The Equifax hack has left many concerned about their personal information. While we still have a lot to learn about last week’s hack, here are four things we do know. Last week’s mega-breach at Equifax has left many scrambling to protect their identity. The credit bureau believes that up to 143 million people were affected—some 44% of the population.
It’s likely that your information has been exposed and, if you have not already, you must place a security freeze on your credit files at the three bureaus:
While we wait for more information on the breach, here are four things you should know about the Equifax hack.
1. Don’t rely on Equifax’s website
In response to the hack, Equifax set up a special website that included a statement, some FAQs, and a tool to check whether or not you were affected. The tool asked people to submit their last name and the last six digits of their Social Security number. Almost immediately, people began having issues with the site.
For example, many checked on Friday and were told that their information was safe. However, when they checked again over the weekend they were told they were affected. Or they checked on their phone and were told they were safe, but from their laptop, they were told they may have been impacted.
Some took it a step further and began entering fake combinations of Social Security numbers and names to find that those “identities” were affected as well.
We recommend that you not even bother checking to see if you were affected using Equifax’s website. It’s best to assume that you were and immediately freeze your credit there—and at Experian and TransUnion.
The three bureaus have been experiencing high traffic recently and your request online may not be processed. If you cannot set up your freeze online, try calling the bureaus or send a written letter so you have a paper trail.
2. Equifax created weak security PINs
After the breach, consumers rushed to lock their credit files with a PIN at the three credit bureaus. Many noticed a suspicious pattern. Instead of being assigned randomly generated numbers, the PINs reflected the date and time they had signed up for the freeze. (For example, someone who froze their credit at 1:30 pm on September 9 would have the PIN 0909171330.)
Using such a template to create sequential PINs puts consumers at risk. Since hackers know the PIN setup, they could potentially unlock credit files by guessing a series of possible PINs.
Equifax has responded and will be changing how they assign PINs, so that they are randomly generated. If you have already received a PIN for Equifax you have the option to change it.
3. The first class action lawsuits have been filed
Since the announcement, at least three lawsuits have been filed against Equifax. One filed in Oregon is demanding $70 billion in damages. The lawsuit requests compensation for out-of-pocket costs endured by those impacted by the breach such as having to pay $10 for a credit freeze.
In addition, attorney generals of five different states have launched formal investigations into Equifax’s practices leading up to the breach and how they notified consumers of the hack.
4.Tax-related identity theft may rise
So far, we haven’t seen the data stolen in the Equifax hack used fraudulently—but experts worry that could change quickly as we approach tax season. Tax identity theft—the process of hackers fraudulently filing for another’s tax return—has been a problem for years. The Equifax breach exposed millions of Social Security numbers, which hackers can use to file a fraudulent tax return in your name.
In recent years, the Internal Revenue Service (IRS) has attempted to combat this fraud by providing some taxpayers with a special PIN they must use when filing their taxes. This security feature, however, is not currently available to everyone.
Regardless, it is best to file your 2017 taxes as soon as possible in 2018 to ward off fraud.
Equifax’s hack has brought us into new identity theft territories. It’s difficult to say now what the full impact of this breach will be, but we’ll continue to follow the latest developments closely.
Again, the best way to protect yourself now is to freeze your credit files. Doing so will make it impossible for criminals to open any new accounts in your name. You can set up a security freeze at all three of the bureaus online, over the phone, or through the mail.