04x27 - Equifax security breach

[bunniefuu]

[Rock music]

♪ ♪

♪ ♪

[Cheers and applause]

John: welcome,

Welcome, welcome

To "last week tonight."

I'm john oliver.

Thank you so much

For joining us.

It has been yet another

Hectic week, from wildfires

In california to continuing

Problems in puerto rico

To more horrifying details

Concerning harvey weinstein.

And it's not just his behavior

That was troubling.

It's the way the people around

Him excused his behavior.

And nothing's more emblematic of

That than the story

Told by actress angie everhart.

She says while she was

Sleeping on a boat at the cannes

Film festival, weinstein broke

Into her room and masturbated

In front of her.

I told people on the boat.

I told people at the dinner

I was at, and everyone was like,

"Oh, that's just harvey."

John: what the f*ck?

So everyone knew, and they just

Went with it?

"Yeah, harvey's gonna burst into

Your room and masturbate.

That's just harvey."

He's like a sex-criminal version

Of the kool-aid man.

And while most now have

Condemned weinstein's behavior,

Incredibly, some initially tried

To defend him, from oliver

Stone, whose first response was,

"It's not easy what he's going

Through," to longtime friend

Donna karan, who took an

Incredible tack.

How do we display ourselves?

How do we present ourselves

As women?

What are we asking?

Are we asking for it?

It's not harvey weinstein.

You look at everything, all over

The world today and how women

Are dressing and what they're

Asking by just presenting

Themselves the way they do.

John: excuse me?

One, that's absolutely

Appalling.

And two, how would donna karan

Know how women are dressing

Right now?

It's not 1993.

Her most recent work

Included this hat.

"Well, howdy there,

Your excellency!

If it ain't pious the kid,

The cowboy pope!"

Now, both stone and karan did

Later apologize for their

Remarks, and just yesterday,

The motion picture academy

Made a big announcement.

The board of governors voting

Overwhelmingly to expel the once

Powerful and feared producer,

Saying the era of willful

Ignorance and shameful

Complicity in sexually predatory

Behavior and harassment

In our industry is over.

John: yes, finally.

The group that counts among

Its current members

Roman polanski, bill cosby

And mel gibson has found the one

Guy who treated women badly

And kicked him out.

So, congratulations, hollywood!

See you at the next oscars,

Where, and this is true,

Casey affleck will be presenting

Best actress!

So for now, let move on

To president trump:

The silver lining for anyone

Who died in 2015.

He spent his week continuing

Efforts to sabotage obama-era

Policies, beginning with

The affordable care act.

First, he signed an

Executive order intended to make

It easier for people to buy

Cheaper, shittier health care

Plans, which, based on

His signature, he did by putting

A pen in his mouth and having

A seizure.

But more importantly,

He also decided to eliminate

$7 Billion in subsidy payments

To insurance companies,

Subsidies which help offset

Health care expenses for around



Reduce premiums for many more.

And the results of that could be

Severe.

The nonpartisan congressional

Budget office has estimated

Ending these subsidies will

Push up premiums by about 20%

In 2018 and actually add

$200 Billion to the deficit

Over ten years.

John: yes, trump's plan is

Going to make insurance more

Expensive and lose the federal

Government more money.

It's a strategy you can read

About in his book:

"The art of being bad at stuff,"

Parentheses "including book

Titling," no end parentheses.

And even members of his own

Party know this is bad politics.

When he's raised the prospect

Of cutting off these subsidies

In the past, some have managed

To talk him out of it.

The problem is, republicans

Are playing checkers.

And trump is playing chex.

That's right.

Chex, the game of stress-eating

Chex mix because you do not

Understand your job.

Because that was not the only

Case this week where trump acted

Without seeming to fully

Understand the consequences.

It is official.

President donald trump has said

That he will no longer certify

That iran is complying with

The nuclear deal or that it is

In the united states'

National interest.

This goes against what his own

National security team and all

The allies and global powers

That signed the deal actually

Believe.

