On a scale of one to ten, this is a ten in terms of potential identity theft. Credit bureaus keep so much data about us that affects almost everything we do.
–Avivah Litan, Cybersecurity and Fraud analyst at Gartner
On Thursday September 7, 2017, consumer credit rating agency Equifax announced they were hacked, exposing an estimated 143 Americans’ personal data. According to Equifax, the hack was discovered on July 29, 2017, though it was not announced until recently. The breach lasted from mid-May 2017 until July 2017. The hackers gained access to people’s names, Social Security numbers, birth dates, addresses, and even some driver’s license numbers. Some are speculating that this may become the most damaging hack in U.S. history.
In Avivah Litan’s above quote, she mentions that the data credit bureaus keep affects almost everything we do. From getting a car loan, mortgage, cell phone, to renting an apartment, our credit scores have a major influence on our lives. Credit scores also affect us in ways which many of us may not realize: insurance premiums.
FICO reports that approximately 85% of home insurance companies use credit based scores, and in most states (with the exception of California, Hawaii, and Massachusetts), your credit has an effect on your auto insurance rates.
Simply put, the data breach at Equifax has the potential to affect us in many costly ways. According to CNN Money, “the hackers made off with the most crucial tools that identity thieves need to impersonate you. The worst-case scenario is a very real threat to Americans. If the stolen information from Equifax gets in the wrong hands, experts say data thieves can open bank accounts, lines of credit, new credit cards and even driver’s licenses in your name. They can saddle you with speeding tickets, steal your tax refund, swipe your Social Security check and prevent you from getting prescription drugs. Recovering from identity theft could take months or even years. And no one is responsible for cleaning up your own mess but you.”
The best course of action is to take immediate action. Forbes recommends starting with Equifax themselves and visiting equifaxsecurity2017.com to find out if your information was exposed. The site has a “Potential Impact Tab” and asks the user to enter the last six digits of their social security number and last name. Forbes warns the user to be sure they’re on a secure computer and internet connection while doing this.
After entering this info, Equifax won’t confirm if your information was hacked, but instead, “based on the information provided, we believe that your personal information may have been impacted by this incident.” From there, Equifax offers users the opportunity to enroll in their TrustedID Premier program for one year at no charge.
This decision by Equifax has come under fire. First, the company whose information was breached is now asking for additional identifying information. It’s fair to say that some may have lost their trust in Equifax. Secondly, immediately following Equifax’s announcement offering users the ability to enroll in their TrustedID Premier program, some found issue with their arbitration language, that by agreeing to enroll, the user waives their right to sue Equifax.
Equifax has since responded. From the Washington Post:
Update, Sept. 10, 2:25 p.m.: Equifax issued a new statement Sunday further clarifying its stance on the arbitration clause. "To confirm, enrolling in the free credit file monitoring and identity theft protection products that we are offering as part of this cybersecurity incident does not prohibit consumers from taking legal action," Equifax said. The company said it has now removed the arbitration language from the terms of use on its data breach notification site, equifaxsecurity2017.com. It also said Sunday that the terms of use on Equifax's main site, equifax.com, do not cover the TrustedID Premier service, which has its own terms of use. "Again," Equifax continued, "to be as clear as possible, we will not apply any arbitration clause or class action waiver against consumers for claims related to the free products offered in response to the cybersecurity incident or for claims related to the cybersecurity incident itself.”
We encourage you to read Equifax’s TrustedID Premier terms of use.
If you do decide to enroll in TrustedID Premier, according to Forbes, one year of free credit monitoring is inadequate as data theft can have lifelong consequences for consumers. “When a credit card number is stolen, you simply get a new card with a new number. You can’t, however, get a new date of birth or Social Security number.”
Forbes recommends enrolling in several free credit score services as well as your free annual credit report from annualcreditreport.com and FICO. If you see any items on your credit report that you don’t recognize, contact the creditor and reporting bureau immediately. Visit identitytheft.gov for additional information to remedy this issue.
Another action you can take is to place a freeze on your credit. A credit freeze will lock your credit files so that only the companies you already do business with will have access to them, making it difficult for someone to open a new credit account in your name. However, freezing your credit may incur a cost (often $10 at each credit reporting agency) as well as removing the freeze. However, this may be a wise investment if you’re at risk.
You can also set up fraud alerts with the three major credit reporting agencies: Equifax, Experian, and TransUnion. These will alert you if someone tries to apply for credit in your name. You can also set up a fraud alert on your credit and debit cards.
We encourage you to continue monitoring your accounts and reviewing your monthly statements for suspicious activity. Additionally, plan to file your taxes early next year. It’s possible the hackers will sit on Social Security numbers and try to use your tax information to file a tax return in your name before you can.
Considering the breadth of the Equifax hack, we encourage everyone to be vigilant with their credit scores and personal information, even if you believe the hack didn’t affect you. The best defense is to be proactive, utilizing the steps above and continually monitoring all of your accounts on a regular basis.
Equifax: 1-800-349-9960
Experian: 1-888-397-3742
TransUnion: 1-888-909-8872
More: