The Scoop
Equifax publicly reported a massive data breach on July 29th, and many users of the credit reporting service are still wondering if their information was exposed, and what to do about it if it was.
The breach lasted from mid-May to July of this year. Names, social security numbers, birthdates, addresses and driver’s license numbers, as well as credit card numbers and dispute documents from some users, were taken. An estimated 145.5 million Americans (>45%) have been affected, and thousands of records have been stolen from individuals in Canada and the UK as well.
Equifax is currently under federal investigation. Over fifty class-action lawsuits against the company have already been filed.
Cybercriminals exploited a website application vulnerability to access user’s data. Cybersecurity professionals allegedly found the vulnerability, created a patch, and told the industry about the fix months prior to the data breach. This data leak has been caused by Equifax’s alleged failure to install security updates in a timely manner.
Equifax has offered its users the ability to check whether or not their information was stolen via their website, TrustID. After checking to see if their information was compromised, users may also sign up for a year of free credit monitoring and identity theft insurance, provided by Equifax. However, several users have reported receiving inaccurate or inconsistent results after submitting their information (possibly due to a large volume of submissions), and there have been security vulnerabilities found within this site as well.
The legal community had been conflicted about whether or not signing up for this service would waive a user’s ability to participate in the legal proceedings, but Equifax has since changed its TrustedID Premier Terms of Use to remove the arbitration clause. Equifax states that the clause will not apply to users who signed up before or after it was removed.
Updated information from Equifax about the breach can be found here: https://www.equifaxsecurity2017.com/
What if My Information was Stolen?
(Please note that we are not legal professionals and are not providing legal advice. These are merely some precautions users may consider if they are worried that their information may have been obtained)
Freeze Your Credit
Legal experts are urging users to employ credit freezes in the interim, and Equifax has made a freeze available for free (details found here). Do note that placing a freeze on your credit may impact your ability to apply for a loan, get a job, or rent/buy a home, as only current debtors and certain government agencies will be able to see your credit report and score until the freeze is lifted (which you may request for a specific party or period of time).
A credit freeze will not impact your credit score, and you will still be able to view it. Thieves will not have access to your information to open new accounts, but they may still be able to make charges to existing accounts if they have gained access to them.
Freezing all three of your credit reports can help to ensure your safety, but it is not a solution. Hackers can still gain access to your information if the company falls subject to a successful attack. More information about credit freezes and how to request them can be found here.
Request a Fraud Alert
In addition to a credit freeze, a fraud alert is another option to consider. Essentially, a fraud alert is a means of two-step authentication. A fraud alert flags your credit report, so that creditors and lenders must take additional steps to verify your identity. For example, if you provide a telephone number to a lender, the lender must call you to verify whether or not you are the person making the credit request.
There are three types of credit alerts, including Initial Fraud Alert, Extended Fraud Alert, and Active Duty Military Alert. The latter is for those who are deployed.
The first, Initial Fraud Alert, is for those who think their personal information and identifiers may have been compromised, but have not yet fallen victim to identity theft. This alert lasts for 90 days, and may be renewed after it has expired.
Extended Fraud Alert is for those who have fallen victim to identity theft, and will require additional verification of your information for seven years.
Requesting a fraud alert is simple, and does not have to be done with every bureau. Requesting one from a single bureau will prompt them to notify the other two. You can find more information on submitting a fraud alert on the bureau’s websites listed below.
Equifax
Experian
Transunion
Credits reports are available from each of the bureaus and can also be accessed via websites like CreditKarma, where you can monitor recent activity for free.
Monitor Your Accounts
Start checking your banking information regularly, and check for any fraudulent activity. Check your activity and balances at least once every week, and make sure to save your statements.
Sign Up for Identity Protection
At the moment, the free service Equifax is offering affected users is buggy at best, and there are several legal and security-related questions left unanswered. It may be in your best interest to sign up for a credit monitoring service, which will offer you both protection and insurance if your identity is stolen. Companies such as Watchdog, LifeLock, and IdentityForce all offer these services for under twenty dollars per month. In addition to monitoring your financial activity and information usage, some companies will also alert you if your information is being sold on the dark web (where the stolen Equifax data was traded initially).
And Now We Wait…
Several lawsuits have already been filed, and those affected by the breach will see updates as the legal proceedings and federal investigation unfold.
Keep in mind that freezing or flagging your accounts now may not have an impact. These thieves have an incredible amount of data to sort through, and your information, if compromised, may lead to identity theft at any point down the road. Only vigilance, monitoring and insurance, at present time, can help protect you and your assets from theft.
If you have any further questions or concerns about the data breach, please feel free to contact us at support@simpleroute.com. We’ll be happy to answer any questions your have about keeping yourself secure.