Equifax Breech

[sobezen]

In CA it does not cost anything to place a freeze at each of the three credit bureaus.  While doing so contact each of your existing credit card companies and request new cards to be issued to you so your previous cards are closed.  During the last few years so many large companies and even government agencies were targeted by hackers.  Most people heard of Target, but HomeDepot, Wells Fargo, Intel, Sony, and even the CA DMV, were all successfully penetrated and had sensitive consumer data stolen.  Be proactive fellow Mustachians.

Yesterday I checked Equifax and it isn't free. Only free if you're the "victim of ID theft." So basically after the fact. Requires a police report for confirmation of ID theft.

https://help.equifax.com/s/article/ka137000000DSDyAAO/What-are-the-security-freeze-fees-in-my-state

There are ways around it, talk to a manager at the POS credit bureau and get them to place freeze.  I've been placing freezes since 1990 and never paid once.  Also I never had police reports either.  YMMV.

[sobezen]

Is there a way to demand a complete delete of your data at the credit bureaus?

Got the house, minimal credit cards, what do I need those MF for?

If you get rid of all credit, i.e. close all credit card accounts and payoff your mortgage then after a few years you will have no credit score. However, I don't think there's anyways to keep these companies from collecting your information. Not to mention the myriad other companies that collect your information from other sources (marketing firms, etc.)

If removing all credit is a concern, you can always try to go off the grid.  Close all accounts (mortgage, credit cards, loans, savings, checking, et al) and then, easier said than done, strictly use cash.  You can buy land and even a tiny home, but chances are you will still need to register with the utilities company; sadly, this usually requires a credit card of checking account. All of your pre-existing information will still exist in the databases of various credit bureaus and companies that profit from marketing your personal data.  I would imagine a better alternative would be to do the first part and then, move to another country and use cash only there.

[clash]

Experian appears to have shut down their online freeze option.

[Bracken_Joy]

Experian appears to have shut down their online freeze option.

Well shit.

I was just getting husband to come around to the idea. We're both "likely affected".

[bobechs]

In our crappy state of Washington, it costs $10 per agency to freeze your credit and the same price to temporarily thaw then refreeze it.  So for my wife and I, it costs $60 to freeze our credit.  During the year if we change car insurance or want to rent a house, apply for a credit card, open a checking account, it costs $20 each time (for joint accounts).

This is probably a major score for Equifax (driving people to freeze their credit and increase Equifax revenues by about $200,000,000 a year at least)

What a complete scam.

How soon until the class action lawsuit?

You're too late. 

One already filed in Oregon Federal court, remains to be seen if will be certifed, what effect it might have on the credit reporting industry and if there will be any benefit to victims (other than a discount coupon or some other settlement bullshit).

[clash]

n/m

[bobechs]

Is there a way to demand a complete delete of your data at the credit bureaus?

Got the house, minimal credit cards, what do I need those MF for?

They don't work for you, in case you hadn't noticed.  You sound like a dangerous radical.

It is only your data in the sense that it is your responsibilty to accept the consequences if it is misused.

[phil22]

Here is the link for Washington state Attorney General consumer complaint form:

https://fortress.wa.gov/atg/formhandler/ago/ComplaintForm.aspx


Do not be a sheep and let Equifax get away with collecting millions of dollars in freeze credit fees just because they made you scared with their lax security.

thanks for the link.  complaint submitted.

[Syonyk]

https://api.cointelegraph.com/amp/v1/news/equifax-hackers-demanding-26-mln-in-bitcoin-or-else

Whee. The hackers demanded 600BTC (~$2.6M) or they'll make the data public.

[fattest_foot]

Looks like Equifax is an even bigger mess than we thought. This is criminally bad security they've got.

https://twitter.com/webster/status/906346071210778625

Equifax security freeze PINs are worse than I thought. If you froze your credit today 2:15pm ET for example, you'd get PIN 0908171415.

