For almost two weeks, Equifax has been sending people affected by their massive security breach to a bogus website. The non-malicious creator of the imposter site was out to prove a point about Equifax’s model for post-breach consumer assistance.
In a tweet Tuesday, an Equifax representative who went by the name ‘Tim,’ wrote: "Hi! For more information about the product and enrollment, please visit: securityequifax2017.com."
The tweet was sent out in response to a question about Equifax’s free credit monitoring program for consumers affected by the company’s recent data breach. The only problem is that is not the original URL and website the embattled company set up for consumers. Equifax’s official site for information related to the incident is called ‘equifaxsecurity2017.’
The tweet was deleted on Wednesday morning, but was live on the internet for almost 18 hours straight, according to ARS Technica.
Eight tweets in all were sent out by Equifax directing people to the fake site dating back to September 9. Gizmodo has reported that as of early Wednesday afternoon, the remaining seven tweets directing consumers to the wrong site, were still live.
The look-alike website’s URL is titled ‘securityequifax2017,’ and was created by developer Nick Sweeting. Sweeting created the site to point out the danger of Equifax’s decision to create a portal called ‘equifaxsecurity2017,’ because of fears that malicious hackers could easily dupe people and steal their information again by simply creating a look-alike site as Sweeting did when he switched around the words ‘security’ and ‘equifax.’
Sweeting says his intentions were purely to point out that Equifax acted recklessly in their handling of people’s information after the incident earlier this month.
“It’s in everyone’s interest to get Equifax to change this site to a reputable domain,” Sweeting told Gizmodo. “I knew it would only cost me $10 to set up a site that would get people to notice, so I just did it.”
The developer commented on the real threats facing people who choose to continue visiting Equifax’s site.
“It only took me 20 minutes to build my clone. I can guarantee there are real malicious phishing versions already out there.”
Right after Equifax announced their epic data breach earlier in September, they started sending consumers affected by the breach to ‘equifaxsecurity2017.com,’ in order to offer those affected by the incident, the chance to enroll in identity theft protection services and post updates on the “cybersecurity incident.” The massive breach, which exposed highly confidential information, such as people’s social security numbers, affected over 140 million consumers in the US.