“Kushnir told me that when the questions page loads, you simply change the last part of the URL from “/acr/oow/” to “/acr/report,” and the site would display the consumer’s full credit report.”
Experian’s identity check was a URL you could edit. Thieves on Telegram knew it until the end of 2022. Even when Experian said it could not verify Krebs, the same trick showed his whole file, which listed four phone numbers and only one was ever his. Experian took the warning on Dec. 23 and ignored every request for comment. It sells your data, gets it wrong, and hands it to anyone who can type.