Experian Dragged Into Litigation Over Purchased Business’ Data Breach

Experian Plc is enmeshed in litigation over its 2012 purchase of the assets of data firm Court Ventures, which is at the center of a breach that exposed some 200 million American Social Security numbers to criminals.

States have launched a joint investigation into the breach involving one of the three major U.S. credit bureaus. The breach could have opened the door to tax fraud, credit card theft, and countless other financial crimes.

A Vietnamese man, Hieu Minh Ngo, last month pleaded guilty in New Hampshire federal court to running an underground website that offered access to personal data. He admitted to gaining access to a database of some 200 million Social Security numbers through an account with Court Ventures, which obtained the information through a data-sharing agreement with another company, U.S. Info Search.

Marc Martin, chief executive officer of U.S. Info Search, told Reuters his company’s agreement with Court Ventures and Experian was to provide information for identity verification and fraud prevention.

“We, like many others, provided data to Experian, who in turn sold data to customers they approved and monitored,” Martin said.

A federal court document describing the guilty plea said Ngo had signed up for the account by posing as a private investigator with a Singaporean company, SG Investigators, sometime before March 2012, which was when Experian agreed to buy the assets of Court Ventures.

Court Ventures owner Robert Gundling sued Experian in October 2013, saying the provider of consumer credit information owed him $2.3 million that was put into escrow when he received $16 million for the transaction.

Experian filed a countersuit in February, saying it had withheld those funds because Gundling did not fulfill the terms of the original contract. It accused him of providing misleading information about his business, including details about ties with SG Investigators.

Experian said in its lawsuit that Court Ventures had not disclosed that some customers could input names and states of consumers and then obtain their Social Security numbers.

A trial over the money is scheduled for March. An Experian spokesman declined to comment, as did Gundling and his lawyer, Alton Burkhalter.

Ngo’s compromise of the data through Court Ventures was part of a bigger scheme, selling a wide portfolio of stolen data from his home in Vietnam from 2007 to 2013, according to a court filing.

That business offered sets of individuals’ information that included street addresses, birth dates, employers and duration of work, driver’s license numbers, mothers’ maiden names, bank account numbers, emails, account passwords and stolen payment card numbers, the filing said.

Ngo’s case surfaced last year when blogger Brian Krebs wrote about his arrest after undercover Secret Service agents lured him to Guam. It surfaced again on Thursday when Reuters reported that several states were looking into the matter.

Experian spokesman Gerry Tschopp said the company would “fully cooperate” with state investigators.

(Reporting by Jim Finkle; Editing by Richard Valdmanis and Lisa Von Ahn)