John: exactly, donald trump

Seems to be pretty much alone

On this.

His defense secretary thinks

Iran's in compliance, as does

His secretary of state,

And I'm pretty sure that

Mnuchin does as well, but I'm

So blinded by that guy's

Movie-star handsomeness

That I can no longer

Hear anything he says.

Prime beef, right?

Prime.

Beef.

Right?

Am I right?

The guy is hot.

[Applause]

You don't mean it.

Now, thankfully, trump's move

Does not instantly k*ll

The deal.

It's a little complicated, but

Basically, congress passed a law

Where the president has to

Re-certify the deal

Every 90 days.

No other nation has

A requirement like this,

Because it's stupid.

And now it goes to congress,

Whose options range from doing

Nothing to restoring sanctions,

Which could blow the whole thing

Up.

That would be insane,

Because essentially everyone --

Including the agency whose job

It is to monitor this -- agrees

That iran is in compliance.

So why is trump doing it?

Well, on wednesday he explained

His -- what we'll call

"Thinking."

I think it was one of the

Most incompetently drawn deals

I've ever seen.

$150 Billion given.

We got nothing.

We got nothing.

They got a path to nuclear

Weapons very quickly.

And think of this one.

$1.7 billion in cash.

This is cash out of your pocket.

What -- you know how many

Airplane loads that must be?

John: okay, for a start,

Stopping iran getting a nuclear

w*apon is not "getting nothing."

It literally makes life on earth

Safer.

As for the money, we didn't give

It to them.

All of it was theirs to begin

With.

It was just frozen under

Sanctions we've now lifted or,

In the case of that planeload of

Cash, it was money they paid us

For military equipment in 1979,

That we never delivered.

So he's wrong.

He's just wrong.

He just said a string of things

That were factually inaccurate.

You know what this means?

Oh, yes, we got him!

We got him!

Yes!

Wait!

Wait!

Stop!

Stop!

We didn't get him.

I just got a news alert.

He's still the president.

He's still the president.

We didn't get him.

Yeah, it turns out

Nothing matters.

I'm sorry.

He didn't know what he was

Talking about.

So, as I was saying, the iran

Deal now goes to congress.

But they can't renegotiate it,

Because the deal isn't just

Between the u.s. And iran.

It's between

All of these parties,

And they've all been pretty

Clear where they stand.

E.u. Leaders are defending

The current agreement and the

U.k., Germany and france say

That they are committed

To the deal as is.

John: yeah, of course they

Don't want to reopen the deal.

That's not how deals work.

If you buy a lamp on craigslist

For $40, then the deal is one

Person gets $40, one person

Gets a lamp.

Also, one of you will get

m*rder*d, but figuring out

Who gets m*rder*d and how is the

Joie de vivre of craigslist.

And as iran's foreign minister

Points out, this decision may

Severely limit the ability of

Trump, or indeed any future

Presidents, to make deals

From now on.

Nobody else will trust any

U.s. Administration to engage

In any long-term negotiation,

Because the length of any

Commitment, the duration of any

Commitment from now on with any

U.s. Administration will be the

Remainder of the term

Of that president.

John: and that is a huge

Problem.

Countries need to know america

Will honor its agreements

If they don't, it's going to be

An issue no matter the next

President.

No matter who that person is,

Whether it's president warren

Or president kaine or --

More likely,

President donald, jr.,

Followed by president eric,

Followed by president jared

And ivanka.

There's no reason to expect that

Won't happen.

So, this iran-deal decision

Is equal parts dangerous

And bizarre.

Trump is asking congress to fix

A deal they don't realistically

Have the ability to fix.

Fixes, incidentally, that may

Violate the deal, which already

Has a process for restoring

Sanctions if iran

Doesn't comply, which,

Remember, everyone agrees

That they are.

And he also threatened to

Pull out of the deal himself,

Even though his secretary

Of state had already said

He wouldn't, but who knows if

Those two are even speaking,

Considering tillerson apparently

Called trump a "f*cking moron,"

And trump publicly challenged

Him to an i.q. Contest

This week.

