On September 7, 2017, the credit-reporting agency Equifax, announced that they discovered a data breach. Cybercriminals stole the personal information of nearly half of the United States population (currently 145.5 million). The information includes names, birthdates, addresses, and Social Security numbers. That’s essentially everything a criminal needs to open fraudulent credit cards, bank accounts, and mortgages with someone else’s identity. This data is also used to take control of existing bank, brokerage, or retirement accounts.
We get many questions about the Equifax breach. So, let us share advice with those who are concerned and wish to take action to reduce their risk. The entire process takes less than 45 minutes. This is a large topic in terms of the details regarding the what, how, and why. Here are the key points.
Assume Equifax has your personal information.
Some people may claim that they aren’t affected because they have never given Equifax any information. That’s not the case. Equifax gathers information from all of the other sources of public and private information that are available. Collecting this data is core to their business.
Assume your data has been stolen.
Equifax has a form on its website you can use to see if your data was affected by the breach. All you do is enter your last name and the last six digits of your social security number. There are reports that it is not accurate.
Be on the alert for scams related to this event.
Imposter web sites and trick emails (phishing) claiming to be from your bank or credit card company.
Check your credit report to verify your current state.
Establish a state-regulated credit freeze on your file with all four credit-reporting agencies:
Equifax, Experian, TransUnion, and Innovis. This will help prevent the opening of new accounts in your name without your knowledge or approval. It will not affect your current active accounts. Important: Do not confuse a state-regulated credit freeze with other products the credit agencies may be selling or offering, such as “credit locks” or “credit monitoring services.” More information on state regulated credit freezes can be found here: Consumers Union’s Guide to Security Freeze Protection
If you need to open a new account of any kind that requires access to your frozen credit reports, temporarily remove the freeze with the appropriate credit agency or agencies.
Make sure your current bank, brokerage, and retirement accounts are protected with what is known as “multi-factor authentication.”
This lowers the risk of criminals taking control of your existing accounts. It means that an institution uses more than just a simple username and password to verify it is really you. This could include answering security questions when you log in that only you would know. Or, you may sign up to receive a text or email with a one-time use password or number code.
If your accounts are not protected with any of these extra measures, contact the institution. Demand that they increase their authentication security.
A recent study found that less than half of consumers take basic protective steps after a major data breach. About three-quarters of people cite “lack of direction” as the driver of their feelings of frustration, anger and anxiety. We encourage you to take these easy steps to protect yourself and those you care for, and join us in sleeping better at night!
Stay safe out there.
Written by the Information Security team at The University of Vermont Health Network.