Credit monitoring agency Equifax revealed shocking news late Thursday: A data breach of the company’s servers from mid-May through July 2017 resulted in the theft of the personal information of up to 143 million U.S. consumers—a huge chunk of the country’s 324 million population. Equifax says the breach leaked highly sensitive information, too, including “names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers.”
That’s everything crooks need to open up credit lines in your name, or worse. And now it’s in nefarious hands.
Contents
Equifax hack: Was I affected?
Shamefully, Equifax won’t be contacting most of the 143 million victims directly to let them know they’ve fallen prey to data hackers. The hackers also swiped credit card numbers for 209,000 people, and “certain dispute documents with personal identifying information” for 182,000 more. Equifax will mail those particular victims—far less than 1 percent of everyone affected—a notice that they were affected by the breach.
Brad Chacos/IDG
Finding out if you were affected by the Equifax hack is trickier (and murkier) if you’re not part of that sliver. Equifax created the www.equifaxsecurity2017.com website for U.S. consumers to “see if your personal information is potentially impacted.” Let’s be frank: It looks like a fraud site. It’s frighteningly bare-bones and runs on WordPress, the URL differs from Equifax’s main site, some browsers were throwing up phishing warnings due to back-end configuration issues, and Equifax even asks for your social security number to confirm whether it leaked your social security number. Those are all classic signs of a malicious phishing site, but fear not: equifaxsecurity2017.com is legitimate.
Head to the Potential Impact page of the Equifax Security website to find out if you were affected. Simply click the “Check potential impact” button and supply your last name and the last six digits of your social security number.
Brad Chacos/IDG
If the credit agency doesn’t believe you were impacted, it’ll tell you so and pitch you to register for Equifax’s “TrustID Premier” credit monitoring service, which the company will provide for free for one year regardless of whether or not your data was stolen.
Brad Chacos/IDG
Alternatively, the site may report that “We believe that your personal information may have been impacted by this incident” and again prompt you to enroll for TrustID Premier.
Brad Chacos/IDG
TechCrunch points out that TrustID Premier’s terms of service—which were last updated September 6, the very day before Equifax disclosed this hack after knowing about it since July 29—state that users waive their right to bring a class-action lawsuit against Equifax. So if that’s something you’re considering, maybe hold off signing up for the free year of TrustID Premier on your “enrollment date.”
Update: Sometime between the 10 a.m. Eastern publication time of this article and 2 p.m., Equifax added a section to the website’s FAQ page that clarifies “The arbitration clause and class action wavier included in the TrustedID Premier Terms of Use applies to the free credit file monitoring and identity theft protection products, and not the cybersecurity incident.”
Equifax has also set up a dedicated call center at 866-447-7559 for additional questions. It’s open from 7 a.m. to 1 a.m. Eastern time every day, including weekends.
Equifax hack: Monitor your credit report
Regardless of whether you accept TrustID Premier, it’s a good idea to keep an eye on your credit report for fraudulent activity—even if Equifax “believes that your personal information was not impacted.” You can get a copy of your credit report online at www.annualcreditreport.com. You can request a free copy of your credit report once per year from each of the major credit monitoring agencies: Equifax, TransUnion, and Experian. Stagger the requests for every few months and you can keep an eye on things throughout the year.
The FTC warns that www.annualcreditreport.com is the only site “authorized to fill orders for the free annual credit report you are entitled to under law,” so steer clear of others making similar claims. If you see any fraudulent activity on your credit report, notify your bank or credit card company immediately.