Data Breaches

Equifax Data Breach Affects Millions of Consumers. Here’s What to Do.

By Steve Symanovich, a Symantec employee


A massive data breach at Equifax, one of the nation’s largest credit reporting companies, could raise the risk of identity theft for 145.5 million U.S. consumers.

Editor’s note: Equifax recently extended its offer for freezing your credit report for free to June 30, 2018. The previous deadline was Jan. 31, 2018.

In this article, you’ll learn details of the security incident and what you can do to help protect yourself if your personal data was compromised in the breach.

You’ll also find out about new developments related to the data breach and how to help protect yourself from identity theft. Here’s a list of topics.

  • Equifax data breach: What happened
  • Immediate steps to take
  • Can credit freezes, fraud alerts, credit monitoring, and identity theft protection help?
  • Tax-related identity theft: Are you at risk and what can you do?
  • Free credit freeze from Equifax: Answers to your questions
  • Equifax's latest move: Free credit lock and unlock for life
  • Poll: Americans slow to check credit after Equifax data breach

What happened

Equifax on Sept. 7 announced the cybersecurity incident, one of the largest in history. Unauthorized data access occurred from mid-May through July 2017. The breach was discovered on July 29.

The personally identifiable information (PII) that was accessed includes these details:

  • Names
  • Social Security numbers
  • Birth dates
  • Addresses
  • Driver’s license numbers (in some cases)

The company detailed the data breach in its press release. Among the key facts:

  • A U.S. website application vulnerability was exploited by criminals to gain access to some files.
  • There is currently no evidence of unauthorized activity on core consumer or commercial credit reporting databases.
  • The company is conducting an assessment and providing recommendations on next steps.

"This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do,” Equifax’s chairman and CEO said in the press release. “I apologize to consumers and our business customers for the concern and frustration this causes."

Immediate steps to take

What can you do if you’re a consumer affected by the breach?

  • Watch your mail. The company plans to send direct mail to consumers whose credit card numbers or dispute documents with PII were impacted.
  • Stay updated. The company has created resources to assist consumers. These include online information at and a call center at 866-447-7559.
  • Check out these tips on how to deal with data breaches.

Can credit freezes, fraud alerts, credit monitoring, and identity theft protection help?

The Equifax data breach has increased the risk of identity theft for millions of Americans. Consumers have concerns, including protecting their credit lines.

What can you do to help protect yourself from identity theft?

Here are four options: credit freezes, fraud alerts, credit monitoring, and identity theft protection.

1. Credit freezes

What it does: A credit freeze “freezes” your credit report. A credit freeze means potential creditors cannot access your credit report, making it less likely an identity thief can open new accounts in your name. For more detail, read about credit freezes, credit monitoring and identity theft protection services.

How to get one: Contact each of the three major credit reporting companies.

Cost: Varies from free to around $10.

2. Fraud alerts

What it does: When anyone applies for credit in your name, a credit alert requires creditors to take reasonable steps to verify that it’s you and not a criminal seeking a new credit card or loan, for instance. Initial fraud alerts have to be renewed after 90 days.

How to get one: Contact one of the three major credit reporting companies. That bureau is required to send your request to the other two bureaus.

What it costs: Free.

3. Credit monitoring

What it does: Credit monitoring services track changes to one or more your credit reports, including applications for a new credit card or a loan. It can detect suspicious activity. For more detail, read about how identity theft protection differs from credit monitoring.

How to get it: Some credit card companies and banks offer basic credit monitoring by providing cardholders a credit score. Other companies provide more extensive credit monitoring for a fee.

What it costs: Free or paid, usually between $10 and $30, depending on the services offered.

4. Identity theft protection

What it does: It typically provides credit file monitoring at one or more of the three credit reporting agencies and sometimes a credit score from one agency or more. Services may include alerts you’re your personally identifiable information is used in ways that may not show up on your credit report. Identity theft protection may also provide restoration services that help victims resolve various identity theft issues.

How to get it: It’s available through a variety of service providers.

What it costs: Varies, usually between $10 and $30, on a monthly or annual subscription.

Tax related identity theft: Are you at risk and what can you do?

The Equifax data breach could spell trouble when it’s time to file your tax return, according to the U.S. Internal Revenue Service, and any hack involving millions of Social Security numbers could fuel that trend.

Tax-related identity theft occurs whenever someone uses your Social Security number to file a tax return in your name. One of the goals? To receive a fraudulent tax refund. Someone could also use your Social Security number to get a job.

You can take steps to help protect yourself from tax-related identity theft. The U.S. Federal Trade Commission encourages you to file your taxes early in the tax season, for instance. If you file your tax return first, the Internal Revenue Service will know any subsequent attempt to grab a refund in your name is likely fraudulent.

The FTC also recommends taking these steps.

  • Check your credit reports from Equifax, Experian, and TransUnion, the FTC advises on its website. You can do this for free by visiting Look for accounts or activity that you don’t recognize. It could indicate identity theft.
  • Consider placing a fraud alert on your files (see section above)A fraud alert warns creditors that you may be a victim of identity theft. Creditors are required to make a reasonable effort to verify that anyone seeking credit in your name is, in fact, you.
  • Consider placing a credit freeze on your credit files. A credit freeze means potential creditors cannot access your credit report. This makes it less likely an identity thief can open new accounts in your name.
  • Monitor your existing credit card and bank accounts. Watch for charges you don’t recognize.

