Equifax data breach: what happened and what to do

The Equifax breach is the one most people mean when they say "the credit bureau got hacked." Equifax, one of the three big US credit bureaus, announced in September 2017 that attackers had taken the personal information of about 147 million people. Its notice to the California Attorney General dates the start of the intrusion to mid-May 2017.

What happened

According to the Federal Trade Commission, Equifax was warned in March 2017 about a serious flaw in the software behind one of its databases and didn't fix it. Attackers used the gap to get in and then found unprotected credentials that let them move through Equifax's network and reach consumer data. They went unnoticed for months. Equifax disclosed the breach on September 7, 2017.

The exact count shifted over time. The FTC cites 147 million people. Equifax's early filings said about 143 million, and the company later added roughly 2.4 million more US consumers to an affected group of about 145.5 million.

What was exposed

The FTC describes the stolen data as names, dates of birth, addresses and Social Security numbers, and in some cases driver's license numbers. About 209,000 payment card numbers with expiration dates were also taken. Social Security numbers were exposed for about 145.5 million people.

Why this one is different

Most breaches leak something you can change: a password, a card number. A Social Security number and a date of birth don't change. Together with a name and address, they are the standard ingredients for identity theft, such as opening credit in your name, filing a false tax return or applying for benefits. Because the data was taken in 2017 and can't be recalled, the risk doesn't expire. Even years later, those details can be used to apply for credit, so a credit freeze today is still worth doing if you haven't. Many people only freeze after a fraud attempt, which is late: a freeze works best when it's already in place.

The settlement

In July 2019 Equifax agreed to pay at least $575 million, and up to $700 million, to settle with the FTC, the Consumer Financial Protection Bureau and 50 states and territories. About $300 million went into a consumer fund for credit monitoring and related costs, with more available if needed. $175 million went to the states and $100 million to the CFPB as civil penalties. The FTC says the claim deadline was January 22, 2024, so the claims process is closed.

What to do now

If your Social Security number has never been frozen behind a credit freeze, this is the point to do it. The free freeze at each bureau is the single most effective protection against the main thing criminals do with this data.