Equifax Data Breach Affected 2.4 Million More Consumers
Consumer Reports has no financial relationship with advertisers on this site.
Equifax has announced that an additional 2.4 million consumers had their personal information accessed during last year’s massive cyberattack.
But the credit-reporting agency says this breach was more limited in scope, involving only consumer names and partial driver’s license numbers. The company said that in most cases the breach didn’t include home addresses, driver’s license states, dates of issuance, or expiration dates.
When Equifax first announced the breach in September, it said about 145.5 million Americans had their personal information accessed, including Social Security, driver’s license, and credit card numbers.
With this latest disclosure, the total number of consumers affected is now about 148 million.
“This is not about newly discovered stolen data,” says Paulino do Rego Barros Jr., interim CEO. “It’s about sifting through the previously identified stolen data, analyzing other information in our databases that was not taken by the attackers, and making connections that enabled us to identify additional individuals.”
Equifax says it will notify these newly identified U.S. consumers directly, and will offer identity-theft protection and credit file monitoring services at no cost to them.
Consumer advocates used the latest disclosure to renew calls for congressional action.
“It’s been five months since Equifax announced the breach,” says Justin Brookman, director of consumer privacy and technology policy for Consumers Union, the advocacy division of Consumer Reports. “The company is still adding millions of new names to the list of people who were impacted. The growing size and scope of the breach underscores the need for Congress to step up and do more to hold companies accountable for keeping our personal data safe.”
In the meantime, there are several ways you can protect yourself.
Place a Freeze on Your Credit File
A security freeze placed on your credit file will block most lenders from seeing your credit history. That makes a freeze the single most effective way to protect against fraud.
If a prospective lender can’t pull your credit report, it won’t issue a new loan. That usually stops identity thieves from setting up fraudulent accounts in your name.
There’s a drawback, though. The freeze also shuts out most companies you may want to do business with, including lenders, telecom companies, and insurers.
To give them access when you want to apply for a loan or open a cellular service account, you have to temporarily lift the freeze and set a date for it to be reinstated automatically.
If you’ve already been the victim of identity theft, a less restrictive option is a fraud alert, which is a notice placed on your credit report that lets prospective lenders know that you are a victim of identity theft and that they should take reasonable extra steps to verify your identity before granting credit to the person claiming to be you.
While a credit freeze offers far more protection than a fraud alert, banks and credit unions where you already have accounts can still check your credit report, as well as collection agencies and certain government agencies.
A freeze might be free, depending on your state and circumstances—for example, if you’re an identity-theft victim and have filed a police report about the incident. Otherwise, expect to pay $2 to $12 to initiate or temporarily lift a freeze at each credit bureau: Equifax, Experian, Innovis, and TransUnion. Review your state’s law for details.
Consider a Credit Lock
Like a credit freeze, a credit lock, a service all three major credit bureaus provide, prevents someone from opening a credit account in your name. But although credit locks and freezes do the same thing, there are some important differences between the two.
First, there’s the question of speed and convenience. A credit lock, which you initiate using an app on your smartphone, generally happens right away. Activating and lifting a security freeze can be a little more time-consuming. The credit bureaus say they need 24 to 48 hours to process the request.
There are also cost considerations. Only two credit monitoring bureaus, Equifax and TransUnion, offer free credit-lock products. Experian offers a subscription-based credit-lock product called CreditLock through CreditWorks, but it costs $5 for the first month and $25 per month thereafter.
Locking down only two of your three main credit reports isn’t enough. Experts say you have to lock all three.
Another difference between a lock and a freeze: The latter offers stiffer protections. A credit freeze’s promise to guard your credit accounts is guaranteed by law. By contrast, a credit lock is simply an agreement between you and the credit monitoring company. Having a contractual agreement is not as strong as having protections under law.
Activate Two-Factor Authentication
In today’s world of digital crime and internet fraud, two-factor authentication is an important extra layer of safety. It requires not just a password but also a second element, such as a code texted to your smartphone, which you have but a crook can’t easily get. Set up and activate two-factor authentication on all your existing mobile banking, savings, credit card, home equity line of credit, and other financial accounts that offer it.
Most banks that offer mobile banking also authenticate the device you use to access your account. Banks with the most cutting-edge security use yet another factor, biometric authentication, which verifies your identity by using your fingerprint or voice print, or through facial recognition—which criminals can’t easily fake.
More from Consumer Reports:
Top pick tires for 2016
Best used cars for $25,000 and less
7 best mattresses for couples
Consumer Reports is an independent, nonprofit organization that works side by side with consumers to create a fairer, safer, and healthier world. CR does not endorse products or services, and does not accept advertising. Copyright © 2018, Consumer Reports, Inc.
