Experian faces class action for security lapses

Experian has been sued in a class action lawsuit following the consumer credit bureau's failure to ensure sufficient protections against consumer account hijacking, according to KrebsOnSecurity. The lawsuit noted that various existing Experian accounts had been reported by KrebsOnSecurity in July to be taken over by threat actors who created new accounts with personal data but different email accounts from their victims. Experian was accused of violating the Fair Credit Reporting Act by permitting account re-registration without prior verification of an existing account. Experian then said that cases reported by their customers were isolated incidents. "We believe these are isolated incidents of fraud using stolen consumer information. Specific to your question, once an Experian account is created, if someone attempts to create a second Experian account, our systems will notify the original email on file. We go beyond reliance on personally identifiable information (PII) or a consumers ability to answer knowledge-based authentication questions to access our systems," said Experian.