SSN compromised on dark web?

[ZiziPB]

Woke up this morning to 6 notifications that my SSN has been compromised on the dark web.  These are coming from the credit monitoring services on my credit cards.  Are these legit?  What do I need to do?

[neo von retorch]

I also got recent notifications like this. My situation may be different.

A bank already fraudulently created an account using my information for another person (about 3 years ago), so I have:

* my credit frozen
* fraud alerts
* checking frozen (see https://www.chexsystems.com/security-freeze/place-freeze )
* lots of these identity monitoring services (all free) giving me alerts

So my SSN being "out there" isn't new and there's nothing I can really "do" about it. But if you haven't done the above, I would recommend it. It's relatively easy to "thaw" your credit in the rare moment you are applying for credit / a loan. Sometimes they'll even tell you which agency they'll hit so you don't have to thaw them all.

[FireLane]

Everyone's personal information is compromised and available on the dark web. If not yet, it will be eventually. Unfortunately, it's a fact of life.

There's nothing you can really do about it, other than freezing your credit at the major credit agencies and keeping it frozen, and checking your credit report every so often just in case. I don't think those credit monitoring and LifeLock-type services do anything useful; I suspect they're just another way to extract money from you.

[jrhampt]

neo - I already have most of these measures in place, but I've never heard of freezing checking.  How does that work?

[neo von retorch]

neo - I already have most of these measures in place, but I've never heard of freezing checking.  How does that work?

Basically the same as freezing credit. Should prevent the opening of checking accounts using your SSN.

[yachi]

It may have been leaked from the recent "National Public Database" hack.  I found my information leaked when I checked a database from cybersecurity firm Pentester.  Their checker is here: https://npd.pentester.com/  It returns everyone in your state with the same name, the addresses, and a redacted SSN consisting of just the last two digits.

I checked for people I'm related to (except for underage kids), and found around 50% of those where leaked.  Because of what NPD does (did?) it tended to be those who worked jobs or often switch jobs.

This was my first leak, so I froze my credit with all 4 credit agencies (Innovis is the fourth one I didn't realize even existed until this hack).  I already had my credit frozen with TransUnion.

[ZiziPB]

I’m having a really hard time freezing my credit.  Tried doing it online but I’m not able to - possibly because I’m not in the US?  Calling the credit agencies seems impossible.  I’m on hold forever…

Any suggestions?

[ZiziPB]

It may have been leaked from the recent "National Public Database" hack.  I found my information leaked when I checked a database from cybersecurity firm Pentester.  Their checker is here: https://npd.pentester.com/  It returns everyone in your state with the same name, the addresses, and a redacted SSN consisting of just the last two digits.

I checked for people I'm related to (except for underage kids), and found around 50% of those where leaked.  Because of what NPD does (did?) it tended to be those who worked jobs or often switch jobs.

This was my first leak, so I froze my credit with all 4 credit agencies (Innovis is the fourth one I didn't realize even existed until this hack).  I already had my credit frozen with TransUnion.

Thanks for this.  It looks like both my daughter and I were in the leak… Ugh!

[yachi]

I’m having a really hard time freezing my credit.  Tried doing it online but I’m not able to - possibly because I’m not in the US?  Calling the credit agencies seems impossible.  I’m on hold forever…

Any suggestions?

It differs between agencies, but I'm in the US and still had to call (both, I think) Experian and Equifax.  I was on hold for a while, and I think I called on a Saturday morning.  I think they have higher volumes than normal because of the data breach.

[spartana]

Try this number: 1-877-322-8228 it's for ordering all 3 credit reports (Equifax, Transunion and Experian) but I believe you can freeze everything too.

[neo von retorch]

It may have been leaked from the recent "National Public Database" hack.  I found my information leaked when I checked a database from cybersecurity firm Pentester.  Their checker is here: https://npd.pentester.com/  It returns everyone in your state with the same name, the addresses, and a redacted SSN consisting of just the last two digits.

Related: Nearly 3 Billion People Hacked in National Public Data Breach. What You Need to Know (kiplinger.com)

Also, holy F. So yeah so far just about anyone in my family / inner circle is in there with up to a dozen or so of our former (and occasionally current) addresses associated with our name, DOB, SSN, sometimes phone number...