That's right, Equifax assigns a PIN by the time you ask for the freeze. Which means it'll be incredibly easy to brute force your PIN (assuming they can get the hash, which based on their terrible security so far seems high).

[WhiteTrashCash]

I feel like a genius right now for freezing all my credit reports two years ago. Way to go, me!

[Exflyboy]

Oh FFS!!!!!

[nottoolatetostart]

I agree, Exflyboy, FFS.

[GrumpyPenguin]

I agree, Exflyboy, FFS.

+1

[Valhalla]

Looks like Equifax is an even bigger mess than we thought. This is criminally bad security they've got.

https://twitter.com/webster/status/906346071210778625

Equifax security freeze PINs are worse than I thought. If you froze your credit today 2:15pm ET for example, you'd get PIN 0908171415.

That's right, Equifax assigns a PIN by the time you ask for the freeze. Which means it'll be incredibly easy to brute force your PIN (assuming they can get the hash, which based on their terrible security so far seems high).

Jeezus....  they need to can the entire IT / security department and start all over... incompetent fools!!

[With This Herring]

Here is TransUnion's list of credit freeze costs by state for the three main credit bureaus TransUnion, Equifax, Experian (as others posted upthread, the lesser fourth bureau Innovis will let you freeze/thaw/refreeze for free):
https://www.transunion.com/credit-freeze/place-credit-freeze


I have read that you should NOT use the https://www.equifaxsecurity2017.com site to check if you are affected by the breach.  The site is said to NOT be secure, it provides a different answer if you check the same info twice, and it will give answers even if you put in garbage info.

When I went to the website to verify this, the first thing that came up was Firefox's warning:

Your connection is not secure

The owner of www.equifaxsecurity2017.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.

After choosing to go ahead anyway, I entered the last name "Abcdefghijkl" (not my actual last name, haha) and the SSN last six digits of 939393.  Good news, it's not affected by the breach!

[sparkytheop]

They've included a statement that signing up for monitoring won't affect your rights...

"2). NO WAIVER OF RIGHTS FOR THIS CYBER SECURITY INCIDENT
In response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident."

[DoubleDown]

Past experience says any class action lawsuit will end up being meaningless for 99.9999% of us (like most class action lawsuits, where the lawyers get rich and the consumers get nothing). As an example, my data was compromised from the Home Depot hack several years ago. After the lawsuit/settlement, I was told I could apply for compensation up to 2-3 hours of my time spent cleaning up the mess (canceling compromised credit cards, freezing credit, etc.). I dutifully filed a claim saying I had spent 2 hours dealing with the mess, which was promptly denied because I did not provide "documentation or proof" that I had spent that amount of time. WTF, as if anyone could prove such a thing. Sure, let me just issue a subpoena to my ISP for records demonstrating how much time I was on the credit card website canceling and requesting new cards and changing my numbers on all my online bill payments...

[robartsd]

https://api.cointelegraph.com/amp/v1/news/equifax-hackers-demanding-26-mln-in-bitcoin-or-else

Whee. The hackers demanded 600BTC (~$2.6M) or they'll make the data public.

There's no reasonable reason to pay the ransom as there is no way to provide assurance that the stolen data is destroyed and will never be mis-used. They are very unlikely to publicly release the majority of the data, as it would be much more valuable to the hackers to sell the secret data.

[robartsd]

https://api.cointelegraph.com/amp/v1/news/equifax-hackers-demanding-26-mln-in-bitcoin-or-else

Whee. The hackers demanded 600BTC (~$2.6M) or they'll make the data public.

That link also indicates that Equifax execs may be guilty of insider trading:

This hack has created a stir, especially after it was revealed that three Equifax executives sold almost $18 mln in stock just before news of the hack was made public.

