> the data stolen in the breach could include full names, dates and places of birth, mailing and email addresses, and phone numbers on an undisclosed number of citizens
Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry and that it won’t happen again".
Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive.
The way to fix it is to empower one government agency to do aggressive pentesting against every other agency, hospitals, banks, infrastructure, and big corporations, with salaries matching the private sector. Impose a legally-enforced deadline to fix any issues, with a fine (for private actors) or demotion of the guy in charge of infosec (for state agencies).
Forget compliance checklists, KPMG "audits" and all that crap, just have government-sponsored hackers trying to get into everything like an attacker would.
France seems to have had a ton of government hacks in the past year at various levels, so it's sorely needed.
Or maybe the government should not require companies to KYC you for every little stupid thing or action you do in this world. What happened to requiring only the information that's actually required? Why do I need to be KYCd in the systems when buying banana, ordering delivery, etc.
Because of the inevitable breaches and leaks - KYC is the illicit activity. The selling point of KYC was preventing fraud and money laundering. It doesn't actually do that. Search for "largest money laundering settlements" and you will find 5 banks and one crypto scam.
Hey now, don’t forget the offer of “free credit monitoring for a year” - I feel like at this point I’ve gotten so many of those that if I signed up for them all, I’d have my personal info in twice as many probably-hackable locations as I do already.
Seeing another one of these breaches had me returning to look at local-first software. https://lofi.so
I feel like if we're going to make progress in preventing wholesale data breaches it will be through architectural innovations that attack the problem of why a trove of concentrated data needs to exist. Even if the government needs to be a central authority, are there ways to house the data that limit the blast radius?
I'm sure there are innumerable arguments why this can't help, but when the mainstream alternative is despair and helplessness, progress will be made in the margins.
I'm not sure about France, but here in Argentina all this info is assumed to be public. If you want a credit at a bank or shop, they ask for a physical copy of the national ID [1], probably a photocopy too, an electricity or water bill and perhaps other paperwork that is hard to get (verified phone number???).
It's supposed to be identifying information here. Usually, you can just send copies of those documents, which means that if you're looking to impersonate someone, you can easily produce fakes. And since everyone and their grandmother asks for these, people don't bat an eye and send them.
The coup de grace of security in France is signatures, though. Now, since you can't produce a physical signature over the internet, they'll ask for your phone number and send you a text with a code. Once you've entered it on their web form, you've proved undoubtedly you are who you say you are.
> in Argentina all this info is assumed to be public
Same here. You can probably can find my address and phone numbers fairly easily from my name by a number of methods. That doesn't mean it isn't bad when an organisation spews out, or allows to be sucked out, huge numbers of people's data. With a leak like this it is practical to try scam everyone the list, searching for each person's details individually, and having to enumerate those people in the first place⁰, would mean no such attack would scale in a way to make it worthwhile bothering¹.
--------
[0] This seems strange when you first think it, but: the most important thing being on such a list says about you, is that you are a real existing person, whose identity could be exploited somehow. That fact is what makes any other information valuable.
[1] except for high-worth targets, which is why spear-phishing is a thing
My full name, phone number, and address were leaked by TAP Air Portugal about five years ago, along with the details of my parents who were on the same booking. Since then, my dad has been targeted by those types of scams where a fraudster impersonates me to ask for money.
I never received a notification from TAP; I only found out a year later through my Google One security feature. I certainly didn't get an apology—much less a free travel ticket!
I do use an email alias everywhere. But I don't believe you can do the same with phone numbers. I tried using my twilio rented number and there is a way systems use to figure out if that is a real number for a person or a VoIP one. Though it is sometimes successful in use for signups and hence spam reduction.
Could set up 6 digit long extensions and only ever issue a few hundred of them in total.
Guess wrong 3x and goodbye.
Can also set some/most/all to go to voicemail so they can get in touch with you, but not really.
