Experian ( one of the big-three U.S. credit bureau companies ) is facing a class-action lawsuit over their negligent role in the sale of personal data to a Vietnamese buyer who was involved in an identity theft service.
On July 14th, Hieu Minh Ngo was sentenced to 13 years in a U.S. federal prison for operating websites that resold consumer data from an Experian subsidiary called Court Ventures to identity thieves.
Court Ventures had a database of consumer information that reportedly contained personal information on over 200 million adults in the United States and Ngo had access to all of it.
Ngo reportedly made $2,000,000 for the sale of this consumer information that was used in identity theft scams.
Ngo reportedly accessed and resold U.S. consumer data, including Social Security and drivers license numbers, to identity thieves, who then used the information in their financial scams.
According to the Internal Revenue Service, some of this consumer data was used to file 13,673 fraudulent personal tax returns that totaled around $65,000,000 in tax refunds.
According to Assistant Attorney General Leslie R. Caldwell, Ngo sold millions of stolen U.S. identities through his websites Superget.info and Findget.me to thousands of cyber criminals around the world from his home in Vietnam.
In 2013, an undercover U.S. federal agent convinced Ngo to travel to Guam by offering him access to more consumer information. Ngo was then arrested in Guam for his role in the identity theft scams.
Ngo could have faced 24 years in federal prison, but received a 13 year sentence after he cooperated with federal investigators and provided information that led to the arrest of over a dozen of his U.S. customers.
On July 17th, 2015, three people filed a class-action lawsuit ( Maudie Patton et al v. Experian Data Corp. ) in a California federal court against Experian, claiming that Experian is negligent for allowing Ngo to buy access to the company’s consumer database for almost 10 months.
According to the lawsuit, Ngo obtained access to the Court Ventures database after passing himself off as a private investigator, using the alias Jason Low and the fictitious business name of SG Investigators.
Ngo reportedly paid for his Court Ventures account using cash wire transfers from a bank in Singapore.
Ngo was already using the Court Ventures database when Experian bought the company in 2012 for a reported $18 million.
The lawsuit alleges that Ngo’s company, SG Investigators, was Court Ventures’ largest buyer of consumer information when Experian purchased Court Ventures in 2012 and that Experian did nothing to investigate Ngo or his company.
From the lawsuit:
Experian, however, intentionally or with reckless disregard failed to do so, stood willingly by, facilitated the illicit operation, and reaped the financial benefits of the acquisition of CVI for another ten months.
The complaint also claims that this data security breach is one of the largest breaches involving consumer data in the history of the United States.
The suit accuses Experian of violating the Fair Credit Reporting Act (FCRA).
In addition to asking for statutory damages, declaratory and injunctive relief, and reimbursement for the plaintiffs’ court costs and legal expenses, the suit asks that Experian notify everyone who was affected by Ngo’s crime.
Since 2013, Experian has been entangled in a related lawsuit ( Court Ventures v. Experian ) with the former owner of Court Ventures over who is liable for Ngo’s access to the consumer data.