Look, as foreign policies go,

This is incoherent.

You can't call it realism

Or idealism or neoliberalism.

You can barely call it foreign

Policy.

The thing it's closest to is

A scared monkey in a submarine

Randomly pushing buttons.

And sure, that might be fun

To watch until it hits you,

"Oh shit, we're all on the

Submarine with the monkey."

And now this.

Announcer: and now it's

Autumn and that means only one

Thing.

Oh, boy.

Pumpkin spice latte.

A whole season in a cup of

Coffee.

Yeah, pumpkin spice latte.

It's officially pumpkin spice

Latte.

In summer, you can't get it.

No, you can't.

The pumpkin spice latte.

That sent me to the moon.

I am waiting for the pumpkin

Latte and trying to lose weight

So I had to stay away from it.

The pumpkin latte.

Pumpkin spice latte!

Forget about the leaves.

As soon starbucks has that

Pumpkin spice latte.

And they take away the

Pumpkin spice latte, I cry a

Don't cry, handsome actor

Man.

Pumpkin spice lattes are

Delicious.

They seem wholesome and they are

Only a average.

But are they r*cist?

Love your pumpkin spice latte

Coat type.

I didn't want to go pumpkin

Spice --

Is it x-rated?

Wait.

The bigger deal is this maple

Pecan latte.

It's going to push the pumpkin

Spice to the side.

f*ck maple pecan.

Pumpkin spice lattes forever!

John: moving on.

Our main story tonight concerns

Equifax, the company whose name

Sounds like a theatrical

Production in which daniel

Radcliffe plays a horse that

Fucks a fax machine.

Equifax is one of the

Big three credit reporting

Agencies, the companies

Who keep financial data on all

Of us, so people like lenders

And landlords can decide whether

Or not we're trustworthy.

So equifax controls some of our

Most sensitive information,

And about a month ago,

We learned this.

Breaking news from the credit

Monitoring company equifax.

Cyber thieves making off

With private information of 143

Million americans, nearly half

The u.s. Population.

John: it's actually worse.

It's now actually 145 million.

And I've got good news

And bad news.

The good news is by private

Information,

They don't mean your google

Search history.

So nobody knows about the time

You searched for "wario porn

Parentheses real,"

Or "world's richest dogs

Looking for assistants,"

Or "can loneliness cause

The farts?"

The bad news is, the information

They got could well be all this.

It's your name, social

Security number, birth date,

Driver's license, and addresses

Where you lived, information

That is mostly permanent,

Unless you're in federal witness

Protection.

John: wow, okay, that sounds

Bad, but here's a simple

Solution:

Just move 145 million people

Into the witness protection

Program.

That means joneses?

You're the thompsons.

Thompsons?

You're the campbells.

Campbells, you're the mendozas.

Mendozas, you're the joneses.

Wait, hold on.

Joneses, you shouldn't be there.

I made you the thompsons!

No, thompsons!

I made you the campbells!

Campbells, you're the mendozas!

Mendozas, why are you here?

You should be living in

The joneses' house in phoenix!

Oh, no, I shouldn't have said

Phoenix!

Oh, god, the joneses are dead!

The joneses are dead!

Forget the whole plan!

I was just trying to help!

I'm sorry for trying.

Oh, they are dead!

And I know there might be

Younger people watching this

Saying, "well, who cares?

We're the first generation

To routinely send pictures of

Our junk to each other over

The internet.

Why should we give a shit

About someone seeing our

Social security numbers?"

But you should know criminals

Can do a lot more with that

Number than they can

With a picture of your d*ck.

This information's gonna be

Sold left and right on the black

Market.

People are gonna be able to open

Up credit cards for the rest of

Your life once they have that

Information.

They can go out and purchase

A home in your name.

They can open bank accounts,

Take car loans.

Someone who has your social

Security number could actually

Take a job, they could file

Taxes, and even claim your kids

As dependents and be gone with

Your refund before you ever

Actually file a tax return.