[robartsd]

Past experience says any class action lawsuit will end up being meaningless for 99.9999% of us (like most class action lawsuits, where the lawyers get rich and the consumers get nothing). As an example, my data was compromised from the Home Depot hack several years ago. After the lawsuit/settlement, I was told I could apply for compensation up to 2-3 hours of my time spent cleaning up the mess (canceling compromised credit cards, freezing credit, etc.). I dutifully filed a claim saying I had spent 2 hours dealing with the mess, which was promptly denied because I did not provide "documentation or proof" that I had spent that amount of time. WTF, as if anyone could prove such a thing. Sure, let me just issue a subpoena to my ISP for records demonstrating how much time I was on the credit card website canceling and requesting new cards and changing my numbers on all my online bill payments...

I think it should be possible to get Equifax on the hook for covering all costs of credit freeze/thaw for each stolen SSN for life. I have no expenctation that a deserved monetary compensation would be provided to the victims.

[Syonyk]

There's no reasonable reason to pay the ransom as there is no way to provide assurance that the stolen data is destroyed and will never be mis-used. They are very unlikely to publicly release the majority of the data, as it would be much more valuable to the hackers to sell the secret data.

Well, we should know how things turned out by the end of the week!

[sobezen]

Have any of you locked your accounts?  I just freeze but wondering if anyone has tried it and with any success?

https://www.transunion.com/credit-freeze/place-credit-freeze2

Lastly, how many of you obtained police reports?  When you did what did you explain to the officer for them to complete the report?  Share your experiences.  I know some of the bureaus require it but I've never filed one for my state of CA and still placed freezes.

[sobezen]

Experian appears to have shut down their online freeze option.

I just froze mine on Experian online. No issues.

I tried again and no dice.

Tried calling and selecting phone and it auto states has to be mailed in (no personal info input)

As of today the Equifax online free submission page works
https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp

[Bracken_Joy]

Sobezen- I recommend deleting the time stamp of your transaction with equifax, since it turns out that's all they use to formulaically generate the PINs. Maybe I'm paranoid, but I'd hate for my PIN to be out there and someone to figure out who I was based on my info on the forums.

[sobezen]

Good point Bracken_Joy. T hanks.  I am all for prudent paranoia.  Did you also place freezes with the other bureaus?  Did you do it online or by phone?  And were you able to obtain a police report so you would not be required to pay the inane $10 per bureau?  Thanks!

[lbmustache]

Sobezen- I recommend deleting the time stamp of your transaction with equifax, since it turns out that's all they use to formulaically generate the PINs. Maybe I'm paranoid, but I'd hate for my PIN to be out there and someone to figure out who I was based on my info on the forums.

Ugh - that's mine :( I deleted the original post and messaged the posters who quoted it to edit/remove it. Worst case maybe I can have a mod edit it...

[Bracken_Joy]

Good point Bracken_Joy. T hanks.  I am all for prudent paranoia.  Did you also place freezes with the other bureaus?  Did you do it online or by phone?  And were you able to obtain a police report so you would not be required to pay the inane $10 per bureau?  Thanks!

Online, all four (innova or whatever it is was free). Equifax was free for DH, I did his a couple days after mine (mine was not free). Otherwise yes, $10 per, so $50 for the two of us total. No police report, because no crime has yet been committed.

[A Definite Beta Guy]

Here is TransUnion's list of credit freeze costs by state for the three main credit bureaus TransUnion, Equifax, Experian (as others posted upthread, the lesser fourth bureau Innovis will let you freeze/thaw/refreeze for free):
https://www.transunion.com/credit-freeze/place-credit-freeze


I have read that you should NOT use the https://www.equifaxsecurity2017.com site to check if you are affected by the breach.  The site is said to NOT be secure, it provides a different answer if you check the same info twice, and it will give answers even if you put in garbage info.

When I went to the website to verify this, the first thing that came up was Firefox's warning:

Your connection is not secure

The owner of www.equifaxsecurity2017.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.

After choosing to go ahead anyway, I entered the last name "Abcdefghijkl" (not my actual last name, haha) and the SSN last six digits of 939393.  Good news, it's not affected by the breach!

Your Equifax "PIN" is also just the timestamp of your request. So all of you telling me that you just froze your credit, I know that the first digits of your incredibly complicated PIN are probably 09082017, 09092017, 09102017, 09112017....

