Attorney General addresses questions regarding Equifax security breach and its impact on Illinois residents

[September 13, 2017]  Chicago – Attorney General Madigan has received an outpouring of questions from concerned and confused Illinois residents about whether their sensitive personal information has been compromised by Equifax’s massive data breach. In response, Madigan is providing updated information to Illinois residents and calling on Equifax to pay credit freeze fees for people with all three major credit reporting agencies, including Experian and TransUnion.

Late last week, Equifax announced it had suffered a massive data breach of sensitive consumer information from May to July of this year, impacting as many as 143 million Americans. Yesterday, Equifax notified Madigan that in Illinois, the breach may impact more than 5.4 million residents.

“Equifax has failed to answer basic questions that millions of Americans whose personal information it likely lost have including: How did the data breach happen? What is Equifax going to do to fix it? And why did it take Equifax six weeks to notify people that their personal information had been stolen?” Madigan said. “Most importantly, it appears that Equifax currently does not have the ability to accurately determine whether your personal information has been stolen. I suggest you assume it has been and put a credit freeze on your credit report to get the best protection you can from identity theft. Equifax needs to stop wasting time and making excuses and start paying for long-term protections that its security failure has made imperative for most Americans.”

Consumers are confused as to whether they have been impacted by the breach, and what they should do if they determine their personal information has been compromised. Some Illinois residents say they received different answers from Equifax at different times, depending on the browser platform they used. Consumers also reported that the Equifax website was inaccessible at times due to high traffic volume.

The main questions Madigan is hearing from consumers include:

Q: How do I know if I’ve been impacted?

A: Equifax’s data breach impacts about half of all Americans, and at least half of all adults in Illinois. To find out if you have been impacted, check the Equifax website: www.equifaxsecurity2017.com to see whether your personal information may be affected by the breach.

Regardless of what you learn, however, the best thing to do is place a freeze on your credit and sign up for free credit reports. Madigan reminds people, “It’s not a matter of if, but when you will become a victim of identity theft.”

Q: If I have been impacted, what should I do?

A: You should put in place measures to protect and monitor your credit. To protect themselves more broadly, consumers should sign up for a credit freeze with Experian and TransUnion, in addition to Equifax.

Currently in Illinois, unless you are over 65 years of age, an identity theft victim with a police report, or an active duty service member, you will be charged $10 to place the freeze with Experian and TransUnion. See Madigan’s Identity Theft Resource Guide for specific instructions on how to place a credit freeze with Equifax, Experian, and TransUnion. Equifax recently indicated that the company will waive the $10 charges for consumers who request an Equifax credit freeze in the next 30 days.

Madigan says she is working with the Illinois legislature to change Illinois law to require free credit freezes for anyone for any reason.

Q: I don’t understand the terms and conditions of the free credit monitoring and free credit freeze that Equifax is offering?

Arbitration – Consumers are concerned that in its the terms and conditions, Equifax includes an arbitration clause that requires them to give up their right to sue Equifax over the free credit monitoring and free credit lock service.

A: Equifax recently clarified that it will not be requiring consumers to agree to such terms.

Auto-renewal of the service after the free year expires – Consumers are concerned that by supplying their credit card number when enrolling in the free service, Equifax will automatically charge them after the period of free service expires.

A: Equifax recently stated that they will no longer require credit card numbers and clarified that consumers won’t be automatically renewed and charged for service at the end of the free service.

Q: I tried to sign up for the free credit monitoring and free credit lock that Equifax is offering, but they keep asking for more information, and I am not comfortable giving it to them. What should I do?

A: Make sure you go to the following website www.equifaxsecurity2017.com  to start the process. Be aware that Equifax is asking questions in order to verify your identity before the company sends you information about your credit report.

Madigan urges Illinois residents to take the Equifax breach seriously and take steps to protect themselves from the possibility of identity theft:

Seriously consider placing a credit freeze on your credit reports with all three consumer reporting agencies: TransUnion, Experian, and Equifax. Equifax recently indicated that they will waive their Security Freeze fees for consumers who request a freeze in the next 30 days;

Regularly request your free credit reports at www.annualcreditreport.com, inspect them closely, and promptly dispute any unauthorized accounts;

Inspect all financial account statements regularly and promptly dispute any unauthorized charges;

Consider placing alerts on your financial accounts to ensure your financial institution alerts you when money above a pre-designated amount is withdrawn;

Beware of potential phishing emails; don't open any email messages or attachments from unknown senders and do not click on any unknown links. Fraudsters will frequently send coercive and misleading emails threatening account suspension or worse if sensitive information is not provided. Remember, businesses will never ask customers to verify account information via email. If in doubt, contact the business in question directly for verification and to report phishing emails; and

Be on the lookout for spoofed email addresses. Spoofed email addresses are those that make minor changes in the domain name, frequently changing the letter O to the number zero, or the lowercase letter l to the number one. Scrutinize all incoming email addresses to ensure that the sender is truly legitimate.

Madigan is nationally recognized for aggressively protecting consumers from the financial threat of identity theft amid a series of unprecedented data breaches at some of the country’s largest retailers. She has testified before Congress on the cause of data breaches, the need for higher security for consumers’ personal information and notification when breaches occur. Madigan’s Identity Theft Unit, which provides one-on-one assistance to victims of identity theft and data breaches, has helped over 43,000 people remove over $29 million worth of fraudulent charges affecting their credit reports and financial accounts.

Madigan is leading a multistate investigation to determine how the Equifax breach happened, address the consumer harm, take steps to help prevent such financial disasters in the future and hold Equifax accountable.

Madigan encourages people to contact her Identity Theft Hotline at 1 [phone] or to review the Identity Theft resources on her website. The hotline is staffed with identity theft experts who can help victims report the crime to local law enforcement and financial institutions, work to repair their credit and prevent future theft. Hotline operators can also assist callers who want to take proactive steps to prevent their personal information from being stolen.

[Office of the Attorney General Lisa Madigan]