Or blackhole the invalid extensions to /dev/null voicemail but then you run the risk of legit misdials and you never get some important message.
The real vs “fake” number issue could be worked around by having your cell phone provider forward all calls to your VoIP number. It’s baked into gsm, don’t need a phone after initial setup: https://www.geckobeach.com/cellular/secrets/gsmcodes.php
That TAP data was leaked on a tor hidden service, in multiple files, and download was extremely slow on the days following the leak. One of the files was much smaller, and my friend had the bad luck to have his data in that one.
His phone was spammed so incessantly he had to change his number almost immediately.
I'm dissatisfied about the TAP leak as well! I was affected, and like you, didn't even receive a notification - nevermind compensation for having leaked my personal data to the dark web enabling all sorts of shenanigans that make my personal life difficult.
About 2 million portuguese there. Basically all active portuguese adults that have enough financial conditions to travel by airplane.
It was a fantastic leak, based from an excel file asked by a marketing department which forgot it inside a shared folder on the hacked (private) server. There was far more info there than just that, also included the details of employees and more interesting if they were on medical leave.
Curiously enough many of those employees were family members from politicians and well-known people. Some of those in long term sick leave were receiving a monthly salary while conducting live shows on festivals during the summer.
Nothing happened on the news. They all went silent about this case.
Fairly sure this is an ironic comment. (Credit monitoring is the useless thing companies give people in the US when their information is leaked -- everyone in the industry knows it's laughably unrelated to private information disclosure).
There is no such thing in France (or most countries for that matter). It's a pretty absurd system that gamifies and profits off heuristics, and results in a Kafkaesque nightmare where you can't get a job, rent a place or get a loan because of an arbitrary value assigned by a company with a profit motive. One that has no incentive to get things right or even get the right person.
How things work in France is much simpler and better. When you apply for a loan, the lender checks with Banque de France (national bank) if you have outstanding debts and if you've defaulted on any debts in the past 5 years. That's it, that and your proof of revenue is all they need.
Depends. According to DOGE, voter registration databases have people listed as 150 years old or deceased people receiving monthly government checks. Obviously a different govt than TFA, but govt databases are no less prone to inaccurate data. They are still run/managed by humans regardless of the govt in question
GDPR has solid fines for data breaches, but this doesn't work for government agencies. Just someone else's money going from one government pocket to another.
What they need is an automatic firing of the head of the government agency that suffered a breach. No question asked.
> These things will never change if the only penalty the company/agency gets is
I do not think penalties can prevent these situations. Perhaps they may be less frequent; perhaps people would get more compensation, but ultimately I do not think these can be prevented. The first consideration is why the data has to be stored in the first place. Naturally one can say "the government needs to know who is a citizen and who is not", and I can understand this rationale to some extent, but even then I wonder whether this has to be correct. Perhaps we could have a global society without any requirement to be an identifiable citizen per se. Things such as mandatory age verification-sniffing to never become an issue, because it is not needed and not possible and nobody would have an addiction-need to sniff for that data (we know Meta and co want that data, this is why their lobbyists run rampage via the "but but but somebody protect the children" lie).
I received the email telling me I am impacted today.
Ironically it changes nothing for me as that same data had already been leaked by the French government agency that handles unemployment benefits a couple years ago.
Silly me had not bothered deleting that account even after it was no longer necessary due to finding a new job.
It seems to me we must move away from worrying about ransomware, data breach, data protection as that ship has already sailed and everyone's PII has already been stolen. We should think of how to verify people's identities online (for things like government benefits etc). I have heard of the Dutch and the Japanese using national digital identity systems although I am unclear how they work. India is doing biometrics. I am curious what the US will eventually land on.
Biometrics is just something else to get leaked, terrible idea because it's even more sensitive (can be used to track you through cameras for example, like used in the Iran war).
This problem has long been solved with federated IdPs and MFA - something you own like OTP device/physical token besides something you know like SSN/tax id/password.
