In what may be considered a small step in the right direction, Brian Krebs at KrebsOnSecurity the city of San Diego is suing credit bureau Experian for failing to notify consumers that their personal information was compromised in an ongoing criminal identity fraud giong back to 2013. California law requires consumers be notified in cases like this.
A very small, incomplete fix of the credit industry would be a major improvement, and basic infosec would be a great place to start. There is so much wrong with our financial system but the complete lack of diligence or effort shown by the credit bureaus to protect consumers presents a really, really easy political win for any legislators or prosecutors trying to show they have consumers’ best interests in mind. Good work, San Diego.