Should You Freeze Your Credit Amid National Public Data, Change Healthcare Breaches?

There have been enough high-profile data breaches so far this year to make anyone nervous. We've seen some of the biggest cyberattacks in history, including a data breach at Change Healthcare and a data breach at National Public Data. Alongside these breaches have been calls to keep yourself safe by freezing your credit. 

But should you freeze your credit when information about data breaches comes out, and how exactly does freezing your credit protect yourself? In cases like the Change Healthcare and National Public Data breaches, what's the point of freezing your credit? 

Let me start by getting one thing out of the way: Kiplinger recommends freezing your  credit. Now, let's walk through why we recommend it, and why this year is a reminder of the importance of this protection measure.

Subscribe to Kiplinger’s Personal Finance

Be a smarter, better informed investor.

Save up to 74%

Sign up for Kiplinger’s Free E-Newsletters

Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.

Profit and prosper with the best of expert advice - straight to your e-mail.

Sign up

What is a credit freeze and how does it protect you during data breaches?

A credit freeze, sometimes called a security freeze, blocks creditors from being able to review your credit reports. Why is that important in the wake of a data breach?

Well, consider the Change Healthcare breach. In that incident, hackers got access to people's data including names, birth dates, phone numbers, addresses, Social Security numbers and banking information. Assume I'm a scammer: If I have that information, I can theoretically apply for a credit card in your name.

If you don't have a credit freeze up, the bank may go ahead and run a credit report for that credit card. Assuming your credit is good, that card could get approved. Then I, as a scammer, could use that credit card opened in your name to buy things for myself and run frauds posing as you. That could ruin your credit and make you — and maybe even your family members — lose money in a scam. 

"While credit freezing doesn’t prevent all types of identity theft, it significantly reduces your risk by making it much harder for hackers to exploit your credit. Hackers are always looking for the lowest-hanging fruit," R.J. Weiss, CFP, CEO of The Ways to Wealth, tells Kiplinger.

It sounds scary because it is scary. Scams like the example above are a real threat of data breaches, when nefarious actors have access to your information. 

A credit freeze does not pause changes in your credit score, and you are able to unfreeze your credit very easily. It's also free to do. (Note that there is an option known as a "credit lock," which is different from a credit freeze. A freeze is free, and a lock is a paid option with some extra features.)

"With a freeze in place, you will still be able to access your own credit report. A credit freeze does not impact your credit score," said Margaret Poe, head of consumer credit education for TransUnion, one of the three credit reporting agencies.

Could you just always have a credit freeze up?

Theoretically, yes. You really only need to unfreeze your report when you're applying for credit, like for a credit card or loan. 

"With the increasing likelihood of data breaches, especially with [recent] news, it's becoming more sensible for most people to keep their credit frozen by default," Weiss says. 

Lisa Gerstner, the editor of Kiplinger Personal Finance, calls freezes "one of the strongest tools available to consumers to prevent identity theft" and has written about how to freeze your credit. 

"My own reports have been frozen for years, and anytime I’ve applied for credit, it’s been simple to temporarily lift the freeze for a period that I specify. After the period ends, the freeze automatically goes back into place," Gerstner says. 

Considering that it's free to freeze your credit and easy to unfreeze it when you need creditors to access your report, this is a simple way to protect your finances. 

"It takes a little time to set up a freeze initially with each credit-reporting company, but once it’s done, it’s well worth the peace of mind that a criminal is unlikely to open credit accounts in your name," Gerstner says.

You'll need to go through Equifax, Experian and TransUnion to freeze your credit. Stay safe out there!

What information came out of the data breaches?

The Change Healthcare breach was a cyberattack where hackers took information. Change Healthcare is a health payment processing group owned by UnitedHealth that touches billing and insurance. So even if you don't think you've worked with them, it's possible you've gone to a hospital or doctor's office who does billing through Change Healthcare, for example. 

While there's not an exact number known, many people were impacted by this cyberattack. Change Healthcare started sending out notification letters to those they know were in the data breach, but it's possible you were part of it even if you didn't get a letter as the company doesn't have everyone's updated mailing addresses. 

The data taken in that breach included people's names, dates of birth, addresses, health insurance and Medicare information, health information, billing and payment information, including financial and banking information, Social Security numbers, driver's licenses, state IDs and passport numbers. 

As for National Public Data, that's another one where even if you never worked with them directly, they may still have had your information. National Public Data is a background check company owned by Jerico Pictures Inc. That breach was also a cyberattack. It took place in April, and word came out about it recently as Bloomberg Law reported a complaint was filed claiming the breach impacted 2.9 billion people. 

That sounds like a big number, but it's important to note it's somewhat speculative and various people have been trying to assess how many people are seriously implicated by the cyberattack. For what it's worth, some Kiplinger staffers looked to see if they were part of the hack and found either that they were not or that the information linked to them was very outdated. 

In any case, information taken in that breach includes names, email addresses, phone numbers, Social Security numbers and dates of birth. 

Related Content

• Change Healthcare Data Breach: What to Know for Your Social Security Number and More
• How to Freeze Your Credit in Three Steps
• Nearly 3 Billion People Hacked in National Public Data Breach. What You Need to Know