Most governments prefer biometrics of course because citizen privacy is the opposite of what they want.
I would not go that far to say all govts are like that. The main problem is majority of citizens cannot easily remember such things. Even simple PIN that is included in EU ID cards - most people don't remember or use. people want frictionless use.
Based on how things are, I feel like the US solution is just going to end up with me requiring a retinal scan to buy pants from Target online and then that scan will end up on the dark web along with my voice print and a scan of a my driver's license.
> We should think of how to verify people's identities online
France already has that, in multiple ways.
There is the France Connect SSO, which is kind of a federated SSO. You need at least one account which is physically proven (it could be with the Post Office which send you a letter with a code to confirm your address and idenntity / ask you to physically come to a post office for an ID inspection; the tax authority where there are also multiple physical verification hoops, the social security system, same), and can use that via the SSO to authenticate to all government services.
Separately, there is an app proposed that scans your physical ID's NFC chip with your biomettrics, compares that to a selfie you take, and uses that identity to authenticate you to stuff.
I find it especially ironic that they would leak all my data, given the fact that they would ask of me to forward them every piece of id imaginable whenever I needed to forge or amend a new one (when adding a mention on my driver's license for instance).
They do have to prove who you are, and to do that you need to show your ID(s) and they need to check it in their system. I don't understand your comment.
I already have to log to their website with 2 factor authentification.
I had to walk and physically present my id card, install the numerical identity app. That should be enough.
Also, apart from reuploading IDs, they ask for information such as age, name, place of living, and a thousand more things that they already have and doesn't need to be provided to establish that you really are you.
It’s kind of interesting that this happens so shortly after they proudly announced how easily they would’ve able to migrate all systems from Microsoft and US firms. Maybe next year will be the year of the Linux desktop
A possible outcome of AI-assisted hacking is that companies, governments, and people become more resistant to using software, and software adoption actually declines.
Great, now scammers can steal my identity directly from the government. I hope they release a tool to check if I'm impacted or at least email me about it.
Because the world is run by people who don't know anything, but have to pretend they know everything, so they can't ask those of us who have some idea about how IT security works.
what would be the point of the government fining itself though?
Now that I'm thinking of it, it would create the need for an extra gaggle of bureaucrats to oversee the process,so I suppose someone might see a point to it ...
You may think you're funny or something, but boy do I have news for you.
There absolutely are fines for French administrations. And, knowing the French tax system, they've probably found a way to levy VAT and some other taxes on top of those fines.
There are carve-outs to allow for governments to make exceptions, but it's besides the point.
If the government were to hold themselves to account, they would fine themselves some amount N, and pay itself N using your taxes. It also wastes other finite resources for all the paperwork and legal action involved that could be used for something else.
Speaking pragmatically, there's no point trying to hold the government itself to it's own laws. The only time citizens do hold the government accountable, it's always done in the form of hangings, or the guillotine in France's case.
Yet another example why NO ONE should trust age verification laws or companies like Anthropic forcing you to verify identity with shady companies like Persona (https://news.ycombinator.com/item?id=47872608). Whatever info you give up, it’ll be exposed one day.
I trust Google more than any government with my data. One needs security to survive the other couldn’t care less.
Google selling data? So far no one came to blackmail me for certain dispositions, while the other does as they want, IRS, foreign governments, social security whatever.
Google can be sued while the other gives itself a pass.
Who is the baddie?
In Germany the administration put massive duties on IT providers and added punitive damage as a looming consequence.
Fast forward and the government with its “Ha, we are so digital!” and “Europe is better than US in CS!” suddenly has to swallow some brutal medicine I guess.
I stick to my guns: Silicon Valley and especially Google is art regarding code and CS evolution. Same for FAANG etc.
EU is hubris to say the least.
Every time someone says “Let’s build our own Google/Cloud/…” a penguin dies.
