Free credit report site appears to be source for celebrity data

Hackers successfully answered a series of questions, enabling them to download reports, according to a source

A website that provides US consumers with a free annual credit report appears to have been the source used by hackers to download those of celebrities including Beyoncé and government officials including Federal Bureau of Investigation Director Robert Mueller.

On Tuesday, a website called "" published Social Security Numbers, previous addresses, and birthdates of a range of well-known people, including former Secretary of State Hillary Clinton, Jay Z, Michelle Obama, Vice President Joe Biden, Hulk Hogan, Donald Trump and U.S. Attorney General Eric Holder, among others. In the hacker world, the practice is known as "doxing."

An FBI spokeswoman confirmed the agency is investigating the breach. All told, hackers released information on 20 people, but credit reports were not available for every victim.

Some of the personal data included credit reports from TransUnion, Experian and Equifax, the three main U.S. credit-rating agencies. Equifax spokesman Tim Klein said the source for the credit reports appears to be "" and not the result of a breach of the credit reporting agencies' databases. was set up by the three credit agencies to allow consumers to download a free credit report annually, according to the U.S. Federal Trade Commission. The website, which is managed by a company based in Atlanta called Central Source, could not be immediately reached.

Consumers are asked as many as six specific questions related to recent payments in order to gain access to their report, such as how much their mortgage payment is or the last payment made on a credit card they hold.

In this breach, it appears the hackers nailed all of those questions accurately for some of the victims, indicating they may have access to other sources of information on victims as well. According to dates on the credit reports, several had been pulled in the last few days.

"This is really detailed information," Klein said. "It appears that some fraudsters were able to get this sort of personally identifiable information on some celebrities and therefore were able to go through this website and access some elements of their credit report."

Identity thieves are known to do meticulous research on their victims, but often a surprising amount of personal detail is often freely available online.

Klein said it has been confirmed four people had their information accessed through, but some of the published information is inaccurate.

TransUnion said in a statement its systems were not hacked. The fraudsters had "considerable amounts of information about the victims" already, which enabled them to illegally access the credit reports, it said.

"TransUnion is taking steps to assist the individuals affected to help minimize any potential impact," the company said. "We are conducting our own internal investigation and working closely with law enforcement." has a country code top-level domain of ".su," which was assigned to the former Soviet Union but is still in use. Those running the website appeared to be using CloudFlare, a San Francisco-based company that provides a worldwide network of data centers intended to speed the delivery of web pages and reduce bandwidth. It was unclear which company is providing hosting services.

A Twitter feed for has already been suspended. The two posts on the feed appeared to be written in Russian, according to a snapshot from Google's cache.

The tag line for the site, which was still up as of Tuesday evening, read: "If you believe that God makes miracles, you have to wonder if Satan has a few up his sleeve."

Send news tips and comments to Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags U.S. Department of Justicesecuritydata breachdata protection

More about EquifaxFBIFederal Bureau of InvestigationFederal Trade CommissionGoogle

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts