Equifax Data Breach - What you need to know and what you need to do

"Equifax. Wow," I muttered to no one in particular as I listened to the news. The headlines were dampened by a couple of catastrophic hurricanes and an earthquake, but now the severity of the Equifax breach is soaking in.

Since my corporate background included working for a major competitor of Equifax, I felt I should address this to my current industry, both from the stand-point of business but also personal.

Who is Equifax?

Based in Atlanta, Equifax is one of three major consumer data information bureaus (Equifax, Experian and TransUnion). They are the access point for which creditors look to on whether to give you credit, whether the credit is for a home, car, revolving credit, line of credit, etc. Anything and everything lending-wise depends on your information residing at the bureaus.

It is nothing that you can simply stop or un-enroll. You don't pay for it and never signed up for it but when you gained credit, your personal information, credit lenders and credit history was enlisted in their data files. Your credit rating itself depends on the bureau's accuracy.

What happened?

This breach is significant and should be taken every bit as serious as Hurricane Harvey and Hurricane Irma. It is estimated that at least half the population of the United States is at risk, with estimates greater than 143 million Americans. But the breach was not limited to Americans, by the way. Some limited information was obtained of UK and Canadian residents.

A weakness in Equifax's server security was hacked from mid-May through July, exposing names, addresses, social security numbers, birth dates and some driver's license numbers. PLUS credit card numbers for over 209,000.

Who did it?  No clue and if they knew, they aren't going to tell us.  But, I believe we can assume that whoever did this hack did it to use the information they gained not to our benefit. 

Are you affected?

Equifax has created an online registry to check. But, you should proceed as if you were hacked. It is safe to assume that if you have credit, you were breached.

Will it affect my businesses credit rating?

Since most of my clients are small business owners, allow me to address from that perspective. If you gain credit (loans, credit cards, LOC, etc) based on your own personal credit rating, then yes, it will affect you. This includes most small businesses.

If you were me, what would you do?

Exactly what I have done.

I checked Equifax online and, yes, they believe my information is one of the millions hacked. There is nothing like seeing that on the screen to cause a little angst. Being passive about this information will cause greater issues in the future, so here is my plan.

First, I enrolled in the credit monitoring program provided by Equifax for a year free after determining I am at risk. This monitors all bureaus, allows me to lock my Equifax credit report and gives me a copy of my existing report to review. In addition, should my identity be stolen, they provide up to $1m in insurance.

Because I travel extensively, I also use LifeLock and have for a number of years. I recommend this product, even when there are no breaches. Understand please - this breach will not suddenly go away within a year. The repercussions and your information will be sold way beyond into the future. At this time, the monitoring by Equifax is only a year.

Second, I downloaded all my business credit card accounts into QuickBooks and personal credit card accounts into Quicken. I will continue to do so weekly for this next year. One of my business cards does not have a chip so I requested a replacement card that has a chip. 

One of my credit card information was recently stolen locally. The card company called immediately due to the number of transactions used at non-chip reading machines. Chips matter. Basic credit information can be replicated on magnetic strips, as in this case, but chips cannot be reproduced. My credit card numbers and security code were probably stolen at a restaurant. They could reproduce a fake card with a magnetic strip but they could not reproduce the chip.

I have begun requesting retail outlets I shop at to have chip machines - it truly does prevent retail theft. Those businesses the thieves used my card at were not paid for their products. The theme I have heard in businesses that are not utilizing chip reading machines is that they don't want to pay to replace.

Seriously? The thieves were able to steal over $900 of products from 4 different stores and mine was just one card. I think the front end is not paying attention to the back end financially.

Third, I am in the process of locking down my credit at the bureaus. It is worth whatever few dollars it cost because the cost is incrementally less than identity theft. Freezing your credit with each of the bureaus blocks anyone from opening any kind of account with your credit. However, if you are in the market for a new home or new car or apply for a new credit card, you will need to then unfreeze your credit PRIOR to purchasing. Yes, it may cost $0 to $15 to freeze your credit at the bureau(s). In this case, it's worth it.

One of my mom's doctors had his identity stolen and the thieves were purchasing a home in Chicago. He lives here in Texas.  The only reason it was caught was that the underwriter called to verify he would be at the closing of the home. He did not make it to the closing but the police did!  He froze his accounts immediately.

If you do not want to freeze your accounts, put a fraud alert on your accounts. This will alert creditors to validate the identity of the one attempting to gain credit with your information. Typically, they will call the phone number to verify it is truly you. You can even get an extended fraud alert which is good for seven years.

It is less effective because there is no guarantee of follow-through with the creditor but it is still an option.

How to freeze?   Notify each of the bureaus you want to place a freeze:  Equifax, Experian and TransUnion. They will issue you a pin in the event you wish to unfreeze your account. Be sure you keep the pin secure. And, it may cost to unfreeze the account then refreeze again. Sounds like trouble but if you have ever experienced identity theft, you know this is no trouble at all.

Remember - if your information was stolen, a credit freeze only prevents new credit lines from being opened. Your existing account information may have already been stolen. You must attentively monitor these accounts for years or get new credit card numbers AND freeze your accounts.

Fourth, file next year's tax return as soon as allowed. Though this is a few months away, since they have your social security numbers, consider filing your tax return sooner than later. Start preparing now and then the end of year will not be nearly as chaotic. If you are not using accounting software, now is the time to consider it. I love the convenience and quickness of available reports. Downloading all my bank and credit card information is a breeze! 

Lastly, be aware of potential phishing emails that will arise out of this breach. They will want to you click on a link to verify a credit card or a transaction or did you ask for new credit or blah blah blah.  NEVER EVER click on a link in an email.  NEVER EVER. The link may lead you to what looks like a valid site but it is not. ALWAYS validate the source and if you do not know, do not do anything. Call the creditor's telephone number on the back of your credit card or on your statement if you are concerned. Consider all those types of emails invalid. Again, particularly vulnerable are our senior citizens. Have a conversation with yours about this breach and online security as well.

Truth be known, some of these steps we should have been doing all along.  This was a wake up call as we have become complacent in protecting our credit information. If you have any questions, please feel free to email.