In September 2017, Equifax, one of the three big US credit bureaus, announced a breach. The final count was 147 million people, roughly half the US population, whose names, Social Security numbers, birth dates and addresses were taken. The settlement with the FTC, the US consumer regulator, and with states and the CFPB set aside up to $425 million for the people affected.
Breaches of that size keep happening, and the data in them doesn't expire. A Social Security number stolen in 2017 is still yours, and still useful to a criminal, today. So the question isn't whether your details were exposed in one breach or another. Assume they were, and make them less useful.
What criminals do with this data
Names, birth dates, addresses and identity numbers are what lenders use to check who you are. With them, a criminal can apply for a credit card, a loan or a phone contract in your name. You find out when the bills or the debt collectors arrive.
The credit freeze
In the US, the strongest defence is a credit freeze, also called a security freeze. While it's on, the credit bureaus won't share your credit report with a new lender, and since lenders almost always check it first, new credit can't be opened in your name.
According to the FTC's guide to freezes and fraud alerts:
- A freeze is free to place and to lift.
- It doesn't affect your credit score.
- You have to place it with each of the three bureaus: Equifax, Experian and TransUnion. A freeze at one doesn't apply at the others.
- When you apply for credit yourself, you lift it temporarily at the bureau the lender uses, then it goes back on.
A freeze doesn't stop your existing cards and accounts from being misused, and it doesn't stop someone from using your details for things that don't involve a credit check. It closes the most common door, not every door.
Fraud alerts, the lighter option
A fraud alert asks lenders to take extra steps to verify it's really you before opening an account. It doesn't block access to your report. An initial alert lasts one year; an extended alert, for confirmed identity theft victims, lasts seven years. Placing one with one bureau is enough, as it tells the other two.
Outside the US
Credit freezes are a US system. Other countries handle credit checks differently, and the protections available vary. The habits below apply everywhere.
Habits that work in any country
- Check your statements and credit reports for accounts you don't recognise. In the US, the three bureaus' reports are free at AnnualCreditReport.com.
- Expect phishing that uses your real details. A message that knows your address and birthday is not proof it's genuine. Breached data makes scams more convincing.
- Change passwords that were in a breach, and use a password manager so each site has its own. Our audit of what your email address reveals shows how to find out which breaches included you.
This address used to carry a 2017 news report on the Equifax breach. This is a new article on the same subject, written in October 2026.
No comments yet