[Sandi_k]

It may have been leaked from the recent "National Public Database" hack.  I found my information leaked when I checked a database from cybersecurity firm Pentester.  Their checker is here: https://npd.pentester.com/  It returns everyone in your state with the same name, the addresses, and a redacted SSN consisting of just the last two digits.

I checked for people I'm related to (except for underage kids), and found around 50% of those where leaked.  Because of what NPD does (did?) it tended to be those who worked jobs or often switch jobs.

This was my first leak, so I froze my credit with all 4 credit agencies (Innovis is the fourth one I didn't realize even existed until this hack).  I already had my credit frozen with TransUnion.

Thanks for the Pentester site - I hadn't frozen with Innovis, but I plan to. Ditto with ChexSystems.

https://www.innovis.com/personal/securityFreeze

https://www.chexsystems.com/security-freeze/place-freeze

I ran the names for my parents, my DH, my in-laws, my brother, my sister, and our BFFs. ALL OF THEM were part of the breach. Ugh

[Wolfpack Mustachian]

How hard is it to unfreeze your credit when you want to apply to for a credit card?

[neo von retorch]

How hard is it to unfreeze your credit when you want to apply to for a credit card?

I have not found it to be too difficult. Once I went through the initial identity verification process with each of the credit reporting agencies, I created an online account with them, saving the passwords to my password manager (Bitwarden). Subsequently, it's easy to log in, choose the "thaw" or "unfreeze" option, and set a date range. If you can, ask your loan officer up front what agency/ies they plan to query and when. Obviously you don't get that option with online credit card applications, but you might with an in person car loan, etc.

[yachi]

How hard is it to unfreeze your credit when you want to apply to for a credit card?

I have not found it to be too difficult. Once I went through the initial identity verification process with each of the credit reporting agencies, I created an online account with them, saving the passwords to my password manager (Bitwarden). Subsequently, it's easy to log in, choose the "thaw" or "unfreeze" option, and set a date range. If you can, ask your loan officer up front what agency/ies they plan to query and when. Obviously you don't get that option with online credit card applications, but you might with an in person car loan, etc.

Cheers, and may it forever work the way Neo describes.  However, my situation lifting a TransUnion credit freeze a few months ago is more in keeping with this Reddit user's description:

Going through this hellscape right now. I wanted to check and freeze account, I keep going through the loop not knowing username or password, creating new account, the system telling me I have an account, getting a code to reset password, then it doesn’t take the new password, it keeps going to the set new password page. I’m giving up for today since it’s a holiday and can’t call anyway."

I think between when I started the freeze (many, many years ago) and when I wanted to lift it, they changed login password requirements or some nonsense.  I actually was able to call, and they lifted the freeze.  Helpfully, they asked the start and end date of the freeze.

I imagine it's still 100x easier to freeze/unfreeze credit than it is to deal with the consequence of accounts being unknowingly opened in your name.

[FLBiker]

Please set me straight if I'm wrong, but (in terms of the NPD breach) isn't it likely that all of this information was already out there?  I'm 48 years old, and I lived in America most of my life.  For the past 15 years or so, I've just assumed that my SSN isn't really secure.  I've had a couple of issues over the years, but the banks have typically caught it before I did.  I check our credit reports a few times a year and make sure that nothing was opened that shouldn't have been, but that's it.  Am I naive?  Thanks!

[eyesonthehorizon]

Please set me straight if I'm wrong, but (in terms of the NPD breach) isn't it likely that all of this information was already out there?  I'm 48 years old, and I lived in America most of my life.  For the past 15 years or so, I've just assumed that my SSN isn't really secure.  I've had a couple of issues over the years, but the banks have typically caught it before I did.  I check our credit reports a few times a year and make sure that nothing was opened that shouldn't have been, but that's it.  Am I naive?  Thanks!

A lot of people have had their data leaked before (often multiple times, by banking or telecoms companies) but the extent of this leak was very wide. Dates of birth, addresses, phone numbers, social security numbers, everything you’d need to fake an identity.

In general I don’t know if there’s a lot of reason to be walking around with unfrozen credit inquiries unless you’re actively seeking a loan.

[jrhampt]

Yes, I think this leak was basically the entire adult population of the US (around 275k, total US pop is around 330k)

[Sandi_k]

Yes, I think this leak was basically the entire adult population of the US (around 275k, total US pop is around 330k)

Uh, that's MILLIONS.

275M adults and 333M total population in the US.

[eyesonthehorizon]

Yes, I think this leak was basically the entire adult population of the US (around 275k, total US pop is around 330k)

Uh, that's MILLIONS.

275M adults and 333M total population in the US.

Perils of talking about personal finance all the time! I’ve accidentally added “k” on the end of figures meant to be in the tens or hundreds before & really alarmed people.

[Monkey stache]

At this point, every single American's personal info is on the dark web. Freeze your credit with all 3 bureaus and thaw them when you need to run your credit (loan/credit card/mortgage application, credit limit increase, etc.).

If you're an American abroad, use a VPN when signing up and logging in to avoid running into problems.

After you've done that, remove yourself from data brokers' websites. I like the free version of Optery for this but it does involve some legwork on your end (the paid version does everything for you). Data brokers are private companies that buy and sell your data and put it out there on the internet for everyone to see. It can include info like your home address, phone number, email address, names of your relatives and their data, etc.

[jrhampt]

Yes, I think this leak was basically the entire adult population of the US (around 275k, total US pop is around 330k)

Uh, that's MILLIONS.

275M adults and 333M total population in the US.

Perils of talking about personal finance all the time! I’ve accidentally added “k” on the end of figures meant to be in the tens or hundreds before & really alarmed people.

Ah yes, sorry.  I meant M, not K.  So yeah, best to assume data of entire adult pop is compromised.

[lhamo]

Another suggestion:

If you do not already have a profile for each of the credit bureaux, set one up immediately.

I had a physical credit card stolen from my mailbox in December 2021.  Within hours of obtaining the card, the thieves set up a fake account on transunion and accessed my credit report.  With the information they found there, they were able to set up an online account at Bank of America.  They then went into a branch, and withdrew a $3000 cash advance.  This was in addition to making charges on the physical credit card they had in their hands (thankfully nothing too big) and applying for several additional credit cards that they and at least one loan (which never went through).

I learned of their activities one week after it all started, when I got a message from American Express about a credit application I hadn't made.  The fraudulent credit card charges/applications were pretty easy to dispute.  It took several months to unwind the cash advance.  I was fortunate in that I had proof I was actually in the hospital getting retinal surgery the day they opened the fake checking account and took out the cash, so there was no way it could have been me.

I have found freezes to be pretty easy to manage since then. 

[ZiziPB]

I was finally able to freeze at Experian and TransUnion.  For some reason Equifax has trouble verifying me with their automated system so I need to actually speak to live person.  So need to try again once they open at 9 EST.

ETA:  Equifax is now done as well.  25 minutes on the phone, but I'm feeling less stressed about this issue now.

[oneday]

Late to the party, but an MMM'er posted what seems like a pretty comprehensive post about this in 2017 when the big Equifax breach happened. There is overlap with advice in this thread, but I like that this other thread has an list with order of operations and other things to think about as you are going through the process:

https://forum.mrmoneymustache.com/welcome-to-the-forum/freezing-your-credit-and-a-half-dozen-other-tips-to-protect-your-identity/

Just froze my Innovis & ChexSystems reports which I hadn't done since 2017, oops!

[RWTL]

I've had the big three credit reports frozen but didn't realize there was a fourth or that you could freeze checking.  Thanks!

[BlueHouse]

One other thing you can do is to not share any personal info.  It seems obvious in context, but sometimes it's easy to think you're just talking about something unrelated.

Conversations about accents --- they can start delving into where you're from originally (place of birth).

Questions about baby names -- "what are some old family names for girls..what was your grandmother's name"  "Did every woman used to have the same middle name?  What was your mom's middle name?" 

What car do you recommend?

As more and more of our social lives moves online, it's so easy to get people to tell you personal info...which can lead to security questions or even to help with identifying features.

[Taran Wanderer]

I had a physical credit card stolen from my mailbox in December 2021.

And this is why I’ve kept our PO Box for the past 25 years even as the cost has grown to $200 per year.  Cheap insurance.

[obstinate]

Personally I don't even worry about it. My data has been leaked in 11 billion different breaches over the last few years. So my SSN is out there. And probably plenty more besides.

The main thing I will do is, 9 months before the next time I want to buy a house, check my credit. Make sure everything's still looking good. Nine months should be enough time to get things cleared up in the average case, and I can always delay home buying a little if it takes longer.