Most likely their security was breached because they made "password" the password to their database.

[talltexan]

PTF

[CheapskateWife]

Experian appears to have shut down their online freeze option.

I just froze mine on Experian online. No issues.

I tried again and no dice.

Tried calling and selecting phone and it auto states has to be mailed in (no personal info input)

As of today the Equifax online free submission page works
https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp

Tried this at various times today, and took about 6 attempts to get it done.  That being said, there was no charge for either of us to place a credit freeze.  Perhaps the spotty success had to do with getting rid of the requirement to pay (we are in a state that allows them to charge us)

[sobezen]

Here is TransUnion's list of credit freeze costs by state for the three main credit bureaus TransUnion, Equifax, Experian (as others posted upthread, the lesser fourth bureau Innovis will let you freeze/thaw/refreeze for free):
https://www.transunion.com/credit-freeze/place-credit-freeze


I have read that you should NOT use the https://www.equifaxsecurity2017.com site to check if you are affected by the breach.  The site is said to NOT be secure, it provides a different answer if you check the same info twice, and it will give answers even if you put in garbage info.

When I went to the website to verify this, the first thing that came up was Firefox's warning:

Your connection is not secure

The owner of www.equifaxsecurity2017.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.

After choosing to go ahead anyway, I entered the last name "Abcdefghijkl" (not my actual last name, haha) and the SSN last six digits of 939393.  Good news, it's not affected by the breach!

Your Equifax "PIN" is also just the timestamp of your request. So all of you telling me that you just froze your credit, I know that the first digits of your incredibly complicated PIN are probably 09082017, 09092017, 09102017, 09112017....

Most likely their security was breached because they made "password" the password to their database.

Nope the Equifax PIN does not equal the time stamp for me.  Maybe for others but it is not even remotely close.

[clash]

^ They changed it over the weekend.  I read online you can request a new PIN.  Assume they'll mail it if you call in.

[sobezen]

Good point Bracken_Joy. T hanks.  I am all for prudent paranoia.  Did you also place freezes with the other bureaus?  Did you do it online or by phone?  And were you able to obtain a police report so you would not be required to pay the inane $10 per bureau?  Thanks!

Online, all four (innova or whatever it is was free). Equifax was free for DH, I did his a couple days after mine (mine was not free). Otherwise yes, $10 per, so $50 for the two of us total. No police report, because no crime has yet been committed.

@Bracken_Joy: Even after a crime has been committed and someone went to a shopping spree using your credit cards, or an assumed identify, the police cannot confirm the events, parties involved, nor can they really investigate it after drafting a report.  So I am extremely skeptical why credit bureaus require a police report.  What good does a police report serve the credit bureaus?  To me obtaining a police report is yet another illogical requirement created by the bureaus.

[Bracken_Joy]

Good point Bracken_Joy. T hanks.  I am all for prudent paranoia.  Did you also place freezes with the other bureaus?  Did you do it online or by phone?  And were you able to obtain a police report so you would not be required to pay the inane $10 per bureau?  Thanks!

Online, all four (innova or whatever it is was free). Equifax was free for DH, I did his a couple days after mine (mine was not free). Otherwise yes, $10 per, so $50 for the two of us total. No police report, because no crime has yet been committed.

@Bracken_Joy: Even after a crime has been committed and someone went to a shopping spree using your credit cards, or an assumed identify, the police cannot confirm the events, parties involved, nor can they really investigate it after drafting a report.  So I am extremely skeptical why credit bureaus require a police report.  What good does a police report serve the credit bureaus?  To me obtaining a police report is yet another illogical requirement created by the bureaus.

Oh absolutely. Doesn't mean they don't require it for a free freeze though.

I did just write equifax to request a new PIN and ask for a refund of my $10 though. We'll see if anything comes of it.

[sobezen]

Oh absolutely. Doesn't mean they don't require it for a free freeze though.

