacted about the readerâ€™s claim, U.S. Info Search CEOÂ Marc MartinÂ said the data sold by the ID theft service was not obtained directly through his company, but rather viaÂ Court Ventures, a third-party company with which US Info Search had previously struck an information sharing agreement. Martin said that several years ago US Info Search and CourtVentures each agreed to grant the other company complete access to its stores of information on US consumers. […]
In March 2012, Court Ventures wasÂ purchasedÂ by Costa Mesa, Calif.-basedÂ Experian, one of the three major consumer credit bureaus. According to Martin, the proprietors of Superget.info had gained access to Experianâ€™s databases by posing as a U.S.-based private investigator. In reality, Martin said, the individuals apparently responsible for running Superget.info were based in Vietnam.
Martin said he first learned of the ID theft service after hearing from aÂ U.S. Secret ServiceÂ agent who called and said the law enforcement agency was investigating Experian and had obtained a grand jury subpoena against the company. […]
[A]ccording to Martin there were other signs that should have alerted Experian to potential fraud associated with the account. For example, Martin said the Secret Service told him that the alleged proprietor of Superget.info had paid Experian for his monthly data access chargesÂ using wire transfers sent from Singapore.
Read the full report for more details.