ENKR

Equifax data breach

Add to my breach check

Made public · 147,000,000 people in the U.S.

What leaked12

Replaceable

  • Card number
  • Card expiry date

Hard to replace

  • ID card image
  • Driver's licence number
  • Mobile number
  • Home or delivery address
  • Email address

Permanent

  • National ID or tax number
  • Social Security number
  • Date of birth
  • Full name
  • Gender
  • Card numberabout 209,000 people
  • ID card imageimages uploaded to the dispute portal by about 182,000 people, including about 38,000 driver's licences, 12,000 Social Security or taxpayer ID cards and 3,200 passports
  • National ID or tax numbertax ID; 97,500 people
  • Driver's licence numberin some instances; 17.6 million people · Equifax, 2018
  • Card expiry dateabout 209,000 people
  • Mobile numberphone number · type not stated; 20.3 million people
  • Email addresswithout credentials; 1.8 million people
  • Gender27.3 million people

To-dos12 · about 3 h in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name · Limits harm from: applications with your ID (opens in a new tab)
  2. Have the card reissued with a new numberabout 15 minStops: card fraud online
  3. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
  4. Turn on instant transaction alertsabout 5 minHelps you notice: card fraud online, bank account fraud, scam calls
  5. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name, applications with your ID (opens in a new tab)
7 more
  1. Do nowCheck your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name, applications with your ID (opens in a new tab)
  2. This weekKnow the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. This weekTurn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  4. This weekTurn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  5. This weekFreeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  6. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  7. This weekUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: SMS code theft

What happened next23 events

  1. Undetected 2 events77 days · show events
  2. Response 9 eventsNo individual notice on record · show events
  3. Remedy 5 eventsEnded · show events
  4. Penalty 3 eventsFine $100M · Back to latest
  5. Disputes 4 eventsSettled · show events

Penalty: 3 events

Back to latest
  1. Proposed order would require an information security program, annual board certifications and third-party assessments every two years
  2. 100 million USD civil penalty to the CFPB as part of the settlement
  3. ICO fined Equifax Ltd (UK) 500,000 GBP, the maximum under the Data Protection Act 1998; up to 15 million UK records
Company
Equifax
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
147,000,000 people in the U.S. · approx.; FTC; some UK and Canadian residents too

How the facts developed

  1. Equifax statement to Congress: counts per data element, including gender, phone numbers, email addresses and images of ID documents uploaded to the dispute portal
  2. First notice September 7, 2017: about 143 million U.S. consumers; names, Social Security numbers, birth dates, addresses, some driver's licence numbers, about 209,000 card numbers

Sources