E Invoice will be a brutal boomerang, XRechnung the greatest backdoor of all times.
I don't understand the downvotes. Literally every single German email provider took like 5 years to implement 2FA. Even now lots of security issues with many German providers that claim privacy. Even so-called DE-mail was sham. Still somehow people assume FAANG is crap in data security. (Yes, I am not demanding privacy from ANY MultiNational company)
Nothing really new here sadly, this information about me have leaked half a dozen of times in the past 2-3 years or so. These things will never change if the only penalty the company/agency gets is "send a message to your users saying you are sorry and that it won’t happen again".
The way to fix it is to empower one government agency to do aggressive pentesting against every other agency, hospitals, banks, infrastructure, and big corporations, with salaries matching the private sector. Impose a legally-enforced deadline to fix any issues, with a fine (for private actors) or demotion of the guy in charge of infosec (for state agencies).
Forget compliance checklists, KPMG "audits" and all that crap, just have government-sponsored hackers trying to get into everything like an attacker would.
France seems to have had a ton of government hacks in the past year at various levels, so it's sorely needed.
Fixing broken systems is very expensive, and also risky.
"The way to fix it" is probably not an easy one. Perhaps decentralized identities or storing less data helps, but it is not an easy problem.
Because of the inevitable breaches and leaks - KYC is the illicit activity. The selling point of KYC was preventing fraud and money laundering. It doesn't actually do that. Search for "largest money laundering settlements" and you will find 5 banks and one crypto scam.
I feel like if we're going to make progress in preventing wholesale data breaches it will be through architectural innovations that attack the problem of why a trove of concentrated data needs to exist. Even if the government needs to be a central authority, are there ways to house the data that limit the blast radius?
I'm sure there are innumerable arguments why this can't help, but when the mainstream alternative is despair and helplessness, progress will be made in the margins.
People don't have credit card like the one in US and Canada.
The vast majority use a debit card.
[1] Do you want my number? It's inside this list:
The coup de grace of security in France is signatures, though. Now, since you can't produce a physical signature over the internet, they'll ask for your phone number and send you a text with a code. Once you've entered it on their web form, you've proved undoubtedly you are who you say you are.
Same here. You can probably can find my address and phone numbers fairly easily from my name by a number of methods. That doesn't mean it isn't bad when an organisation spews out, or allows to be sucked out, huge numbers of people's data. With a leak like this it is practical to try scam everyone the list, searching for each person's details individually, and having to enumerate those people in the first place⁰, would mean no such attack would scale in a way to make it worthwhile bothering¹.
--------
[0] This seems strange when you first think it, but: the most important thing being on such a list says about you, is that you are a real existing person, whose identity could be exploited somehow. That fact is what makes any other information valuable.
[1] except for high-worth targets, which is why spear-phishing is a thing
I never received a notification from TAP; I only found out a year later through my Google One security feature. I certainly didn't get an apology—much less a free travel ticket!
When I was a kid most adults' full name, phone number, and address were available for free in the phone book.
They have been reporting millions in profits despite rising costs. What you propose would further elevate costs. Shareholders don’t want that.
Guess wrong 3x and goodbye.
Can also set some/most/all to go to voicemail so they can get in touch with you, but not really.
Or blackhole the invalid extensions to /dev/null voicemail but then you run the risk of legit misdials and you never get some important message.
The real vs “fake” number issue could be worked around by having your cell phone provider forward all calls to your VoIP number. It’s baked into gsm, don’t need a phone after initial setup: https://www.geckobeach.com/cellular/secrets/gsmcodes.php
His phone was spammed so incessantly he had to change his number almost immediately.
It was a fantastic leak, based from an excel file asked by a marketing department which forgot it inside a shared folder on the hacked (private) server. There was far more info there than just that, also included the details of employees and more interesting if they were on medical leave.
Curiously enough many of those employees were family members from politicians and well-known people. Some of those in long term sick leave were receiving a monthly salary while conducting live shows on festivals during the summer.
