Equifax employee portal in Argentina listed 14K names, social security number-like DNIs of customers in plain text until notified by security researchers today
Brian Krebs / Krebs on Security :
Context & Ripple Effects
The Argentina portal exposure arrived days after coverage framed Equifax's wider breach as evidence of the risks of treating Social Security numbers as digital identifiers. It extends that concern to a separate Equifax workflow holding customer names and DNI numbers in plain text.
Related coverage later alleged that Equifax took months to address a reported public-site flaw, making the researcher-led discovery here relevant to scrutiny of the company’s vulnerability-reporting and remediation process.
First-order effects
- Equifax Argentina must secure the employee portal after researchers found 14,000 customers’ names and DNI numbers displayed in plain text; those customers’ identity data was exposed through an internal-facing workflow.
- The finding adds another Equifax data-handling incident involving identifier data, alongside the broader debate over Social Security numbers as digital identifiers.
Second-order effects
- Security researchers become a practical control point for Equifax’s exposed systems, while the company faces pressure to review access controls and data display practices beyond the portal identified here.
- Credit-reporting rivals and customers have a clearer reason to scrutinize whether personnel tools expose national-ID data as readily as consumer-facing services do.
Third-order effects
- The recurring exposure of identity-number data points toward security controls being assessed workflow by workflow, rather than treating a company-wide breach response as sufficient.
- If national identifiers continue to be stored and surfaced as routine account data, credit-reporting systems will remain attractive targets even when the exposure originates outside their primary consumer interfaces.
The trend: Identity-data security is shifting from perimeter-focused breach response toward tighter controls over every employee and customer workflow that displays national identifiers.