The FTC offers other tips for protecting yourself after a data breach on its website.

For more detail, read about tax-related identity theft in depth.

Free credit freeze from Equifax: Answers to your questions

Equifax is offering consumers a free credit freeze until June 30, 2018.

In the minds of most consumers, “free” is usually good. Often, you have to pay a fee to freeze your credit report, then pay another fee to lift the freeze. If you decide to freeze your credit file at Equifax, it won’t cost you any money to place or remove a credit freeze for a limited time.

Let’s take a closer look at the Equifax offer and answer some common questions about its benefits and limits. For more detail about whether you should get a credit freeze, you can read about the pros and cons of credit freezes.

Q. How does the free credit freeze help protect me against identity theft?

A credit freeze helps block new lines of credit by restricting who can see your credit report. Potential creditors—such as a credit card company or mortgage lender—cannot access your credit report while the freeze is active. That makes it less likely an identity thief can open new accounts in your name.

Keep in mind that Equifax is just one of three major credit reporting companies. To help protect against identity thieves opening new accounts in your name, you would also need to freeze your credit reports at Experian and TransUnion. Those two credit bureaus will likely charge you a fee to freeze you credit file.

Q. Aren’t all credit freezes free when personal information is accessed in a breach?

No. Usually, you can only freeze your credit for free if you are a victim of identity theft. In the case of the Equifax breach, you may be a breach victim. You become an identity theft victim when your personal information has been misused. Until then, you will likely pay money to place or lift a credit freeze.

Q. Can I get a free credit freeze if my information wasn’t accessed in the Equifax data breach?

Yes. Equifax’s offer is open to all consumers. After June 30, 2018, you will likely have to pay a fee to place a credit freeze or remove one that was placed during the free period.

Q. What if I already paid Equifax for a credit freeze after learning about the data breach?

The credit bureau plans to refund consumers who paid for a security freeze starting at 5 p.m. on Sept. 7, 2017. Credit card payments will be refunded automatically. The company also plans to refund consumers who paid by check or money order, with details to come.

Q. If I decide to get a free credit freeze from Equifax, where do I go?

Here are two ways to place a freeze on your credit:

Equifax’s latest move: Free credit lock and unlock for life

Equifax is sweetening its offer. The company will give consumers the option to lock and unlock their Equifax credit files for free for life. The service will debut by Jan. 31, 2018.

Following one of the largest data breaches in history, Equifax said consumers could freeze their credit files for free until Nov. 21. That deadline has been extended to the end of June 2018.

The company’s interim CEO wrote about the new service in a Wall Street Journal opinion piece titled “On Behalf of Equifax, I’m Sorry.” The Sept. 27 opinion appeared one day after the company’s previous CEO retired.

What does the new service mean for consumers? Here are some of the key details you should know:

  • The ability to instantly lock and unlock credit reports provides some security. A locked report helps prevent identity thieves from opening new accounts in your name.
  • You will be able to easily lock and unlock access to your Equifax credit file. “You will be able to do this at will,” the interim CEO wrote. “It will be reliable, safe and simple.”
  • All three major credit bureaus have offered “manual” lock capability. The manual-lock process is more complicated, in part, because a personal identification number (PIN) is required to unlock a file. Usually, there’s a cost to place or lift a freeze that varies by state.
  • To date, TransUnion is the only credit bureau that offers a free credit lock.

Equifax also extended the deadline for consumers to sign up for a year of free credit monitoring services to Jan. 31, 2018 from November 21, 2017.

Poll: Americans slow to check credit after Equifax data breach

According to a new poll released Oct. 10 by,  Americans have been slow to react to the massive Equifax data breach and the heightened risk of identity theft.

Here’s what the poll found:

  • Only about 1-in-4 Americans (26 percent) checked their credit reports or credit scores within two weeks of the breach announcement on Sept. 7, 2017.
  • 53 percent of those polled had heard a lot about the breach but didn’t check their credit reports or scores.
  • Roughly half of millennials between 18 and 26 years old were unaware the breach had happened.

The survey results raise a question of whether people are making the right moves to help protect themselves against identity theft.

The Equifax data breach potentially exposed the personal information of 145.5 million Americans, including their Social Security numbers.

In contrast, the survey estimated 61 million people had checked their credit.

Princeton Survey Research Associates International conducted the survey of 1,001 adults living in the continental U.S. between Sept. 21-24 via landline and cellphone.


Editor's note: This article was originally published September 8, 2017, and has been regularly updated with new information to assist our readers, most recently on Feb. 6, 2018.

Editorial Disclosure: LifeLock provides consumers with identity theft protection services for a fee, but this article is editorial in nature and designed to educate consumers about identity theft, regardless of whether they choose to utilize LifeLock, another service, or take a do-it-yourself approach.

Symantec Corporation, the world’s leading cyber security company, allows organizations, governments, and people to secure their most important data wherever it lives. More than 50 million people and families rely on Symantec’s Norton and LifeLock comprehensive digital safety platform to help protect their personal information, devices, home networks, and identities.

Start your protection,
enroll in minutes.