“Experian’s page for retrieving someone’s credit freeze PIN requires little more information than has already been leaked by big-three bureau Equifax and a myriad other breaches.”
A credit freeze is the one defense consumers are told to use. Experian lets anyone recover the PIN with a few answers anyone can look up, and sends it to whatever email address you type. It doesn’t notify the email already on file. Krebs flagged the same weakness in 2017, and Experian still hasn’t fixed it.