ENKR

Equifax data breach

Add to my breach check

Made public · 147,000,000 people in the U.S.

What leaked12

Replaceable

  • Card number
  • Card expiry date

Hard to replace

  • ID card image
  • Driver's licence number
  • Mobile number
  • Home or delivery address
  • Email address

Permanent

  • National ID or tax number
  • Social Security number
  • Date of birth
  • Full name
  • Gender
  • Card numberabout 209,000 people
  • ID card imageimages uploaded to the dispute portal by about 182,000 people, including about 38,000 driver's licences, 12,000 Social Security or taxpayer ID cards and 3,200 passports
  • National ID or tax numbertax ID; 97,500 people
  • Driver's licence numberin some instances; 17.6 million people · Equifax, 2018
  • Card expiry dateabout 209,000 people
  • Mobile numberphone number · type not stated; 20.3 million people
  • Email addresswithout credentials; 1.8 million people
  • Gender27.3 million people

To-dos12 · about 3 h in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name · Limits harm from: applications with your ID (opens in a new tab)
  2. Have the card reissued with a new numberabout 15 minStops: card fraud online
  3. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
  4. Turn on instant transaction alertsabout 5 minHelps you notice: card fraud online, bank account fraud, scam calls
  5. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name, applications with your ID (opens in a new tab)
7 more
  1. Do nowCheck your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name, applications with your ID (opens in a new tab)
  2. This weekKnow the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. This weekTurn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  4. This weekTurn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  5. This weekFreeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  6. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  7. This weekUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next23 events

  1. Undetected 2 events77 days · show events
  2. Response 9 eventsNo individual notice on record · show events
  3. Remedy 5 eventsEnded · show events
  4. Penalty 3 eventsFine $100M · show events
  5. Disputes 4 eventsSettled · show events
  1. Extended claims periodClosed
  2. Four members of China's People's Liberation Army 54th Research Institute charged with the hack
  3. Initial claims periodClosed
  4. Settlement offered four years of three-bureau credit monitoring through Experian, then six years of one-bureau monitoring through Equifax
  5. Approved settlement: up to 20,000 USD for documented out-of-pocket losses, plus capped pay for time spent; capped alternative cash (up to 125 USD) for those who already had credit monitoring
18 more
  1. Final approval of the consumer class settlement: at least 380.5 million USD fund, plus up to 125 million USD more for out-of-pocket losses
  2. Proposed order would require an information security program, annual board certifications and third-party assessments every two years
  3. 175 million USD to 48 states, DC and Puerto Rico
  4. 100 million USD civil penalty to the CFPB as part of the settlement
  5. Global settlement: at least 575 million USD, potentially up to 700 million USD
  6. ICO fined Equifax Ltd (UK) 500,000 GBP, the maximum under the Data Protection Act 1998; up to 15 million UK records
  7. 8-K with the statement to Congress: counts per stolen data element, no additional consumers
  8. October to December 2017: letters to the about 182,000 people whose dispute-portal uploads were accessed
  9. The chairman and CEO retired; an interim CEO was appointed
  10. The Chief Information Officer and Chief Security Officer retired; interim replacements appointed
  11. Sent written notifications to all U.S. state attorneys general and began contacting state and federal regulators
  12. The chairman and CEO apologised to consumers and business customers
  13. Offered one year of free credit monitoring and identity theft protection (TrustedID Premier) to all U.S. consumers
  14. Opened equifaxsecurity2017.com and a dedicated call centre
  15. Announced the breach: about 143 million U.S. consumers potentially affected
  16. Took the affected web application offline, then patched the Apache Struts flaw
  17. Security team observed suspicious traffic on the U.S. online dispute portal and blocked it
  18. Intrusion began
Company
Equifax
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
147,000,000 people in the U.S. · approx.; FTC; some UK and Canadian residents too

How the facts developed

  1. Equifax statement to Congress: counts per data element, including gender, phone numbers, email addresses and images of ID documents uploaded to the dispute portal
  2. First notice September 7, 2017: about 143 million U.S. consumers; names, Social Security numbers, birth dates, addresses, some driver's licence numbers, about 209,000 card numbers

Sources