Equifax breach: What to do if your data was hacked

If you're among the roughly 44 percent of the U.S. population who is potentially jeopardized by the Equifax breach, there's a significant chance you or someone in your family has had their personal data compromised. 

The hackers gained access to important information belonging to 143 million U.S. consumers after exploiting a vulnerability on the company's website. The cyberattack occurred between mid-May and July, but Equifax (EFX) didn't disclose the incident until Thursday. 

That's leaving millions of Americans scrambling to figure out how to respond to the security breach and the threat of having their identities stolen. Consumers can take several steps to protect themselves, although the most aggressive tactic -- placing a credit freeze at all three major credit bureaus -- includes some expense.

"If consumers have had a breach that affects their Social Security number, they should consider a credit freeze," said Liz Weston, a personal finance expert at NerdWallet. "If you want a new job, get a new cell phone, get new insurance, they all check your credit. You could be lifting and setting down that freeze, and that can get really expensive. That's really really irritating."

Consumers must create credit freezes separately at each of the three credit bureaus, which along with Equifax includes Experian and Transunion (TRU). Each charges $5 to $10 to freeze an account, and they will provide a PIN number that will allow you to lift the freeze. 

Credit freezes don't affect your credit score, but they do restrict access to your credit report, which makes it harder for hackers to use your data to open new credit card accounts or take out loans. But that also means consumers must lift the freeze each time they apply for a loan or credit card, which can be a hassle and add up over time. 

Monitoring your credit report is also important, but consumers whose info may have been stolen may want think twice about taking Equifax up on its offer of a year subscription to its monitoring product free of charge. The service's terms of use appear to require consumers to sign away their right to sue Equifax, although some reports say the company has now changed its policy to allow people to opt-out of its "mandatory arbitration" agreement. 

"The only weapon consumers have is these lawsuits to get the companies to basically treat their information with the care it deserves," Weston said. "That's the big stick consumers have, and companies have been taking it away."

Below are four steps to take following Equifax's data breach.

Check with Equifax if you were impacted by the breach. Equifax has set up a site -- equifaxsecurity2017.com -- where consumers can check if their data was exposed. However, this site has come under criticism because it asks consumers to enter the last six digits of their Social Security numbers.

Place a credit freeze at all three credit bureaus. Consumers will have to take the time to place a freeze at each bureau separately. Here is the contact information for the firms:

• Equifax: 1-800-349-9960
• Experian: 1‑888‑397‑3742
• TransUnion: 1-888-909-8872

Put a fraud alert on your file. Fraud alerts are free, but they don't lock down your credit. An alert means a business must verify that you are the person asking for a credit request by calling you, for example. A basic fraud alert expires after 90 days, which means consumers must be diligent in renewing them. Below are the numbers for requesting a freeze:

• Equifax: 1-888-766-0008
  
• Experian: 1-888-397-3742
  
• TransUnion: 1-800-680-7289
  

Enroll in a credit monitoring service. Equifax is offering a free credit-monitoring service, called TrustedID Premier, for a year, but the service's terms of use appear to require consumers to sign away their legal rights (some reports say people can opt out of that requirement). There are competing services, such as LifeLock, but they charge for monitoring, which some consumers may not feel is justified. 

Check your free credit reports. Many credit-card companies and other financial services firms now offer free monthly or quarterly credit reports. That can help you keep tabs on whether anything fishy is going on with your data. Consumers can also check their credit report for free each year at annualcreditreport.com. 

Monitor your financial accounts. Keep a close eye on your credit cards, bank accounts and other financial accounts. Watch for charges you didn't authorize, even if they are for small amounts. Hackers sometimes test whether a credit card is valid by posting a small charge of a dollar or two. 

Don't wait to file your taxes. Armed with your Social Security number and other data, swindlers can file a return in your name and claim your refund. One way around that is to file your taxes quickly, before a criminal has a chance to make a fake filing.