Q: How can I find out if my personal data was stolen?
A: Equifax has set up a website where people can enter their last name and the last six digits of their Social Security number and receive an immediate reply. Replies to at-risk people read “Based on the information provided, we believe that your personal information may have been impacted by this incident.” Replies to people who are not believed to be at risk read “Based on the information provided, we believe that your personal information was not impacted by this incident.”
Q: I heard that if I check whether my information was hacked or sign up for Equifax’s credit monitoring system, I will be giving up my right to sue the company. Is that correct?
A: No. The confusion over this question stems from the fact that Equifax is offering free credit monitoring to potentially-affected consumers. The monitoring is done by a subsidiary of Equifax, not Equifax itself. The user agreement with the monitoring company initially contained a mandatory arbitration clause which, by its terms, applied only to the monitoring services going forward and not to any past misdeeds by Equifax itself in connection with the breach. Equifax has attempted to clear up this confusion by stating in multiple places on its website that “enrolling in the free credit file monitoring and identity theft protection that we are offering as part of this cybersecurity incident does not waive any rights to take legal action.” The subsidiary company has also removed the mandatory arbitration clause from its user agreement.
Q: I don’t have any credit cards, bank or consumer loans, or mortgages. Does this mean I am not affected by the data breach?
A: Unfortunately, no. Many people have had a credit check run on them through Equifax as part of an employment application, a rental or lease application, a student loan or grant application, or as part of a security check. In that case, your name and personal identifying information was sent to the company and may have been part of the data breach.
Q: Is Equifax offering to repair my credit if my personal information was compromised by the breach?
A: No. Equifax is offering only monitoring services, not repair services. Credit repair services will have to be purchased by consumers independently. There are a number of excellent companies that can assist with this.
Q: Since the data breach, I’ve seen some firms offering credit repair and other offering identity theft protection. What’s the difference?
A: Although there is some overlap between these two services, the key difference is that identity theft protection is generally forward-looking and seeks to prevent damage to your credit history. Identity theft protection services, on the other hand, monitor your credit history and alert you to any changes in it. Some offer insurance against financial losses due to identity theft. Others monitor sites on the dark web where consumer identifying information is sold (current going rate: $30 per person for name, address, Social Security number, and date of birth). Some offer fraud resolution services, which assist consumers in clearing up bills that they did not incur. Credit repair services, however, are generally retrospective. Once any harm has been done to your credit history, these firms work to scrub the damaging and false data. Credit repair services challenge incorrect entries on your credit report and work with lawyers to ensure that credit bureaus are abiding by the consumer protection laws.
Q: I am potentially affected by the Equifax data breach. How can I protect my legal rights?
A: You should not sign any documents relating to Equifax and the data breach without obtaining legal counsel. You may also wish to join one of the class action lawsuits against Equifax. As of this writing, there are 23 separate class action lawsuits have been filed in 14 states and the District of Columbia. It is likely that many of these suits will be consolidated eventually. However, by enrolling or proceeding in the class action suit, you may be forfeiting your rights to sue Equifax individually. Again, make sure to get legal counsel in order to determine how best to proceed.
Q: What are the legal claims against Equifax based on?
A: So far, lawyers representing consumers in claims against Equifax have advanced three legal theories. The first is that Equifax was negligent in its security protocols and procedures and thereby enabled the hack. Another theory claims that consumers were harmed by Equifax’s delay in alerting the public that their private information had been stolen. The company first learned of the breach in late July but did not disclose the hack to the public until early September. The third theory is that after the breach, Equifax did not properly disclose that the company performing the “free” credit monitoring after the breach was, in fact, a subsidiary of Equifax itself.