Advertiser Disclosure

Equifax Data Breach: How to Protect Your Personal Data

Credit Score, Personal Finance
With so many websites offering free financial tools, it can be hard to know whom to trust. At NerdWallet, we thoroughly research financial products and companies, and adhere to strict standards of editorial integrity to find you the best choices. We even share how we make money so you can rely on our expert advice and recommendations with clarity and confidence.

Chances are good that the Equifax data breach affects you. What do you do next? The short answers: Consider a credit freeze. Scrutinize your credit statements. And check your credit reports from all three credit bureaus.

Equifax says hackers used a website application vulnerability to access the personal information of nearly 148 million U.S. consumers, or more than half of the country’s adult population, in 2017. Credit bureaus such as Equifax are an especially sensitive target because they handle detailed financial records, and it’s nearly impossible for consumers to avoid credit reporting. Every time you apply for credit, the personal data — including your name, birthdate and Social Security number — you share can be stored by a reporting bureau.

Most credit card issuers and lenders report consumer activity to all three major U.S. credit bureaus, and your data is likely duplicated at Experian and TransUnion. There’s no reassurance in the fact that only one bureau was hacked.

“On a scale of 1 to 10, this is a 10, and that’s because of the quality of the data … your Social Security number is the skeleton key for your identity,” said Adam Levin, founder of CyberScout, a company offering identity theft and data breach defense services.

Freeze your credit for the best protection

Credit freezes prevent stolen information from being used to open new accounts in your name by restricting access to your records. Without access to your credit history, most creditors won’t open a new account.

“We have to assume that our personal information is exposed and act accordingly,” Levin said. He said a credit freeze has become “a critical thing to do.”

Credit expert Barry Paperno, who blogs at Speaking of Credit, agreed: “That’s the most extreme method, but it’s also the most effective.”

A freeze usually costs you a small fee, which varies from state to state. (Equifax now says it will offer free freezes until June 30, 2018, and it launched a free credit lock app.) Because a freeze can prevent fraud, it’s better than a credit monitoring service, which only alerts you that fraud might have happened. It’s the difference between using a deadbolt to keep thieves out rather than a security camera to catch them after the fact.

» MORE: Credit freeze vs. credit lock

You might also have to pay to lift the freeze each time you apply for credit or need to allow a potential landlord or employer to check your credit. You’ll receive a PIN to unfreeze your credit. Keep it in a safe place.

Here’s how to request a freeze (note that all three bureaus are facing heavy volume, so you may have long hold times or difficulty loading a website):

Even with your credit frozen, you’ll still have access to your credit records and scores. If you don’t already have a way to regularly monitor your score and report information, consider signing up before you place a freeze. Some credit card issuers and many personal finance websites, such as NerdWallet, offer free credit scores and reports. Watching for a big, unexplained change can alert you to potential fraud.

Place fraud alerts if a freeze is too much

If you don’t want to lock out all creditors — perhaps you’re in the middle of mortgage shopping or refinancing — you can place a 90-day fraud alert on your credit. This tells potential creditors to verify your identity before issuing credit in your name.

Contact one of the three bureaus, and it will notify the others.

» MORE: How to place a fraud alert, and why

Monitor your own credit

You’re entitled to at least one free credit report from each credit bureau every 12 months via If you haven’t accessed your credit reports within the past 12 months, do it now. If you’ve reviewed them recently, placing a fraud alert on your credit files allows renewed access.

Use your reports from the bureaus, and any free score and report services you have, to watch for:

  • New accounts that you didn’t open
  • Credit inquiries that don’t match when you applied for credit
  • Balances that don’t match your statements

» SIGN UP: Get your free credit score and monitor changes

Deal with your credit cards

Freezing keeps new accounts from being opened, but doesn’t stop fraudulent charges on an existing account. Take these steps to protect yourself:

  • Check your email and regular mail. Some consumers whose account numbers were compromised are being notified by credit card issuers that they’ll be sent a new card and the old one will be deactivated.
  • Even if you’re not notified by your issuer and you think your data wasn’t in this breach, don’t relax. Stay vigilant by checking your credit card statements for charges you don’t recognize. If something looks fishy, dig further. Often there’s a phone number listed with the merchant name for the transaction.
  • Consider signing up for text or email alerts about credit transactions. Many issuers let you set them for charges above a certain amount.

If you see a charge you think isn’t yours, call your issuer right away to dispute it. Your card issuer can’t charge interest or fees on the transaction while it’s being investigated.

What was exposed? Is my data out there?

The data accessed includes:

  • Information such as names and addresses, birthdates, Social Security numbers and some driver’s license numbers
  • Credit card numbers for approximately 209,000 consumers
  • Partial driver’s license numbers of 2.4 million consumers
  • Some documents from about 182,000 consumers’ credit report disputes, including personal identifying information

In March, Equifax said partial driver’s license numbers of 2.4 million customers were also impacted by the breach. Equifax said it will inform the consumers whose partial driver’s license information was hacked and offer a year of free credit monitoring. The company has more information at

» MORE: Your guide to cybersecurity and identity theft

Should I sign up for the free Equifax monitoring?

Equifax originally offered all U.S. consumers free credit and identity theft monitoring for one year, and it is being extended to the consumers whose driver’s license information was compromised. But the risk doesn’t disappear after a year. Someone who has your Social Security number has it — and might try to use it — forever.

The service is through TrustedID, an Equifax company. Equifax has clarified that people affected by the data breach will not be required to waive their rights to participate in a class-action lawsuit or class arbitration. The company had faced consumer backlash over that clause in the TrustedID terms of service.

Learn more:

Updated March 1, 2018.

About the author