Recently, Equifax, one of the three major credit reporting agencies, came clean with a stunning announcement: A security breach had exposed data on more than 140 million Americans — nearly half the population of the United States.
If security experts have been waiting for the "big one," it looks like this is it. This breach isn't about your organization's data security. Instead, it's about your own personal risk of identity theft, or someone using your personal information like your social security number to take out loans or buy things in your name. Here are some things you can do about it.
The Equifax breach lasted from mid-May through July 2017 but only became widely reported in early September. Cyberattackers got people's names, Social Security numbers, birth dates, addresses, and, in some instances, driver's license numbers. They also stole credit card numbers for about 209,000 people.
The attack also got personal information of people in the U.K. and Canada. Equifax has created a dedicated website to educate those impacted about the risks, and a call center is open from 7 a.m. to 1 a.m. Eastern time at 866-447-7559 to answer questions.
At least one group has filed a class-action lawsuit against Equifax, and the Federal Trade Commission is taking an interest.
Just because your data may have been stolen in this breach doesn't mean you can't protect yourself — it just requires you to stay vigilant.
Go to the Equifax Check Potential Impact website. Click Check Potential Impact and enter your last name and the last six digits of your Social Security number. This is sensitive information, so make sure you're on a password-protected network connection rather than open public Wi-Fi. The site will tell you if you've been affected by this breach.
TechCrunch reports that the Potential Impact site is a bit problematic. For example, it tells people who entered completely made-up information that their personal information may have been stolen. In addition, ZDNet reported Monday that this site may also be vulnerable to hacking (gulp!). However, it looks like it is the only option for checking exposure as yet.
Equifax is also offering one free year of credit monitoring to all Americans. You have until November 21, 2017, to enroll in this service, but the New York Times offers a weak recommendation for the credit monitoring service.
What to Do When You Receive a Data Breach Notice defines data breaches in more detail and provides practical steps you can take to protect yourself. It's the clearest and most comprehensive article I've seen on how to protect yourself against identity theft in cases of serious data breaches.
All Americans are entitled to one free credit report from each of the three major credit reporting agencies (Equifax, Experian, and TransUnion) per year. To request yours, visit annualcreditreport.com. Any activity that you don't recognize could indicate identity theft. Visit IdentityTheft.gov to find out what to do about that.
When you place a fraud alert on your credit file, you'll be alerted if someone tries to apply for credit in your name. You don't need to request a fraud alert from all three credit agencies. When you place a fraud alert through one of these agencies, it'll notify the others.
These free alerts are good for 90 days, and you can renew the alert if necessary. If you do become a victim of identity theft, you can get an "extended fraud alert" that will be in effect for seven years. You can cancel the fraud alerts at any time. Request a fraud alert at
Call your bank or credit union. The steps to set up alerts vary depending on the bank.
A credit freeze provides the greatest protection from identity theft. It locks your credit files so that only companies you already do business with will have access to them.
Although it goes a long way toward protecting your identity, a credit freeze does make it inconvenient for you to do things like apply for new loans, rent an apartment, or seek employment involving a background check. You can request that the credit freeze be lifted for a certain period of time or for a specific creditor. Equifax, Experian, and TransUnion offer credit freezes nationwide, but you may have to pay a fee to make it happen. Here are links to their credit freeze pages.
This breach is one that we all need to pay close attention to, and the damage could persist for years. While immediate action to protect yourself from identity theft is a very good idea, Villanova professor Henry Carter says, "We'll likely be seeing identity thefts from this breach for a long time." Stay vigilant, do your due diligence, and if you suspect you might be a victim of identity theft, take immediate action to protect yourself.