Don't worry, we only lost the dangerous parts... not something personal like your dob
Don't worry, we only lost the dangerous parts... not something personal like your dob
Image Screenshot-from-2023-12-22-08-10-46 in James McKee's images album
Every time that there is a leak like this it's infinitely aggravating how the spin department tries to downplay what happened. If you are using SMS based MFA you probably want to stop doing that now.
You're viewing a single thread.
Edit: sorry, app didn't show the entire image by default, they DO list exactly what was lost, not a bad email tbh (although better if they didn't lose it)
Isn't it saying that they didn't have those bits so couldn't loose them?
It would have been more useful (but look worse for them!) If they just listed what was lost....
Yup and that's the infuriating part. It's not helpful or useful, it 100% a cya.
Your title implies they lost all the bad stuff though
With the IMEI and SIM card information they now have the details needed to take over MFA. I share my birthdate with people that I casually know, I try not to do that with MFA codes. Credit card details would be bad, but at this point with the number of people who have leaked it, I would be 100% surprised if you couldn't find our CC data via a google search.
Setup TOTP NOW. Mint added proper TOTP authentication as MFA a while back that should block sms based MFA. Might be a good way to prevent sim swapping attacks.
Might work for mint but what about all the other accounts with other companies using mfa?
The goal here is to prevent someone from requesting a SIM replacement to unlock your other accounts. Since the attacker can use the IMEI and SIM info to contact customer service. If you have MFA on your mint account then they should ask for extra info before sending the replacement SIM, which would help with the current situation.
The reality is they may not know exactly what was obtained, but they do know it wasn’t anything they don’t collect (like DOB, SSN, etc listed in the message). Instead of looking at this purely as a CYA message, instead looking at it as informing you as soon as they had any idea your information may have been impacted instead of waiting weeks/months to inform you. Don’t let perfect be the enemy of good.
Don’t let perfect be the enemy of good.
This is nice. I'ma keep it.