Equifax Hack: 44% of Americans Had Their SSN, names & birthdate stolen

Luciferical said:

I find it hilarious, in a dark comedy sort of way, that the potential impact site has been so poorly setup that one security app actually tagged it as a potential phishing site.

I feel much better now. Do you?

Click to expand...

tiddlywinks said:

*delurks*

This is not a hoax or fake news or just a gimmick to get you to sign up for crappy credit monitoring. Unfortunately it is very real, folks, and some of you may have already been affected in the months since the data was stolen (I can attest from personal experience here. This explains some recent nasty headaches in my household...)

As for preventative measures, one thing you can do is put a credit freeze in place - but do your research before you do that, especially if you have any near term plans to open lines of credit, purchase a house, etc. It's a PITA when you actually want to do something involving credit...buuuuut you also don't want to get ready to apply for a mortgage, only to find someone has wreaked havoc on your credit. (The big 3 credit agencies aren't exactly the fastest or most helpful under such circumstances either.)

Click to expand...

Roxxsmom said:

One thing that's been suggested to protect oneself from stolen credit and personal information is to pay a fee to freeze your credit with each of the reporting agencies. This means that if someone applies for credit in your name the reporting agency will notify the lender or agency that needed the credit report that your credit has been frozen, so the application won't be approved. It's not foolproof, but it makes it harder for someone to use stolen information to get credit cards or do things that require credit reports in your name. Most thieves go with a path of least resistance.

The down side is that you can't apply for credit or do things that require a credit report either, without paying a fee to temporarily or permanently lift the freeze. And each agency gives you a long pin that you must keep somewhere safe (it won't be easy to memorize) to give the credit reporting agencies if you want to lift the freeze.

As far as I know, though, they don't notify you if someone tries to obtain credit in your name.

Click to expand...

In basic terms, freezing your credit means placing restrictions on who can view your credit report. Why is this important? Well, applying for housing, checking accounts or new credit cards can all involve a credit pull by potential landlords, mortgage lenders or banks. If you prevent them from pulling your credit, it'll frustrate the fraudsters who need these organizations' approval to open fake accounts using your stolen identity.

Freezing your credit comes with a $5 to $10 charge for each credit bureau. The amount of the charge depends on where you live; here's a PDF from Equifax that shows how much it might cost you. Often, victims of identity theft can freeze their credit at no charge. To get the ball rolling, visit the relevant websites of Experian, Equifax and TransUnion. You can also call Equifax (1-800-349-9960), Experian (1‑888‑397‑3742) or TransUnion (1-888-909-8872).


The credit agencies will ask for your personal information, including your name, address, date of birth and Social Security number. Once you've supplied those and frozen your credit report, nobody except your existing lenders, or their debt collectors, will be able to see it, according to federal regulators. The only other entities that are allowed to see your credit report at this point are government agencies carrying out a search warrant or subpoena, and yourself, if you're trying to access the free credit report that is entitled to you once per year per credit bureau. (You can thank a 2003 law known as FACTA for this right. Annualcreditreport.com is the only website you'll ever see government officials recommend for this purpose.)


But what do you do once your report is frozen and you need, say, a credit card company to look at it?


In that case, you can contact the credit bureaus again and ask them to lift or “thaw” the freeze. To do so, you'll need a PIN that your credit bureau gave you when you enabled the freeze. The reporting agencies are required to put the thaw into effect no later than three business days after you submit the request. You can also choose to lift the freeze only for a specific amount of time, to limit your exposure. Lifting the freeze can also come with a small fee.


If you lose your PIN, you can reset it, but that will typically require you to provide proof of your identity. This poses a different type of security risk; if a criminal manages to get a copy of the required identifying documents — say, through a corporate data breach or by persuading you to give up the information voluntarily through an email phishing attack — then there isn't much standing between a determined thief and an unfrozen credit report.

Click to expand...

blacbird said:

Having no existence to speak of, perhaps I'm okay.

caw

Click to expand...

Luciferical said:

The credit monitoring CAN be whatever they want. I am not a legal expert, but I'm not aware of any law on this. I think some states may have requirements. But no blanket coverage. One year seems to be the accepted standard, if such a word applies here at all.

And the dark Web markets have already done what you say. Security experts have already noticed stolen credentials showing up on black market sites after said year of free monitoring. Holders of these fake credentials are even known to spot check some of their holdings to see if fraud alerts or credit freezes show up.

