Experian hasn’t had the best track record when it comes to security — for instance, it suffered a database hack that compromised the information of 15 million T-Mobile customers and has been accused of making it too easy for the wrong person to get ahold of a credit freeze PIN. Unfortunately, judging by a report from Krebs on Security, nothing has changed.

The report details accounts of users who have allegedly had their Experian profiles hijacked through what's believed to be a simple combination of public research and lax verification practices. In at least a couple of instances, it appears that malicious parties were able to quickly assume control by making a new Experian account using the target's social security number.

Experian claims these were likely isolated incidents and that there's more verification happening behind the scenes, though that doesn't address the issue of people having their accounts taken over via new account creation in the first place. Until multi-factor authentication comes to Experian, consumers’ best protection is probably to just keep an eye on their account manually.