The Equifax Data Breach: What You Should Do
One of the gatekeepers to your most sensitive personal information was hacked, bigtime. Here’s how to protect yourself.
By now you’ve probably heard that Equifax, which as one of the three major U.S. credit agencies collect loads of sensitive data on consumers, suffered a massive breach, potentially affecting nearly 146 million Americans. In the ongoing saga of rampant data breaches, it’s a stomach-churning twist, and it’s especially galling given that as one component of its business, Equifax sells credit monitoring and other services to detect whether identity thieves have pilfered your information.
Chances are high that the thieves got ahold of sensitive information on you or someone in your family, given that the breach touches almost half the entire U.S. population and nearly three-quarters of those who have a credit report on file, according to the National Consumer Law Center.
According to Equifax, “(c)riminals exploited a website application vulnerability to gain access to certain files.” That’s putting it nicely. From mid May through July, hackers had access to all the key information needed to steal identities: Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. Plus, credit card numbers for about 209,000 consumers and dispute documents containing personal information of about 182,000 people were compromised.
Take these steps to see whether you are affected and to protect yourself in the aftermath.
Check with Equifax. At www.equifaxsecurity2017.com/potential-impact/, click on “Am I Impacted?” then enter your last name and the final six digits of your Social Security number. Equifax will supply a message noting whether it believes your personal information was compromised. Even if your information wasn’t compromised, you’ll have the option of signing up for a free year of credit monitoring and identity theft protection services from Equifax’s TrustedID Premier. Equifax has also set up a call center, at 866-447-7559.
Initially, concerns arose about a disclaimer on the Equifax website stating that customers must agree to resolve disputes through arbitration, waiving the right to participate in a class-action lawsuit. Equifax has since said that the waiver does not apply to the free TrustedID Premier offering or to claims related to the breach.
Sign up for monitoring and protection. You have until January 31 to enroll in TrustedID Premier at www.equifaxsecurity2017.com. The service includes access to your Equifax credit report, monitoring for changes (such as newly opened credit card accounts or loans) on your credit reports from all three major credit agencies (Equifax, Experian and TransUnion), the ability “lock” your Equifax credit report so that new creditors can’t access it unless you unlock the file (similar to a credit freeze; for more, see the next section), monitoring of your Social Security number on internet black-market sites, where crooks buy and sell stolen information, and insurance to reimburse out-of-pocket expenses if you become an ID theft victim.
TrustedID Premier is a legit service, and in particular, monitoring of your reports from all three credit bureaus is valuable in helping spot identity theft. But if you’re wary of relying on Equifax for protection, you have other options. Among free services, CreditKarma.com offers access to information from your TransUnion and Equifax credit reports, plus monitoring and alerts about changes in both reports. Check whether you can get free assistance from your bank, credit card issuer, insurance company, or employer, too. Discover, for example, recently began offering its cardholders free monitoring for new accounts on their Experian credit reports. Paid services from companies such as LifeLock and Identity Guard offer broader suites of identity-theft protection services, including monitoring of your reports from all three credit agencies.
Shield your credit. If you haven’t obtained your free annual credit reports in the past 12 months, now is a good time to do it. At www.annualcreditreport.com, you can get a report from each of the three credit agencies. Review each one for accounts you don’t recognize, an incorrect address, or any other red flags. If you believe that you may be a victim of identity theft, you can take steps to resolve it.
The strongest measure you can take to prevent identity theft is imposing a freeze on your credit files (you must contact each bureau separately to do so). It bars new creditors from accessing your credit report—and as a result, identity thieves will have a hard time opening new credit cards or loans in your name. If criminals haven’t yet used your personal information fraudulently, you’ll probably have to pay to place the freeze (fees vary by state but often run about $5 to $10 per credit agency). If you later want to apply for a credit card or loan, you’ll have to lift the freeze during the shopping period, which may incur another fee. “But that bit of inconvenience doesn’t outweigh the amount of time you’d spend cleaning up an identity-theft issue,” says Eva Velasquez, president and CEO of the Identity Theft Resource Center.
Equifax is waiving fees to place or lift a credit freeze on your Equifax credit report until January 31. Equifax has also promised that by the end of January, all consumers will be able to lock and unlock their Equifax credit reports free of charge for life. The lock feature appears to serve the same basic purpose as a freeze. But we recommend using the freeze, which is governed by state laws.
As a less-cumbersome alternative, you can initiate a free 90-day fraud alert on your credit reports (when you place an alert with one credit agency, it will contact the other two companies). A fraud alert requires lenders to take extra steps to verify your identity when someone applies for credit in your name, but it doesn’t provide a full block on your reports. And unless you are already a victim of identity theft, you’ll have to renew the fraud alert every 90 days to maintain the protection. Your personal information may sit for years before a thief uses it, so you’ll need to be on guard for far longer than three months.
Identity-theft victims are eligible for a free extended fraud alert, which lasts seven years. You also get two free credit reports within 12 months from each credit agency.