An investigation of an alleged Vietnam-based identity theft ring has dragged in the credit reporting firm Experian and rekindled a congressional effort to force companies to reveal how they use Americans' personal and financial data.
The scam, revealed in an indictment unsealed on Friday, allegedly resulted in the theft of data for 500,000 Americans, information which was then posted for sale on websites, including superget.info and findget.me. But the indictment made no mention of the source of the data.
Security expert Brian Krebs uncovered that detail and reported on it Sunday. In a post at KrebsOnSecurity.com, he said the conspirators bought the information from a company called Court Ventures by posing as private investigators. Court Ventures, purchased in March 2012 by California-based Experian, had obtained the information through a data-sharing agreement with USInfoSearch.com, he wrote.
(Read more: Medical identity theft could cost you your life)
In a statement to Krebs, Experian said the Secret Service had notified it that "Court Ventures had been and was continuing to resell data from US Info Search to a third party possibly engaged in illegal activity." Experian said it then stopped reselling the data from USInfoSearch.com and worked with law enforcement to catch the crooks.