200,000 South Dakotans Compromised By Equifax Hack. Now What?

South Dakota Attorney General Marty Jackley is saying 200,000 state residents are involved in the Equifax data breech.  That means their private financial data may be available to cyber criminals.  SDPBs Andrew Bork speaks with Wallet Hub Analyst Jill Gonzalez to learn more about credit information and the best way to find out if yours is compromised.

Jill thanks for joining us today. I want to start off by having you explain what Equifax is.

Equifax is one of the main three crediting reporting agencies. When your lender, when your bank, etc., reports monthly if you paid your bill on time, how much your balance is, etc., they essentially report to one of these three lenders, sometimes all three, Equifax being one of them.

So just by using your credit card or paying your bill is how these companies acquire credit information?

Yeah, so they all get it from lenders. Banks, any type of maybe student loan company that you work with, any line of credit is essentially going to be reported to these agencies, so mortgages, auto loans, student loans, credit cards, those types of things will be reported here, as well as things like judgments, public records, bankruptcies, etc.

Is Equifax liable for damages caused if information is compromised like this?

Well, it's looking like it. Right now, Equifax has kind of set up somewhat haphazardly, a website where people can essentially see if they were affected and enroll in their free credit monitoring system, or at least it's free if you enroll through this program and if you were affected. But when you click enroll, you're essentially signing an arbitration clause that says you will not obviously sue Equifax for damages, etc. Users do have 30 days to kind of deflect that in writing to Equifax, but many consumers don't know that that's the case.

What do we know about the hack?

We know that roughly 143 million consumer records were stolen from Equifax. That obviously has big implications for people's wallets. What's a little bit murky right now is how long Equifax knew about this breach, it's looking like people within the organization knew about this for at least a month, moved around stocks accordingly before this was made public. So it's interesting and still definitely being investigated, what exactly happened, why and how we can make sure that this doesn't happen again.

Credit NPR

How do people know if their information was being held by Equifax?

Well, it's safe to bet that your information, if you have any type of credit line, was being held by Equifax. I mean obviously, everyone that has banked at all has a credit file. If you have student loans, an auto loan, a mortgage, etc., which is a lot of people, then you essentially have this information out there and it's a good chance that Equifax or one of the other credit bureaus had your information.

What type of control do people have of their credit information once these companies have it?

I mean unfortunately, this information is now held by Equifax, TransUnion, also Experian, and as far as control here, you can do things like put a credit freeze on your reports, you would have to do that separately for each one of those agencies. You can also put a fraud alert on one of these reports too. So you do have some type of control in terms of essentially who can take out a loan or line of credit in your name, but as far as giving that information to one of these three bureaus, that's where you really don't have control.

How do people know their information was compromised?

Really, the only way to know is by looking at that Equifax site, and putting in the last six of your social security number as well as your last name. I do not advise this, the DNS codes for that website that Equifax has put up are not really the most secure, which I think is pretty ironic. Again, you're not exactly sure what you're clicking, when you're signing an arbitration clause essentially and when you're not, I mean there were 143 million consumers records. There's about double that, so there's a one in two chance that you were affected here. I would say err toward the side of caution and assume that your records might have been stolen.

If I'm assuming my information's been stolen, where do I go from there?

I think one important step is to sign up for credit monitoring, 24/7 monitoring. That should be free. There's some companies that might charge you for this especially now, with this scare, kind of saying, hey you need to pay to know that your records are safe from now on, etc. That's not the case. There are lots of free sites, Wallethub is one of them, that allows you to monitor your credit report 24/7. So that if someone has recently tried or is trying to open an account in your name, you know about it right away, you can obviously stop that while it's happening.

Second would be to enable two-factor authentication. Equifax was hacked, but your personal cell phone, your personal devices were not. So that's something you can use to your advantage. You can use that as another layer of protection when logging in to your email, or financial websites, use that two-factor authentication that essentially sends a text message with a code to your phone that you then plug into whatever website you're trying to access.

And then finally, it's not necessary in this case, but if you really do want to protect yourself from fraudulent borrowing, then putting a freeze on all three major credit reports is going to prevent anyone but you from accessing them, so that makes taking out a loan, a line of credit impossible to do unless you yourself are doing it.

How do people move forward knowing somebody has stolen their information?

I think taking these steps. Unfortunately, this is the new normal that we live in. For all we know, your records could have been stolen before in any one of the big retail breaches. So this unfortunately is something that we all should be living with and making sure that we add extra security, really throughout our daily lives when logging in to certain things, when on open networks, etc., when creating new passwords, we really have to be thinking about this smartly moving forward.

What do you see happening in the near future as this moves forward and more information comes out about the breach?

I definitely see a class action lawsuit in Equifax's future. I think it's going to be interesting how their management is dealt with, how their executive levels are dealt with and hopefully, the other two bureaus, TransUnion and Experian, can really learn from this to make sure that these types of things don't affect even more consumers in the future.

Federal law says people can get a free credit report every 12 months from each credit reporting company.  You can do that at www.annualcreditreport.com.  For additional information, South Dakotans can contact the Attorney General’s Consumer Protection Division by phone at 1-800-300-1986 or by email at [email protected].