Update September 13: After a “conversation” with New York State Attorney General Eric T. Schneiderman, Equifax has revised its terms of service; signing up for the company’s free year of protection does not preclude you from taking any type of legal action, and credit card information will not be required as part of the sign-up  process. USA Today reports that currently, at least 23 class action suits have been filed. These and others will likely be consolidated in a single lawsuit. 

On September 7, the credit reporting company Equifax—one of three in the US—announced that the personal data of 143 million American consumers, possibly as well as some in Canada and the UK, has been compromised.

From late spring though the end of July, hackers gained access to Equifax’s data and were able to steal not just names and addresses, but also Social Security numbers, birth dates and even some driver’s license numbers. In addition, credit card numbers for more than 200,000 people were stolen. And in some cases, secret questions and answers used to verify identity were compromised, too.

It took the company six weeks to disclose the breach, during which time your data could already have been used to open credit card accounts or tap into existing ones.

This is possibly the most serious data breach in US history and could put you at risk for identity theft in the future.

How to Find out If You’re at Risk

Equifax has created a simple tool that lets you input your last name and last six digits of Social Security number, and checks those details against its records. The tool will tell you if your info has been compromised (before you use it, see “What Else You Should Know” below).

To use the tool:

• Click on this link www.equifaxsecurity2017.com
• Scroll down and click the POTENTIAL IMPACT button
• On the next page, click on the CHECK POTENTIAL IMPACT button

The site will return a message telling you if you’ve been impacted and what to do next.

Be Careful

• Don’t use this tool on a public computer or on a network that is not password protected
• We recommend that you don’t use the tool on your mobile device

What Happens Next

Equifax will provide a year of free credit monitoring and identity theft checks, regardless of whether or not your data has been compromised.

• When you use the Equifax tool to check whether you’ve been impacted, you’ll see a message telling you when you can come back and enroll—usually sometime next week. Copy the date to your address book, write it down or print the webpage.
• On that date, go to faq.trustedidpremier.com and enroll.

You’ll be enrolling in a service called Trusted ID Premier. It includes credit reports from all three agencies, identity theft insurance and internet scanning for misuse of Social Security numbers.

What Else Should You Do?

The FTC’s Identity Theft website has useful information on how you can protect yourself once your data has been stolen. Check the site here.

Among the tips:

• Strongly consider placing a credit freeze to stop someone opening a new account or applying for a loan in your name; at the least, create a fraud alert to stop anyone from using your existing accounts. The FTC’s Identity Theft site will link you to pages that tell you how. (The cost of placing a freeze at Equifax varies by state from free to $10; each credit reporting company has its own fee.)
• Review your credit card transactions now for the past month, at least, and regularly going forward
• File taxes as early as possible so a scammer doesn’t file for you and get your refund
• Don’t fall for tax scam phone calls

See all the FTC’s tips here. (Click on the + sign next to each option to open a pane of information.)

You might also consider signing up for a more robust, paid identity theft service, such as  as Lifelock. It costs $9.99 per month for the basic service, which helps guard against someone else changing the address on your account; helps you cancel or replace lost credit cards and various forms of ID; and more.

Don’t stop checking 

Don’t think you’re in the clear because your data has been available for a month or more already an nothing has happened, and don’t assume you only have to check credit reports and credit card transactions for a couple more months. Once data has been stolen, it might be sold or the hackers might sit on it for years before it’s used. Stay alert.

Of course, Equifax is only offering one year of its service for free; it’s possible they will be pressured to add additional years to that offering given the severity of that breach—and the fact that three Equifax executives sold shares in the company after the discovery of the breach and before its public disclosure six weeks later, according to Bloomberg.

What Else You Should Know

As of this time, the Equifax site states: “If you check Equifax’s site to see if your data was stolen, you *waive your rights* to sue Equifax or be part of a class action suit.” In a tweet, New York State Attorney General Eric T. Schneiderman says this language is “Unacceptable and unenforceable.” His staff has demanded that the company remove it. However, at this time you can’t be sure whether you’ll be giving up your rights by using the Equifax tool.

Illinois Attorney General Lisa Madigan is pressuring Equifax to waive its fee for putting a freeze on affected credit accounts. This fee varies by state from free to $10—so you might want to pay for it now and hope the company refunds it later.

Schneiderman’s office has opened a formal investigation into the Equifax data breach.

• Visit the FTC site for the Equifax breach
• Visit the FTC Identity Theft site
• Visit the Equifax data breach FAQ

In the comments section below, let us know if you have issues with any of the Equifax or government websites we’ve linked to—and keep us posted.