top | item 15456533

(no title)

rlvesco7 | 8 years ago

Noticed this on Monday. After registering for fraud alert, they send an email that has link to http://www.equifax.com/fcra for free credit report. This was getting hijacked. But not if you used https://

discuss

Matt3o12_|8 years ago

Why would they send you to a http at all if they already have https. This just seems like complete incompetence. It’s not like they have an excuse like their ad networks don’t work with https.

BearGoesChirp|8 years ago

I know of companies with typos in their links that they email. These typos lead to scam sites. I've contacted them and they haven't yet fixed it. There needs to be a serious re-evaluation of the costs associated with failing such basic security measures like using https and just making sure you send people the correct link. Right now it isn't even a slap on the wrist.

froindt|8 years ago

Someone in marketing probably didn't know that it mattered. Same with the head person who approved the email.

But don't worry, they'll have an engineer approve it next time as well!

reaperducer|8 years ago

Probably because security is handled by the IT department, and email communication is handled by the much less tech-savvy Communications department.

tyingq|8 years ago

The specific js that was hijacked is here: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js

That page pulls it in.

Edit: maybe a red herring. Sure looks shady though.

Sujan|8 years ago

g051051|8 years ago

So was it Equifax that was hacked, or Fireclick?

jbeales|8 years ago

Looks like they just took the page down as I was poking around trying to figure out where the redirect(s) came from.

Edit: Of course the error message is truthful:

>The Equifax.com website and Equifax Member Center are experiencing unusually high volumes due to responses to the recently announced Cybersecurity Incident. We are working diligently to better serve you, and apologize for any inconvenience this may cause. We appreciate your patience during this time and ask that you check back with us soon.

jbeales|8 years ago

If you don't want to pull out your phone, throw Chrome into Responsive Design mode and you'll get the same results.