You may have never used Equifax yourself — or even heard of it — but the credit reporting agency could still have a treasure trove of your personal information.
Equifax said Thursday that 143 million people could be affected by a recent data breach in which cybercriminals stole information including names, Social Security numbers, birth dates, addresses, and the numbers of some driver’s licenses.
Additionally, credit card numbers for about 209,000 people were exposed, as was “personal identifying information” on roughly 182,000 customers involved in credit report disputes.
Equifax is one of three nationwide credit-reporting companies that track and rate the financial history of U.S. consumers. It gets its data — without you even knowing — from credit card companies, banks, retailers, and lenders.
Equifax will not be contacting everyone who was affected, but will send direct mail notices to those whose credit card numbers or dispute records were accessed.
The company suggests you sign up for credit file monitoring and identity theft protection. It is providing free service for one year through TrustedID Premier — whether or not you’ve been affected by the breach.
To enroll, go to www.equifaxsecurity2017.com and click on the Check Potential Impact tab. You must submit your last name and last six digits of your Social Security number there. At that point you’ll be given a date when you can return to the site and sign up for the service.
The site says once you’ve submitted your information you will receive a message indicating whether you’ve been affected. But it’s unclear when or how you will receive that message.
Some are being told: “Based on the information provided, we believe that your personal information may have been impacted by this incident.”
But even in that case, Equifax is not offering the credit monitoring service until next week at the earliest. Monday is the first day you can sign up.
If you do choose to sign up for the credit monitoring service, you must agree to submit any complaints against Equifax to arbitration. You can’t sue on your own behalf, and you can’t join a class-action case or benefit from any class-action settlement that Equifax agrees to.
The company also recommends that you review account statements and credit reports yourself to check for incidents of fraud. You can request a copy of your credit report online at www.annualcreditreport.com. You are allowed a free copy once a year from each of the three credit reporting agencies: Equifax, Experian, and TransUnion.
If you see any unauthorized activity, immediately report it to your bank and/or credit card company. If you believe you’ve been a victim of identity theft, you should also contact law enforcement.
Another way to protect yourself is by immediately placing fraud alerts on your credit reports, according to credit expert John Ulzheimer, who previously worked at FICO and Equifax. This means that a lender must contact you to verify your identity before it issues credit in your name. You can place an alert on your report for free by contacting one of the credit agencies, which is required to notify the other two. It will last for 90 days and can be renewed.
Since cybercriminals may have accessed what Ulzheimer calls the “crown jewels of information” at Equifax, he also suggests putting a long term freeze on your credit.
A freeze takes your credit report out of circulation. If someone else goes to take out a loan in your name, the lender will not be able to pull your report and therefore cannot extend the credit. If you want to take out a loan yourself, you’ll have to contact the reporting agency to temporarily lift the freeze. Fees to freeze your account vary by state, but commonly range from $5 to $10.
“It’s a pretty extreme measure, but when 143 million people have been exposed like this, I think you have to take it,” Ulzheimer said.
The Federal Trade Commission’s website, www.ftc.gov/idtheft, also offers information about how to protect yourself against fraud.
If you have more questions for Equifax, the company has set up a designated call center at 866-447-7559.
CNN’s Chris Isidore contributed to this report.
