Web Site Investigated for Posting Private Data

WASHINGTON — Law enforcement officials said on Tuesday that they had opened an investigation into a Web site that posted the home addresses, Social Security numbers and other personal information for more than a dozen celebrities and politicians, including Vice President Joseph R. Biden Jr., Michelle Obama and Jay-Z. 

At this point, we are trying to determine the sourcing of this and the validity of the stuff that is being posted,” said a senior federal law enforcement official.

The investigation is being led by the Federal Bureau of Investigation, the Secret Service and the Los Angeles Police Department, law enforcement officials said.

One said the authorities were looking at whether Russian hackers were involved. The site — Exposed: The Secret Files — included the Internet suffix “.su” — an indication that it was originally from the Soviet Union. It linked to a Twitter account that included postings in Russian.

At the bottom of the Web page was a list of the people whom the hackers claimed to have compromised, including Chief Charlie Beck of the Los Angeles Police Department, Beyoncé, Attorney General Eric H. Holder Jr., former Vice President Al Gore and Kim Kardashian.

Some of the information can be readily found through public records searches, but other information exceeded what can normally be found online. For instance, the hackers posted a home address, Social Security number, birth date and link to what appeared to be a complete credit report for Mr. Holder.

Credit-reporting agencies, including Equifax, Experian and TransUnion, said Tuesday that hackers had used private information to gain access to their credit reports from third-party sites like annualcreditreport.com, a free service.

“There is a stringent credentialing process for those sites,” said Tim Klein, a vice president at Equifax. He said that to get to those reports, hackers must have used stolen personally identifiable information — like a person’s Social Security number and mortgage provider — to authenticate themselves and gain access to credit reports.

Parts of the credit reports confirmed information that has been previously disclosed about the Obamas. Mrs. Obama’s credit report showed that she paid off her college loans in January 2003. The credit report also showed that she had Banana Republic and Gap credit cards and that she was 30 days overdue on a payment in July 2008, when Mr. Obama was running for president.

Security experts said such attacks are on the rise because of lax security by companies that hold confidential information and because consumers use easy-to-crack passwords online.

“Forget the F.B.I. and the banks,” said Mark Risher, chief executive at Impermium, a start-up that aims to clean up social networks. “The problem we’re seeing is that sensitive information is being pulled from less-defended sites like social networks and dating services.”