TalkTalk Hacking

Figgerty

Alibean121 Thanks for replying.

I will make a few phone calls tomorrow to find out the situation and if she is one of the unlucky ones to have her data accessed, I will suggest she registers with Cifas. I presume they will accept her!

The fact that names, telephone numbers may be 'out there' when the number who had her information previously was very small puts her at more risk of being scammed.

I will also get her to write to Noddle and demand that the details given for her registration is removed from their system. The data was supplied for her registration and they were unable to register her so they should remove it.

masonic

Figgerty wrote: »

I will also get her to write to Noddle and demand that the details given for her registration is removed from their system. The data was supplied for her registration and they were unable to register her so they should remove it.

How is she going to convince them to do that if they can't identify her as a real person? Also, supposing they do conclude that she really exists, don't they have to retain details of failed registration attempts as they may be required to pass these on to other CIFAS members or other fraud prevention agencies?

I will suggest she registers with Cifas.

Since Noddle (Callcredit) is a CIFAS member, then they'll get her details again anyway if she does this.

Figgerty

masonic wrote: »

How is she going to convince them to do that if they can't identify her as a real person? Also, supposing they do conclude that she really exists, don't they have to retain details of failed registration attempts as they may be required to pass these on to other CIFAS members or other fraud prevention agencies?


Since Noddle (Callcredit) is a CIFAS member, then they'll get her details again anyway if she does this.

I am totally confused now. Hopefully I will find out shortly what a failed registration means in her circumstances. She asked me what would happen if Noddle was attacked as they now had more information on her than Talk Talk have. I didn't have an answer but it made me wonder about the level of security they deploy.

Futuristic

Figgerty wrote: »

I am totally confused now. Hopefully I will find out shortly what a failed registration means in her circumstances. She asked me what would happen if Noddle was attacked as they now had more information on her than Talk Talk have. I didn't have an answer but it made me wonder about the level of security they deploy.

With that approach she should then be questioning every single site she goes on and enters any details on. The threat will always remain and could happen, considering the fact for example JP Morgan one of US's largest bank was hacked resulting in 76m customers data being leaked...

Sadly site hacks are becoming common and up to the companies to ensure their infrastructure is secured and encrypted.

The issue here is TalkTalk didn't learn from their mistakes, this is now the 2nd/3rd hack in 8 months. They clearly haven't secured their infrastructure, one can let it go the first time but the 2nd, 3rd for a huge company is extremely poor.

alibean121

Figgerty wrote: »

I am totally confused now. Hopefully I will find out shortly what a failed registration means in her circumstances. She asked me what would happen if Noddle was attacked as they now had more information on her than Talk Talk have. I didn't have an answer but it made me wonder about the level of security they deploy.

I think your energy is better spent educating your neighbour on identifying frauduent callers. If your neighbour really is as vulnerable as you think, they're a fraud victim waiting to happen. I really wouldn't be hung up on data leak. Data leak is basically inevitable in my opinion, you should proceed on the basis that a lot of information about you is in the public domain and move on.

Regardless of the failed application, callcredit (noddle) like other credit reference agencies almost certainly WILL have data on your neighbour from their credit accounts. Potentially just not enough to securely and without a doubt match them to their credit record without further ID checks. You have no right to have your credit record expunged so forget it and move on.

Figgerty

Futuristic wrote: »

With that approach she should then be questioning every single site she goes on and enters any details on. ..
.

She can use email and that's about it. She has to have help accessing her online bills and that is about the extent of her internet use.

Figgerty

alibean121 wrote: »

I think your energy is better spent educating your neighbour on identifying frauduent callers. If your neighbour really is as vulnerable as you think, they're a fraud victim waiting to happen. I really wouldn't be hung up on data leak. Data leak is basically inevitable in my opinion, you should proceed on the basis that a lot of information about you is in the public domain and move on.

Regardless of the failed application, callcredit (noddle) like other credit reference agencies almost certainly WILL have data on your neighbour from their credit accounts. Potentially just not enough to securely and without a doubt match them to their credit record without further ID checks. You have no right to have your credit record expunged so forget it and move on.

Perhaps I should take your advice but I don't let go easily.
I need to speak to a credit agency to get a better idea of how they operate. I'm sure you are right about having a credit record deleted but I want them to explain why they can retain very personal data on customers that fail the registration and do not obtain the service for which they provided that information.

Thanks for replying.

masonic

Figgerty wrote: »

PI want them to explain why they can retain very personal data on customers that fail the registration and do not obtain the service for which they provided that information.

What "very personal data" did she provide to them that credit reference agencies wouldn't already have?

Edit: You might also find it useful to read this guide, which explains a bit more about credit reference agencies, what data they hold, etc: https://ico.org.uk/for-the-public/credit/

Figgerty

masonic wrote: »

What "very personal data" did she provide to them that credit reference agencies wouldn't already have?

Edit: You might also find it useful to read this guide, which explains a bit more about credit reference agencies, what data they hold, etc: https://ico.org.uk/for-the-public/credit/

I should have said private not personal. She has supplied her 3 forenames & surname, date of birth. bank card details including the CSV code, address, telephone number and email address - all to one company. The only other company that has that level of information on her is her bank and they do not have an email address for her. She does not shop online nor over the phone so her information is not readily available on the net.

Frankly, this TT data hack has also made me worry about the security of the data held on me by all companies, including Noddle. Any criminal getting their hands on ALL this information on one person has a much better chance of scamming anyone than someone with just a telephone number and/or email address. They would be very convincing.

Thanks for the link to the ICO.

colsten

Figgerty wrote: »

She has supplied her 3 forenames

Which could explain why Noddle didn't find her.

What name(s) does she use with her bank(s) and on the ER?

If she is normally known as Mary Smith, Noddle won't know it's her when she says her name is Mary Anne Mabel Smith.