John: no, no!

The tax benefit is the whole

Point of having children!

Without that, all you're left

With is your actual children,

Which, you know...

Ugh.

The point is,

This is a huge problem.

And in any other era, this

Would've been the biggest news

Story for a month, but now that

Every day's headline is simply

The words "everything batshit

Bananas again today,"

It's slipped under the radar.

It is worth asking

How the hell did this happen?

The short answer is,

"The people in charge have done

Literally everything wrong."

And let's start with just

The way equifax told us

About the hack.

In early september,

Their then ceo rick smith,

A man so bland he may as well be

Called "human person"

Or "frasier rerun," issued

A taped apology, but his remorse

Seemed a little less than

Heartfelt.

On july 29th of this year,

We discovered that attackers had

Gained unauthorized access

To certain equifax data files.

This is clearly a disappointing

Event and one that strikes at

The heart of who we are

And what we do.

John: holy shit.

Rick smith is so alarmingly

Mechanical, you probably have

To put him in rice every time

He gets wet.

Now, notably, he mentioned there

That equifax learned about

The breach on july 29th.

But even more notably,

That video was uploaded in

September, which is, and this is

True, after july.

So equifax knew about the breach

For nearly six weeks before

Telling the public.

And they claim they needed that

Time because their investigation

Was "complex

And time-consuming."

Although that's not all that

Happened in that time span.

Three equifax executives sold

Nearly $2 million in company

Stock days after the data breach

Was discovered.

John: wow, selling stock

Before the public knows there's

A problem is one of those things

That looks suspicious, whether

Or not you're actually doing

Something wrong, like walking

Into a petting zoo

With a bib on.

What exactly are you planning

On messily devouring?

And equifax defended that,

Saying, none of the executives

In question, including their

Chief financial officer,

Knew about the data breach.

Which raises another question,

How is that even possible?

Did they just ignore emails

With the subject line,

Data.

You stared blankly at me and

Said I'm going to order from the

Salad place."

And if you're getting frustrated

With that kind of incompetence,

Pace yourself, because this

Story gets a lot worse.

Apparently, there were multiple

Points where this hack could've

Been prevented.

And one of them is incredible,

Because equifax were alerted by

Homeland security back in march

That they needed to fix

A critical vulnerability

In their software.

But as lawmakers discovered

At a recent hearing, that's not

What happened.

There was one person,

Apparently, who forgot to tell

Somebody that they had a piece

Of software that needed to be

Patched.

John: yeah, it's not ideal

That a company guarding such

Valuable information leaves

Something that important down

To one person.

It's like finding out

Chase bank has a big red button

Labeled "lose everyone's money"

And the only thing stopping

Anyone from pushing it is frank.

And look, I love frank,

I love the guy,

But what if he has to pee?

And I'd love to say this is

An anomaly, but equifax has had

Multiple headline-grabbing

Breaches over the years.

And that's not even counting

Smaller incidents like this.

I checked my credit report

The other day online with

Equifax.

That was it, and next thing

I know, I have 300 pieces

Of mail sitting in my mailbox.

Every single one of these

Is addressed to her, but they're

Not hers.

Instead, she got other people's

Credit reports.

Now, names, social security

Numbers, dates of birth, current

And previous addresses, bank and

Loan account numbers all stacked

Up on a kitchen table

In biddeford.

John: that's not great,

And it really should've set off

Red flags at equifax when

Hundreds of different credit

Reports were

Reports were being mailed to the

Same address.

What did you think happened?

That every single fraggle

Checked their credit at once

Down at fraggle rock?

Down at fraggle rock?

Very nice.

And I know other companies

Have had breaches, but none

Remotely as damaging as this

New equifax one.

Because remember, this isn't

Target exposing customers'

Credit cards.

This is compromising

Social security numbers,

The things thieves could use

To open new credit cards

In your name.

And if your information was

Stolen which, remember,

Is about a 50-50 chance

It could haunt you forever.

You don't change

Your birth date.