I did just write equifax to request a new PIN and ask for a refund of my $10 though. We'll see if anything comes of it.

Keep us posted.

[RidetheRain]

I know people are worried about the 1 year only of credit monitoring, but I will add a silver lining to a cloud that gets darker the longer I type.

I have had free credit monitoring for the last 3 years and this is going to be the 4th year in a row. Most likely, another company will loose your data fairly quickly after the year is up (or before!?) and you will get another complimentary year of free monitoring. So far, my credit has been lost by my college, my apartment complex parent company, my bank, and now Equifax.

After the first breach, my data was out there. No coming back from that. So each additional time doesn't bother me too much because I get free monitoring and I've already got the freeze worked out. I suggest everyone live like the data is out there for the rest of your life. This is reality. I work in data security for a pretty big company that does security for a lot of major firms you may know in the states and the idea of online security makes me giggle. There is no security. You have no private information if you have given it out to anyone. Including the government.

My advice: take this opportunity to read about how to protect your credit and live with the results forever. Memorize another PIN so that you can freeze and unfreeze your credit as necessary, but don't go back to this free moment when you can apply for credit on a whim.

[Bracken_Joy]

So question. I was reading an article that indicated that, using SSN and such, it's possible for drivers licenses and/or doctors visits in your name. Then any resultant speeding tickets or med reconciliation issues would be on you. 1- any truth to this? 2- how do you detect if it happens? 3- any way to prevent this aspect of it?

Since those aren't tied to credit, I don't see that security freezes would have any bearing on them.

[sobezen]

You can request schools, hospitals, businesses, and even other institutions to use an alternative number instead of your social security number as an identifier.  It is not a legal requirement for many businesses and institutions to use your SS for identification.  YMMV.

[farfromfire]

Looks like Equifax is an even bigger mess than we thought. This is criminally bad security they've got.

https://twitter.com/webster/status/906346071210778625

Equifax security freeze PINs are worse than I thought. If you froze your credit today 2:15pm ET for example, you'd get PIN 0908171415.

That's right, Equifax assigns a PIN by the time you ask for the freeze. Which means it'll be incredibly easy to brute force your PIN (assuming they can get the hash, which based on their terrible security so far seems high).

lol - who the hell's in charge of data/cyber security there? And here I thought that as private companies in a competitive marketplace, the credit bureaus would have the incentive to do the best job protecting our data that they possibly could.

[clash]

https://www.nytimes.com/2017/09/12/your-money/equifax-fee-waiver.html?mcubz=3

Equifax, Bowing to Public Pressure, Drops Credit-Freeze Fees for 30 Days...

Does anyone know if we'll get refunds?  What a joke all this is

[Michael in ABQ]

https://www.nytimes.com/2017/09/12/your-money/equifax-fee-waiver.html?mcubz=3

Equifax, Bowing to Public Pressure, Drops Credit-Freeze Fees for 30 Days...

Does anyone know if we'll get refunds?  What a joke all this is

I submitted a freeze over the phone with Equifax but they haven't charged my debit card yet. I did it online for my wife last night and there was no charge. Experian still charged both of us $10.50. TransUnion is free in our state and Innovis doesn't charge at all.

Hopefully this event prompts all of the credit bureaus to eliminate these fees.

[sobezen]

Equifax is bowing to public pressure?  Bend more.  Shouldn't Equifax take more responsibility for the security breach and offer complimentary freezes and credit monitoring service for at least three years or more?  As others stated this entire situation is a pathetic joke on us the public. 

Also it is amazing the other credit monitoring "services" are not legally required to provide complimentary account freezes whenever one of the bureaus security is breached.  I've been writing to local officials and Senators for 20+ years and consumer protection remains a joke.

[markbike528CBX]

Has anyone send a bit or byte of information to any of the credit bureaus? 

I think it unlikely.

They, along with the reporting companies are the ones guilty of data theft.

They merely collected the info for the convenience of the later hackers.

