Up until late December 2022, hackers were using a flaw in Experian's site to get anyone's entire credit report using only their name, address, birthday, and SSN
Context & Ripple Effects
This flaw is the latest chapter in a decade-long pattern at Experian: back in 2017 its [[a:922501|credit-freeze PIN retrieval tool authenticated users on just four pieces of basic personal information]], and mid-2022 reporting documented hijacked accounts and weaknesses in the same authentication flow. Meanwhile the raw material for abuse was already circulating — the Equifax breach exposed up to 143M consumers' birthdays and SSNs, and researchers showed those same identifiers unlocked further data via the FAFSA site even after a similar IRS tool was pulled.
What changed here is scale and persistence: until late December 2022, anyone holding a person's name, address, birthday, and SSN — precisely the combination mass-leaked in prior breaches — could pull their entire Experian credit report. A full report aggregates accounts, balances, and inquiries, turning scattered leaked fragments into a complete financial dossier.
First-order effects
- Identity thieves with breached SSN-and-birthdate data could retrieve any consumer's full credit report from Experian, converting partial leaks into complete profiles usable for targeted fraud.
- Experian faces renewed credibility damage on top of the 2021 PIN-reset flaws and 2022 account-hijacking reports, all pointing at the same authentication architecture.
Second-order effects
- The episode demonstrates that knowledge-based authentication fails whenever the 'secret' answers were leaked years earlier, pressuring all three bureaus to move verification off personal-data questions toward out-of-band or document-based checks.
- With report access trivially abusable, consumer defense shifts toward proactive freezes and locks, increasing reliance on — and scrutiny of — the bureaus' own protection tooling.
Third-order effects
- If SSN-plus-birthday is simultaneously the key to identity verification and the most widely leaked data set in the US, the credential model underpinning consumer credit reporting is structurally obsolete — a case for regulator-mandated replacement rather than site-by-site patches.
- A record spanning Equifax's 2017 breach through Experian's repeated authentication failures builds momentum for treating credit-report access as critical infrastructure with enforced security standards instead of voluntary fixes.
The trend: US consumer credit reporting is being forced away from SSN-and-birthday knowledge-based authentication because that data set is now effectively public.