Such stolen credentials aren't sold individually, or even by the dozen. They are sold 10,000 or more at a time. So they can afford to test a few here and there.

Click to expand...

It’s time for all of us to play defense, because Equifax clearly did not.


In the wake of the epic breach of as many as 143 million of our Social Security numbers, names and addresses from the company’s credit files, the company put up a website that attempted to make sense of things for consumers.


The company’s first order of business ought to have been to create a simple way for people to figure out if their data was potentially compromised. On this count, Equifax failed at first.


On Thursday night, I entered my last name and the last six digits of my Social Security number on the appropriate Equifax web page. (They had the gall to ask for this? Really? But I digress.) I received no “message indicating whether your personal information may have been impacted by this incident,” as the site promised. Instead, I was bounced to an offer for free credit monitoring, without a “yes,” “no” or “maybe” on the central question at hand.


By Friday morning, this had changed, and I got a “your personal information may have been impacted by this incident” notification. Progress. Except as my friend Justin Soffer pointed out on Twitter, you can enter a random name and number into the site and it will tell you the same thing. Indeed, I typed “Trump” and arbitrary numbers and got the same message.


Now, to the remedy. The company is offering one free year of credit monitoring to all Americans, not just the ones whose data was stolen. It includes the ability to turn your Equifax credit report on and off, to keep thieves from applying for credit in your name using information they stole from Equifax and to have access to your Equifax report to do so.


That’s all well and good, except that the thieves might use the stolen information to apply for credit with lenders that check the credit reports only at the other big agencies, Experian and TransUnion. So this protection is incomplete.


And why just a year? Who knows? Isn’t this an invitation to the thieves to sit on the data for a while and then use it when all of us have moved on?


Meanwhile, people can’t easily change their Social Security numbers to thwart the thieves. So if any bad actors have your personal data, those numbers will be useful for years, maybe decades, depending on how the credit system changes over time.


Equifax should have made the monitoring last forever. Since it didn’t, it will now be able to solicit everyone who signs up for its year of free service. And what do you want to bet that the company will offer an extension bright and early on day 366 for, say, $16.95 per month?


So, yes, your worst suspicions are now confirmed. Equifax may actually make money on this breach. We would expect nothing less from the credit reporting industry, with which few of us would choose to do business but nearly everyone has to sooner or later.

Click to expand...

If you're not worried about the Equifax hack, you should be.

The hackers made off with the most crucial tools that identity thieves need to impersonate you. The worst-case scenario is a very real threat to millions of Americans.

If the stolen information from Equifax gets into the wrong hands, experts say data thieves can open bank accounts, lines of credit, new credit cards and even drivers' licenses in your name. They can saddle you with speeding tickets, steal your tax refund, swipe your Social Security check and prevent you from getting prescription drugs.

Recovering from identity theft could take months or even years. And no one is responsible for cleaning up your own mess but you.

The data stolen in the Equifax hack is extremely valuable to cyberthieves. All that information packaged together sells for upwards of $30 per identity on online black markets, according to Mark Nunnikhoven, head of cloud research for cybersecurity firm Trend Micro.

"That's the foundational identification information for U.S. consumers," said Nunnikhoven. "It's enough to allow cyberthieves to take over you online."

If a cybercriminal maxed out a credit card in your name, you'll have a very difficult time passing a credit check. Good luck getting a new cell phone, a student loan, a car or a mortgage.

If a data thief took out a prescription using your identity, that goes on your medical record. That could seriously screw up your ability to get treatment at a hospital or from your pharmacy, particularly if the fraudster obtained medicine that counteracts with yours.

More sinister cybercriminals could use that data to pin crimes on you, according to Eva Velasquez, CEO of the Identity Theft Resource Center, a nonprofit that assists fraud victims.

If someone gets a driver's license in your name and runs a red light or gets a speeding ticket, you're on the hook. The criminal's not going to pay it -- and soon enough there could be a warrant out for your arrest.

"This is not hypothetical," said Velasquez, who notes her organization annually helps thousands of victims of some truly complex identity fraud. In a few extreme cases, Velasquez's organization dealt with fraud victims who discovered prisoners were serving sentences in their names.

Of the roughly 17 million reported cases of identity theft last year, about 4% was of the "criminal" variety (assigning speeding tickets, warrants and other violations to fraud victims). It's a small, but not insignificant number. And that was before the massive Equifax hack.

Click to expand...