US comms provider AT&T has routinely denied responsibility for multiple data breaches but the revelation that they leaked personal data belonging to 73 million current and former customers may finally prompt American consumers to appreciate how much their trust is being abused. The correct response to this breach would involve addressing the root cause of data breaches. More should be spent on securing data, but the track record of failure suggests AT&T management will never reach that conclusion. They are following what has become the standard playbook for big US corporations: make an apology, play down the significance of the breach, shift the burden to victims by telling them to be ‘vigilant’ of follow-on crimes, and give them ‘complimentary’ credit monitoring for a one-year period. This is the opening paragraph of the letter AT&T sent to victims of the breach:
At AT&T, we take the security of your data very seriously. We’re writing to inform you that AT&T has determined that some of your personal information was compromised. To help protect your identity, we’re offering you one year of complimentary credit monitoring, identity theft detection and resolution services provided by Experian’s® IdentityWorksSM.
In other words, crimes will be committed using the victim’s data, but some other big US business may tell the victim when it occurs. Why anyone would think this might be an adequate response to a never-ending series of data breaches is beyond my comprehension but it starts to become clear how the private sector has become incentivized to behave like this. Former Assistant US Attorney Thomas O’Malley explained why in a recent social media comment. O’Malley refers to the big three US credit agencies — Experian, Equifax and TransUnion — as an oligopoly before observing:
…Your AT&T breach letter refers victims like you to Experian’s free credit report marketing website because AT&T is using Experian to provide some customers (apparently not you) with 1 year of “complimentary credit monitoring, identity theft detection and resolution services by Experian’s IdentityWorks.”
…Once the “complimentary” service expires, Experian constantly markets its paid service to victims for $25-$35/month.
US law means consumers can get credit reports for free, but that lowers the incentive to sign-up for a paid service like that offered by Experian. An incident like this, affecting 73 million people, hence becomes a golden opportunity for Experian to acquire many new paying customers when their first year of cover expires. AT&T pays for one year of service from Experian, presumably at a discounted rate because they are buying in bulk, and then Experian can profit from an enlarged customer base a year later.
