TheHill reported that Equifax posted a tweet of a link to a would-be phishing site to victims of its massive breach rather than the breach information site it intended.
This happened last Monday when a, Equifax’ credit monitoring service TrustedID customer asked about cancelling his subscription in exchange for the free year of TrustedID offered to the victims.
A tweet from Equifax’ official account posted, “Hi! For more information about the product and enrollment, please visit: [the url of the fake site] -Tim”
The company seemingly intended to send a link to equifaxsecurity2017.com which is the site with information on how to sign up for TrustedID. Alternatively, the tweet indicated equifaxsecurity2017 as securityequifax2017.
The securityequifax2017 web address is registered to Nick Sweeting, a security researcher. It was said that he already checked the site to prevent scam artists from using it to con potential victims for possible phishing information via Equifax.
To assure users that scam will be prevented, experts advise for companies to host their sites under their domain name. For example, Equifax should have host equifaxsecurity2017.com under equifox.com instead.
Equifax released a statement as the tweet was taken down last Wednesday, “All posts using the wrong link have been taken down. To confirm, the correct website is https://www.equifaxsecurity2017.com. We apologize for the confusion.”