On Sep­tem­ber 7, 2017, Equifax, one of the three main cred­it report­ing agen­cies, announced a mas­sive data secu­ri­ty breach that exposed vital per­son­al iden­ti­fi­ca­tion data — includ­ing names, address­es, birth dates, and Social Secu­ri­ty num­bers — on as many as 143 mil­lion con­sumers, rough­ly 55% of Amer­i­cans age 18 and old­er.1

This data breach was espe­cial­ly egre­gious because the com­pa­ny report­ed­ly first learned of the breach on July 29 and wait­ed rough­ly six weeks before mak­ing it pub­lic (hack­ers first gained access between mid-May and July) and three senior Equifax exec­u­tives report­ed­ly sold shares of the com­pa­ny worth near­ly $2 mil­lion before the breach was announced. More­over, con­sumers don’t choose to do busi­ness or share their data with Equifax; rather, Equifax — along with Tran­sUnion and Exper­ian, the oth­er two major cred­it report­ing agen­cies — uni­lat­er­al­ly mon­i­tors the finan­cial health of con­sumers and sup­plies that data to poten­tial lenders with­out a con­sumer’s approval or con­sent.2

Equifax has faced wide­spread crit­i­cism fol­low­ing its dis­clo­sure of the hack, both for the breach itself and for its response, par­tic­u­lar­ly the web­site it estab­lished for con­sumers to check if they may have been affect­ed. Both the FBI and Con­gress are inves­ti­gat­ing the breach.3 In the mean­time, here are answers to ques­tions you might have.

1. What’s the deal with the website Equifax has set up for consumers?

Equifax has set up a web­site, equifaxsecurity2017.com, where con­sumers can check if they’ve been affect­ed by the breach. Once on the site, click on the but­ton “Poten­tial Impact” at the bot­tom of the main page. You then need to click on “Check Poten­tial Impact,” where you will be asked to pro­vide your last name and the last six dig­its of your Social Secu­ri­ty num­ber — a request that was wide­ly mocked on social media as being too intru­sive when the stan­dard request is for only the last four digits.

Equifax has stat­ed that regard­less of whether your infor­ma­tion may have been affect­ed, every­one has the option to sign up on the web­site for one free year of cred­it mon­i­tor­ing and iden­ti­ty theft pro­tec­tion. You can do so by click­ing the “Enroll” but­ton at the bot­tom of the screen. Note: Just click­ing this but­ton does not mean you’re actu­al­ly enrolled, how­ev­er. You must fol­low the instruc­tions to go through an actu­al enroll­ment process with Truste­dID Pre­mier to offi­cial­ly enroll.

More wrath was direct­ed at Equifax when some eagle-eyed observers not­ed that enrolling in the free year of cred­it pro­tec­tion with Truste­dID Pre­mier meant that con­sumers gave up the right to join any class-action law­suit against the com­pa­ny and agreed to be bound by arbi­tra­tion. But an Equifax spokesper­son has since stat­ed that the bind­ing arbi­tra­tion clause relat­ed only to the one year of free cred­it mon­i­tor­ing and not the breach itself; Equifax has since removed that lan­guage from its site.4

2. What is TrustedID Premier?

Equifax’s response to the data breach is to offer con­sumers one free year of cred­it file mon­i­tor­ing ser­vices through Truste­dID Pre­mier. This includes mon­i­tor­ing reports gen­er­at­ed by Equifax, Exper­ian, and Tran­sUnion; the abil­i­ty to lock and unlock Equifax cred­it reports with a cred­it freeze; iden­ti­ty theft insur­ance; and Social Secu­ri­ty num­ber monitoring.

Con­sumers who choose to enroll in this ser­vice will need to pro­vide a valid email address and addi­tion­al infor­ma­tion to ver­i­fy their iden­ti­ty. A few days after enrolling, con­sumers will receive an email with a link to acti­vate Truste­dID Pre­mier. The enroll­ment peri­od ends Novem­ber 21. After the one free year is up, con­sumers will not be auto­mat­i­cal­ly charged or enrolled in fur­ther mon­i­tor­ing; they will need to sign up again if they so choose (some ini­tial reports stat­ed that con­sumers would be auto­mat­i­cal­ly re-enrolled after the first year).5

3. What other steps can I take?

It is always a good idea to mon­i­tor your own per­son­al infor­ma­tion and be on the look­out for iden­ti­ty theft. Here are spe­cif­ic addi­tion­al steps you can take:

  • Fraud alerts: Your first step should be to estab­lish fraud alerts with the three major cred­it report­ing agen­cies. This will alert you if some­one tries to apply for cred­it in your name. You can also set up fraud alerts for your cred­it and deb­it cards.
  • Cred­it freezes: A cred­it freeze will lock your cred­it files so that only com­pa­nies you already do busi­ness with will have access to them. This means that if a thief shows up at a far­away bank and tries to apply for cred­it in your name using your address and Social Secu­ri­ty num­ber, the bank won’t be able to access your cred­it report. (How­ev­er, a cred­it freeze won’t pre­vent a thief from mak­ing changes to your exist­ing accounts.) Ini­tial­ly, con­sumers who tried to set up cred­it freezes with Equifax dis­cov­ered they had to pay for it, but after a pub­lic thrash­ing Equifax announced that it would waive all fees for the next 30 days (start­ing Sep­tem­ber 12) for con­sumers who want to freeze their Equifax cred­it files.6 Before freez­ing your cred­it reports, though, it’s wise to check them first. Also keep in mind that if you want to apply for cred­it with a new finan­cial insti­tu­tion in the future, or you are open­ing a new bank account, apply­ing for a job, rent­ing an apart­ment, or buy­ing insur­ance, you will need to unlock or “thaw” the cred­it freeze.
  • Cred­it reports: You can obtain a free copy of your cred­it report from each of the major cred­it agen­cies once every 12 months by request­ing the reports at annualcreditreport.com or by call­ing toll-free 877–322-8228. Because the Equifax breach could have long-term con­se­quences, it’s a good idea to start check­ing your report as part of your reg­u­lar finan­cial rou­tine for the next few years.
  • Bank and cred­it card state­ments: Review your finan­cial state­ments reg­u­lar­ly and look for any trans­ac­tion that seems amiss. Take advan­tage of any alert fea­tures so that you are noti­fied when sus­pi­cious activ­i­ty is detect­ed. Your vig­i­lance is an essen­tial tool in fight­ing iden­ti­ty theft.

4. How can I get more information from Equifax?

Con­sumers with addi­tion­al ques­tions for Equifax can call the com­pa­ny’s ded­i­cat­ed call cen­ter at 866–447-7559. The call cen­ter is open sev­en days a week from 7 a.m. to 1 a.m. East­ern time. Equifax said it is expe­ri­enc­ing high call vol­umes but is work­ing dili­gent­ly to respond to all con­sumers.7

1, 3–5, 7) The Wall Street Jour­nal, Sep­tem­ber 8, 2017, Sep­tem­ber 10, 2017
2) CNN­Money, Sep­tem­ber 8, 2017
6) The New York Times, Sep­tem­ber 12, 2017
Con­tent pro­vid­ed by:  Broad­ridge Advi­sor Solu­tions, Inc.
Sep­tem­ber 2017