Disclosure,  I get credit checks several times a year for my job.   The fact that I therefore don't have to keep all that data available on request is a convenience for me.

[effigy98]

Online links error when I try to use them after giving a credit card.

[DoubleDown]

Most likely their security was breached because they made "password" the password to their database.

And you thought you were speaking tongue-in-cheek...

http://www.msn.com/en-us/money/companies/equifax-used-admin-for-the-login-and-password-of-a-non-us-website/ar-AArVYHu

Scores of accounts on Equifax (EFX)'s website in Argentina allegedly were protected by the same generic username and password: "admin."
 
Researchers at Hold Security, a Milwaukee-based cybersecurity firm, found that after some guesswork, they were able to uncover personal employee information housed on Equifax's South American site, including names, emails, and Social Security equivalents of over 100 individuals.

[Valhalla]

Most likely their security was breached because they made "password" the password to their database.

And you thought you were speaking tongue-in-cheek...

http://www.msn.com/en-us/money/companies/equifax-used-admin-for-the-login-and-password-of-a-non-us-website/ar-AArVYHu

Scores of accounts on Equifax (EFX)'s website in Argentina allegedly were protected by the same generic username and password: "admin."
 
Researchers at Hold Security, a Milwaukee-based cybersecurity firm, found that after some guesswork, they were able to uncover personal employee information housed on Equifax's South American site, including names, emails, and Social Security equivalents of over 100 individuals.

holy @#@#$!!   Some people there needs to spend some time in prison for this.

[Michael in ABQ]

I left a message with the New Mexico Attorney General's office last week regarding my displeasure at having to pay the credit bureaus for the privilege of them not selling my information to anyone who requests it. I just got a call back and spoke to an attorney there who is working on the matter. He stated the obvious that probably every single state attorney general is looking into this (plus the federal and various federal agencies) and that they are compiling all of these comments. I mentioned that they should update the state website to reflect that Innovis and Chex Systems are essentially credit bureaus as well and 99% of people aren't aware that they can request a security freeze with them as well.

Hopefully these companies will soon making freezing and unfreezing your credit report completely free. I suspect we'll see some regulation or law to that effect. Hopefully soon as I'm unhappy giving Experian $20.00+tax.

[Valhalla]

I left a message with the New Mexico Attorney General's office last week regarding my displeasure at having to pay the credit bureaus for the privilege of them not selling my information to anyone who requests it. I just got a call back and spoke to an attorney there who is working on the matter. He stated the obvious that probably every single state attorney general is looking into this (plus the federal and various federal agencies) and that they are compiling all of these comments. I mentioned that they should update the state website to reflect that Innovis and Chex Systems are essentially credit bureaus as well and 99% of people aren't aware that they can request a security freeze with them as well.

Hopefully these companies will soon making freezing and unfreezing your credit report completely free. I suspect we'll see some regulation or law to that effect. Hopefully soon as I'm unhappy giving Experian $20.00+tax.

Great to hear that you made a call.  I have emailed and made calls. Unfortunately it seems they are overwhelmed and have not returned my calls, and only form email replies to my emails.  I'm going to keep trying.

[Scortius]

I left a message with the New Mexico Attorney General's office last week regarding my displeasure at having to pay the credit bureaus for the privilege of them not selling my information to anyone who requests it. I just got a call back and spoke to an attorney there who is working on the matter. He stated the obvious that probably every single state attorney general is looking into this (plus the federal and various federal agencies) and that they are compiling all of these comments. I mentioned that they should update the state website to reflect that Innovis and Chex Systems are essentially credit bureaus as well and 99% of people aren't aware that they can request a security freeze with them as well.

Hopefully these companies will soon making freezing and unfreezing your credit report completely free. I suspect we'll see some regulation or law to that effect. Hopefully soon as I'm unhappy giving Experian $20.00+tax.

As a fellow 505er, thanks!  I'll look into placing my own call as well.  It seems like free credit freezes and thaws should be a pretty low bar for any US state.