Nothing happened on the news. They all went silent about this case.
How things work in France is much simpler and better. When you apply for a loan, the lender checks with Banque de France (national bank) if you have outstanding debts and if you've defaulted on any debts in the past 5 years. That's it, that and your proof of revenue is all they need.
What is the penalty for the government?
Facts at Equifax
> These things will never change if the only penalty the company/agency gets is
I do not think penalties can prevent these situations. Perhaps they may be less frequent; perhaps people would get more compensation, but ultimately I do not think these can be prevented. The first consideration is why the data has to be stored in the first place. Naturally one can say "the government needs to know who is a citizen and who is not", and I can understand this rationale to some extent, but even then I wonder whether this has to be correct. Perhaps we could have a global society without any requirement to be an identifiable citizen per se. Things such as mandatory age verification-sniffing to never become an issue, because it is not needed and not possible and nobody would have an addiction-need to sniff for that data (we know Meta and co want that data, this is why their lobbyists run rampage via the "but but but somebody protect the children" lie).
Ironically it changes nothing for me as that same data had already been leaked by the French government agency that handles unemployment benefits a couple years ago. Silly me had not bothered deleting that account even after it was no longer necessary due to finding a new job.
This problem has long been solved with federated IdPs and MFA - something you own like OTP device/physical token besides something you know like SSN/tax id/password.
Most governments prefer biometrics of course because citizen privacy is the opposite of what they want.
Or... it's something that you always have on you which is incredibly hard to fake.
https://en.wikipedia.org/wiki/Hand_transplantation
France already has that, in multiple ways.
There is the France Connect SSO, which is kind of a federated SSO. You need at least one account which is physically proven (it could be with the Post Office which send you a letter with a code to confirm your address and idenntity / ask you to physically come to a post office for an ID inspection; the tax authority where there are also multiple physical verification hoops, the social security system, same), and can use that via the SSO to authenticate to all government services.
Separately, there is an app proposed that scans your physical ID's NFC chip with your biomettrics, compares that to a selfie you take, and uses that identity to authenticate you to stuff.
Like they didn't have access to it anyway.
Also, apart from reuploading IDs, they ask for information such as age, name, place of living, and a thousand more things that they already have and doesn't need to be provided to establish that you really are you.
If you want to build a society on information, then you cannot forget the most important group.
If that's sufficient to achieve anything then those systems are built on top of hopes and dreams.
"ANTS stated that it is currently in the process of notifying those identified as impacted."
Now that I'm thinking of it, it would create the need for an extra gaggle of bureaucrats to oversee the process,so I suppose someone might see a point to it ...
There absolutely are fines for French administrations. And, knowing the French tax system, they've probably found a way to levy VAT and some other taxes on top of those fines.
If the government were to hold themselves to account, they would fine themselves some amount N, and pay itself N using your taxes. It also wastes other finite resources for all the paperwork and legal action involved that could be used for something else.
Speaking pragmatically, there's no point trying to hold the government itself to it's own laws. The only time citizens do hold the government accountable, it's always done in the form of hangings, or the guillotine in France's case.
Google selling data? So far no one came to blackmail me for certain dispositions, while the other does as they want, IRS, foreign governments, social security whatever.
Google can be sued while the other gives itself a pass.
Who is the baddie?
In Germany the administration put massive duties on IT providers and added punitive damage as a looming consequence.
Fast forward and the government with its “Ha, we are so digital!” and “Europe is better than US in CS!” suddenly has to swallow some brutal medicine I guess.
I stick to my guns: Silicon Valley and especially Google is art regarding code and CS evolution. Same for FAANG etc.
EU is hubris to say the least.
Every time someone says “Let’s build our own Google/Cloud/…” a penguin dies.
E Invoice will be a brutal boomerang, XRechnung the greatest backdoor of all times.
Your data, time to shift everything into the EU.