【passion, eroticism, and sexual energy】

Equifax can't seem to get anything right. After exposing the personal information of potentially 143 million Americans to hackers,passion, eroticism, and sexual energy the credit reporting agency is under fire yet again for the way it attempted to secure the credit reports of those affected. It turns out that process, too, was vulnerable to cybercriminals.

Now, the company is scrambling to fix what can only be called a bungled response to the data breach. For some victims, it might even be too late.

The problem lies in how Equifax went about implementing credit freezes — something consumers worried about identity theft and fraud should implement. Essentially, if you request a credit freeze, Equifax will no longer send out credit reports to those who request it. That means if someone tries to open up a credit card in your name, the issuing bank won't be able to get a hold of your credit report. As such, they will deny the fraudulent application.

But what happens if and when you decide that you need a new credit card? Well, then, you simply put in an unfreeze request and validate that it's actually you (and not the aforementioned criminal) with a PIN provided by Equifax. Except, here's the thing: The PIN wasn't randomly generated. Instead, it was a timestamp based upon when you asked for the credit freeze.

And you guessed it: those PINs are vulnerable to being brute-forced by hackers.

This Tweet is currently unavailable. It might be loading or has been removed.

In other words, if someone had your social security number and tried to do something shady — only to find your credit was frozen — they could unfreeze it by guessing your PIN. Not too hot, right?

This Tweet is currently unavailable. It might be loading or has been removed.

The company is taking a lot of criticism for this online, and a spokesperson told Ars Technicathat it would change the process by which PINs are generated.

"While we have confidence in the current system, we understand and appreciate that consumers have questions about how PINs are currently generated," explained the spokesperson. "We are engaged in a process that will provide consumers a randomly generated PIN. We expect this change to be effective within 24 hours."

But what if you already received one of the shady PINs? Well then, you can request that Equifax change your existing one. Which, considering how badly the company has handled pretty much every aspect of this breach, is sure to go over flawlessly.