What Happened in the Equifax Data Breach
In 2017, Equifax, one of the three major credit reporting agencies in the United States, experienced a significant data breach. Hackers exploited a vulnerability in Equifax's computer systems between mid-May and July 2017, gaining unauthorized access to sensitive personal information. The company didn't publicly announce the breach until September 7, 2017—more than two months after discovering it.
Free Guide to Netflix Payment Methods and Account Management →
Equifax reported that approximately 147 million people were affected by this breach. This number represents roughly 44% of the U.S. population at that time. The scope was enormous, making it one of the largest data breaches in American history. The breach exposed information on consumers across the United States, Canada, and the United Kingdom, though the vast majority of affected individuals were U.S. residents.
The vulnerability that allowed the breach was in Apache Struts, an open-source software framework. Security researchers had identified and released a patch for this vulnerability months before Equifax was hacked, but the company failed to apply it promptly. This delayed response was a critical failure in their security practices. The breach could have been prevented if Equifax had updated their systems when the fix became available.
Once inside Equifax's systems, hackers accessed extensive personal data. This information included Social Security numbers, birth dates, addresses, driver's license numbers, and payment card information for some individuals. For many people, this represented nearly every piece of identifying information that could be used to commit identity theft or fraud.
Practical takeaway: Understanding what data was exposed helps you know what types of fraud to watch for. If your Social Security number was compromised, monitor accounts that use this number as an identifier, particularly financial accounts and tax records.
How Equifax Uses Your Personal Information
Equifax is a credit reporting agency, which means its primary business is collecting, maintaining, and selling information about consumers' credit histories. Most people have never directly interacted with Equifax, yet the company maintains detailed files on nearly every American adult. Understanding what Equifax does with your information provides context for why the breach was so serious.
Free Guide to Atlas Credit Card Online Account Access →
Credit reporting agencies like Equifax gather data from multiple sources. Banks, credit card companies, retail stores, and other lenders report payment histories to these agencies. Additionally, Equifax collects public records information such as court judgments, tax liens, and bankruptcy filings. They also obtain information from utility companies, medical providers, and debt collection agencies. This creates a comprehensive profile of each person's financial behavior and creditworthiness.
Equifax uses this data to generate credit reports and credit scores. Lenders, landlords, employers, and insurance companies purchase access to this information to make decisions about lending money, renting property, hiring workers, or pricing insurance premiums. In 2017, Equifax generated billions of dollars in annual revenue by selling these reports and scores to third parties.
Beyond traditional credit reporting, Equifax also provides services in identity verification, fraud detection, and risk assessment. The company sells data products to businesses seeking to verify customer identities or assess risk. Some of these services involve detailed personal information beyond just credit history. During the 2017 breach, all these different types of data were potentially accessible to hackers.
The company also maintains specialized databases and products targeting specific industries. For example, Equifax offers mortgage products to lenders, employment screening services to employers, and medical payment history reports to healthcare providers. Each of these products contains personal information that could be misused if accessed by unauthorized parties.
Practical takeaway: Since Equifax maintains information about you without your active participation, you have rights to view your file. You can request a free credit report from each of the three major credit agencies once per year at AnnualCreditReport.com. Checking your report helps you identify errors or signs of fraud.
What Information Was Compromised
The specific categories of personal information exposed in the Equifax breach included Social Security numbers, full names, birth dates, addresses, and driver's license numbers. For many affected individuals, the breach exposed multiple pieces of identifying information simultaneously. This combination of data points is particularly valuable to criminals seeking to commit identity theft.
Get Your Free San Angelo Unemployment Office Location Guide →
Payment card numbers were also compromised for some individuals, though Equifax stated that this affected a smaller subset of the 147 million people impacted overall. Additionally, the breach included email addresses and telephone numbers for many people. These contact details could be used for phishing attacks or fraudulent communications impersonating legitimate entities.
Some affected individuals had sensitive employment information exposed, including employment history and income information that Equifax maintained. For certain individuals with mortgage histories, the breach included mortgage account information and property details. Tax identification numbers beyond Social Security numbers may have been exposed for some business owners or self-employed individuals.
The reason this particular combination of information was so problematic relates to how identity theft and fraud work. When criminals have someone's Social Security number, name, and date of birth, they can open credit accounts in that person's name. They can apply for loans, credit cards, or lines of credit. They can also file fraudulent tax returns or apply for government benefits. The driver's license number provides another layer of identification useful for creating fraudulent documents or passing identity verification checks.
Equifax initially stated that payment card numbers and information about Social Security numbers for most affected individuals were protected using encryption. However, this raised questions about why the company would encrypt some data but not other data, and whether encryption was effective given that hackers had access to Equifax's systems where encryption keys might also be stored.
Practical takeaway: If you were born before 2000 and lived in the United States during 2017, you were likely affected by this breach. Document what information you believe was compromised, and use this knowledge when monitoring your accounts for fraudulent activity.
Steps to Monitor for Identity Theft and Fraud
After learning about a data breach like the Equifax incident, taking steps to monitor for fraud becomes essential. Identity theft can take time to become apparent. Criminals may not immediately use stolen information. They might wait months or even years before attempting to open accounts or commit fraud using your personal data. This means your vigilance needs to continue long after the initial breach announcement.
Learn How to Log In to Delta Dental Bill Pay →
Review your credit reports carefully and regularly. Federal law allows you to obtain one free credit report from each of the three major credit reporting agencies—Equifax, Experian, and TransUnion—every 12 months. You can stagger these requests throughout the year, checking one report every four months. Look for accounts you don't recognize, inquiries from lenders you didn't contact, or personal information that appears incorrect. Credit reports may not reflect the most recent activity, but they provide a detailed record of accounts opened in your name.
Monitor your financial accounts for unauthorized transactions. Review bank account statements, credit card statements, and investment account statements regularly—ideally at least monthly. Many banks and credit card companies offer online account monitoring with alerts for large or unusual transactions. Set up these notifications if your financial institution provides them. Legitimate creditors can help you identify fraudulent activity quickly if you contact them.
Consider placing a fraud alert or credit freeze on your credit file. A fraud alert notifies creditors that you may be a victim of identity theft and instructs them to take extra steps to verify your identity before opening new accounts. You can place a fraud alert for free by contacting any of the three major credit reporting agencies. A credit freeze prevents creditors from accessing your credit report without your permission, making it much harder for criminals to open accounts in your name. Freezes are also free in most states following recent federal law changes.
Pay attention to mail and communications. Watch for credit card statements, loan documents, or bills for accounts you didn't open. If you receive communications about accounts or services you didn't request, investigate immediately. Criminals may open accounts in your name and use different contact information, but some mail might reach you depending on the address they use.
Check your Social Security earnings record and tax records. Visit ssa.gov to create an account and review your Social Security statement. Your earnings record should match your actual work history. File your taxes early to prevent someone else from filing a fraudulent return in your name. Keep copies of your tax returns and supporting documentation for reference.
Practical takeaway: Create a simple tracking system noting when you've checked each credit report, reviewed each account, and verified other records. Set reminders to repeat these checks regularly. Consistency in monitoring is more effective than sporadic checking.
Remedies and Settlements for Affected Individuals
Following the
Free Guide to Understanding Disability Support in Washington State →