So, Equifax says your data was hacked—now what?

Yesterday, the credit reporting agency Equifax revealed that the personal data of 143 million US consumers, as well as "limited personal information for certain UK and Canadian residents," was exposed by an attack exploiting security flaws in the company's website. Social Security numbers, dates of birth, addresses, and some drivers license numbers were all exposed—information which could be used to pose as individuals to gain access to financial accounts, open new ones in their names, or file fraudulent tax returns.

Equifax responded by offering all US citizens a one-year credit monitoring service. But the leaked data could have a much longer lifetime than a year on the black market for identity theft and credit fraud, because the information obtained in the attack is irreplaceable. Unlike relatively disposable data such as credit card information or bank account numbers, the data obtained from Equifax could be held for years before use and still be effective.

So what can affected consumers do? Unfortunately, as things stand, the burden is on you to protect yourself in the long term—and the credit reporting agencies stand to profit from it.

Step 1: Enroll in the free thing

Regardless of whether Equifax says your data has been exposed or not, you should enroll in the free TrustedID Premier credit protection service being offered by Equifax. Registering through the site will give you an enrollment date for the service, as Equifax is queuing up people to enroll to avoid overtaxing its systems.

With that service, you get:

• A copy of your Equifax credit reports.
• A year of credit monitoring across all three major credit bureaus (Equifax, Experian, and TransUnion).
• Internet scanning for your SSN to see if it pops up on websites.
• The ability to security freeze or unfreeze your Equifax credit report for one year, free of charge. (We'll talk more about this in Step 3.)

There is some concern that Equifax has tried to supress the right to sue them if you even check if your data was exposed. New York State's Attorney General Eric Schneiderman took to Twitter today to declare that the language is unenforceable:

This language is unacceptable and unenforceable. My staff has already contacted @Equifax to demand that they remove it. https://t.co/vT0x7f5Xhc

— Eric Schneiderman (@AGSchneiderman) September 8, 2017

 

Step 2: Get all the reports

You should get a copy of your credit reports from all three reporting agencies to check if anything unusual has happened with finances associated with your credit over the past four months. Thanks to the Fair Credit Reporting Act, you're entitled to free copies of your reports once every 12 months and in situations where you've been the subject of an adverse report that results in you being denied credit, insurance, or employment. You can get free reports via the clearinghouse site annualcreditreport.com.

You can request all three reports at the same time or space them out over time in order to check for suspicious activity in the months ahead. But if you've been affected by the Equifax breach, you may want all three now. If you spot anything that suggests someone has used your identity fraudulently, contact both the Federal Trade Commission, which acts as the coordinator for identity theft crime, and local law enforcement.

There are other services, such as Credit Karma, that provide free regular checks of your credit reports, paid for by offers from loan and credit companies. This provides more frequent up-dates long-term, but it also insures regular solicitation for new credit.

Step 3: Security freeze

You should also consider putting a security freeze on your credit report data with all three major credit reporting agencies (again, Equifax, Experian and TransUnion). This will prevent anyone (including yourself) from applying for credit or requesting a credit report in your name. This will also prevent people (including yourself) from creating a new phone account, purchasing a new cell phone, and in some cases even obtaining employment using your personal information unless the data is unlocked by you.

In some states, if you've been the victim of identity theft, placing a security freeze is free—but it may require a police report. But if you're merely the victim of a breach and looking to prevent identity theft, it will cost between $5 and $10 per credit agency. You'll also be charged every time you need the security freeze temporarily lifted to apply for new credit, depending on the laws of the state you live in.

While Equifax is offering security locking and unlocking of its reports for free to those who enroll in the one-year protection they are providing, the net result long term is that you'll end up paying an additional $30 or so in fees every time you open new credit or need to allow someone to check your credit history. Absent some sort of legal action or change in credit reporting practices, the security of your identity will be a revenue generator for the credit reporting agencies for some time to come.

Step 4: File your taxes early

Tax identity theft is a thing that is becoming increasingly common. Your address, date of birth, and SSN can be used to file fraudulent tax returns in an attempt to obtain tax refunds in your name or to gain access to your tax transaction data.

The IRS eliminated the use of an e-filing personal identification number, and now the organization requires your adjusted gross income from the previous year to file electronically. The IRS has also begun to roll out an Identity Protection PIN for victims of identity theft and a limited number of other citizens (including residents of the District of Columbia). Chances are that you will not have access to this protection immediately. And in any case, neither of these prevent fraudulent paper tax returns.

For now, your best bet is to file your tax returns as early as possible.

Step 5: Beware of scammers

The data leaked by this breach could be used by individuals seeking to fool victims into paying them directly, either by claiming to be debt collectors or tax authorities. Even if someone provides your social security number over the phone, don't believe them. Your credit report data could also be used in phishing scams targeting individuals with loans or credit cards with specific institutions, so be hyper-aware of those sorts of attacks.