You don't change your social

Security number.

Those who have been jeopardized

By this hack will have to

Protect themselves for years

Until they're dead.

John: it's true.

And think about it there's only

One other thing that you have to

Constantly protect yourself from

Until you're dead.

And that's f*cking death.

And you'd hope that equifax

Would do a decent job of

Mitigating the damage.

After all, they had nearly six

Weeks to work on a response.

But instead, their fuckups

Continued.

For instance, they created

A website for concerned

Consumers to go to, but then

This happened.

The site that equifax started

Is called equifaxsecurity2017

But a developer named nick

Sweeting wanted to show how easy

It is to create a similar,

Fake site, so he did.

He called it

Securityequifax2017.

John: exactly, someone

Created a fake site.

And if you're thinking,

"Who'd be dumb enough

To fall for that?"

Equifax, that's who.

Because they tweeted links

To that fake site

At least eight times.

Despite the fact the site had

A couple of tiny clues that it

Might be fake, from the headline

Reading, "why did equifax use

A domain that's so easily

Impersonated by phishing sites?"

To the fact that,

When you clicked on their

"Frequently asked questions,"

This happened.

♪ Never gonna give you up ♪

♪ Never gonna let you down ♪

♪ Never gonna run around ♪

♪ And desert you ♪

John: well-played,

Pranksters.

You have my respect.

But don't worry, equifax has

Tightened up their operation.

And to see how well they've

Done, you can just go to

Equifaxfraudprevention.com.

Not because it's their site,

But because it's our site.

We bought it two days ago.

And if you go there, you'll find

The message, "how were we still

Able to do this?

Why haven't you learned

Anything?"

But wait, there's even more.

Because equifax also offered

Consumers a year of free credit

Monitoring.

But when people tried to sign up

For the service, they noticed

Something.

Guess what, you lock into

Equifax terms of service when

You sign up for it, which means

That you can't sue the company.

You have to resolve any disputes

In forced arbitration.

John: exactly, you'd be

Giving up your right to sue, so

Legally, your best recourse

Would be shaking your fist at

The heavens while shouting

"Equifax!"

Now, they've since rescinded

That clause.

Although many frustrated people

Are now signing up for

Third-party credit-monitoring

Services like lifelock, who've

Been advertising everywhere,

And have seen a surge

In business in the wake of

The breach.

Although, if you are considering

Lifelock because you're mad

At equifax, there's something

You should know.

According to filings with the

Sec, lifelock purchases credit

Monitoring services

From equifax.

And that means someone buys

Credit monitoring through

Lifelock, lifelock turns around

And passes some of that revenue

Directly along to equifax,

Is that right, mr. Smith?

That is correct.

John: it's true.

Some of the money

You pay to lifelock goes right

Back to f*cking equifax, which

Could only be more infuriating

If you then found out the rest

Of it goes to toys for todds,

A charity that purchases

Sex toys for grown men

Named todd.

Buy your own sex toys, todd.

And equifax connections aside,

Lifelock has had repeated issues

Itself, including multiple

Settlements with the ftc

And a truly disastrous

Ad campaign a few years back.

I'm todd davis.

And I'm here to prove just how

Safe your identity can be

With lifelock.

That's my real social security

Number.

John: yeah.

Lifelock's then-ceo, todd davis,

Actually put his real social

Security number,



And billboards.

For a time, it was impossible

To escape his social security

Number.



It was a cocky move and one that

Resulted in him having

His identity stolen 13 times.

And I'm guessing the defense

For the people who took it was,

"I didn't steal his identity.

I literally got it off

The back of a truck."

So to put it mildly, lifelock

May not be your best solution

To the equifax crisis.

So what is?

Well, consumer advocates told us

The one big step everyone should

Take is go to all three large

Credit-reporting companies.

That's equifax, experian,

And transunion, and freeze

Your credit.

That way, no one can access it,

Including you, until you

Un-freeze it.

