It’s being reported by users of the credit score company, Credit Karma, that they are able to access other user’s credit history by simply logging into the service. It looks to be a two hour window from Auguest 14, 2019 from 7 AM to 9 AM PST before a fix was applied by Credit Karma.

As noted on the FTC’s case proceedings notification page, Equifax’s settlement fund will run out much sooner than the January 2020 deadline.

It’s been covered pretty extensively for such a simple routine update, so here’s a quick summary from zdnet: “..with the way EA had implemented the trust mechanism, researchers found it was possible to redirect users to login via the hijacked subdomain.”