Equifax And Social Security

     Dave Lindorff at Salon wonders "How badly did Equifax breach damage the Social Security system?" The question arises because Equifax, which has suffered a massive hacking breach, has a contract with Social Security to help with security for the mySocialSecurity system that allows Americans to have some degree of access to their Social Security records.

     It's a reasonable question to ask. Unfortunately, when Lindorff asked Social Security, he got nothing. Their public affairs office refused to answer questions.

     Let my try to give the answer that Social Security should have given. Social Security obtains information from Equifax to verify identities but gives none to Equifax in return. For example, Social Security would ask Equifax for information on a person who is attempting to establish a mySocialSecurity account and those records might show that the person had recently purchased a car. Social Security would ask the person what brand of car they purchased. If the person attempting to open the mySocialSecurity account is the true number holder, they'd be able to answer the question and open the account. The key fact is that there is no information exchange. All of the information goes in one direction, from Equifax to Social Security. Equifax gets no information in return apart from the knowledge that Social Security was asking for information on that person.

     If there is a problem, it would be that the information hacked from Equifax could be used to open mySocialSecurity accounts but that risk quickly disappears assuming Equifax has stopped the data breach since Social Security is only using recent information to verify identity. Also, even apart from the Equifax hack, identity thieves have been able to access mySocialSecurity accounts to change bank deposit information to divert payments made to claimants. So far, Social Security has regarded this as a low level problem. To some extent that's true. It doesn't take long for people to complain about not receiving their Social Security benefits so little money is stolen and it's all eventually restored to the rightful people. However, it's a big problem for those who are deprived of their Social Security benefits for a month or two or three. Social Security seems to prefer that this not be publicized since it undermines their effort to get people to open mySocialSecurity accounts.
     I should say that Social Security eventually got its act together and was able to give a terse but accurate response when the Wall Street Journal asked the same question. The Wall Street Journal article is behind a pay wall.
     Update: Social Security really should have put out a statement on this as soon as possible after the Equifax breach became public. Two Senators have written a letter to  the Acting Commissioner asking about Equifax.