Now, the companies also offer

Their own credit-protection

Products, with names like

"Trusted id," or "credit lock

Plus," but they're often more

Expensive and offer fewer

Consumer protections.

If you need a way to remember

It, locks are something

You don't want.

Think of justin bieber's

Dreadlocks.

A terrible decision.

Whereas freezes are great.

Think of this tiny penguin

Losing its frozen mind.

♪ ♪

See?

So, to recap.

Locks?

Yuck.

Freezes?

Whee!

Now, here's the thing.

Freezing and unfreezing

Your credit can cost money,

Which will go back to

These companies.

Because seemingly, they just

Can't f*cking lose.

And if you need any more proof

Of that, on the very same day

That congress was yelling at

Equifax's former ceo, it emerged

That the company had just been

Awarded a $7 million contract

By the irs to prevent fraud.

Which led one senator to make

A pretty brutal comparison.

You realize to many americans

Right now that looks like we're

Giving lindsay lohan the keys

To the minibar.

I understand your point.

John: that was the pause

Of a man thinking,

"Do I let that pass?

Do I correct him on how

To pronounce lohan?

Or do I double down

And pronounce her name

Lingonberry lohoneybaloney?"

And you should know that irs

Deal has been suspended.

Not canceled, by the way,

Just suspended,

Which might make you angry.

The problem is, that anger won't

Have much impact on equifax.

They make most of their money

Selling our data to businesses

Like banks.

So in their eyes, we're not

The consumer.

We're the product.

To think of it in terms of kfc,

We're not the guy buying the

Ten-piece buckets.

We're the f*cking chickens.

So for the time being,

Businesses are the only ones

Who can exert influence here.

And as one colorfully dressed

Expert pointed out, that's not

Going to happen anytime soon.

I haven't heard any big

Company come out yet and say

We're not going to use equifax

Anymore for their credit scores.

Good point.

So far, everybody's been

Quiet, and I don't know what

They're waiting to hear.

This is outrageous.

They should be done.

But I bet you because

It's america, they'll be okay.

John: here's the thing.

That angry business-casual

Farm animal on fox business

Is talking sense.

And that sentence shows just how

Bad things are.

So in the long term, there

Should clearly be a major reform

To this industry and how

It's regulated.

But that's going to take time.

Until then, you need to freeze

Your credit reports with

All three of these companies,

And only un-freeze them when you

Need to apply for credit.

And because the freeze option

Can be hard to find on their

Sites, if you go to our twitter

Feed, we will give you the exact

Links to do it.

And when you do, they'll give

You a pin number that you need

To un-freeze it, so don't lose

That, or at least make it

Something memorable,

Like 457-55-5462.

But not that.

Because of course,

That's todd davis's

Social security number.

And now this.

Announcer: and now:

New york city mayoral candidate

Bo dietl makes a splash.

We begin with opening

Statements.

I've got to say go, yankees.

I was mugged 500 times.

Stabbed, shot at, hospitalized.

What did you make last year?

I made 1.8 million.

If I had my head in a potato

Field and I listened to this

Man, I would say I would vote

For him too.

The guy was guarding moose.

Mr. Dietl.

I haven't asked the question

Yet.

Me a new, general population.

This is one of the issues in

Which our mayor has --

What is that wall?

What are we hiding?

Is it the berlin wall?

If you don't follow the

Rules.

To the assembly member.

Only one.

Turn off dietl's mic.

You keep interrupting.

You said "a muslim guy who

Works for the state was to blame

For your problems."

You referred to your attorney as

Your "jewish lawyer" and you

Said you knew you lost your

Court battle and you are trying

To run this a demographic is the

African-american judge, you

Said, it looked like bill

De blasio's wife.

You are wrong, what you just

Said.

All I said was the judge was

Very familiar looking, as the

Mayor's wife.

Two beautiful eyes and a smile

And they looked similar.

I never used the word

African-american.

Okay, okay.

All

All right.

Turn off the mic.

Thanks for watching.

These vote next month.

John: that's our show.

Thanks so much for watching.

Good night!