On Thursday, September 7, credit bureau Equifax announced that after unauthorized access to their network in July, the sensitive information of 143 million Americans was compromised. The data includes Social Security numbers (SSNs), birth dates, and addresses. A smaller percentage of cases also included credit card numbers, driver's license numbers and "certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers." Equifax has also disclosed that "limited personal information for certain UK and Canadian residents" was also part of the incident. While the initial number of 143 million would appear to affect 44 percent of the U.S. population, the affected percentage increases once children and those without credit histories are removed.

Equifax has setup a website where individuals can determine if their information was compromised in this incident. Additionally while initial reports said that by using the Equifax website individuals were entering into a forced arbitration agreement, the company has since issued a statement that clarifies that these legal rights are not being waived. As of September 12 an official cause for the breach has not been given, though there have been reports through anonymous sources that an Adobe Struts vulnerability was the cause.

This breach highlights an important issue, when personal information is compromised; there may not be much an individual can "do". Unlike credit card and bank account numbers, birthdates, SSN's and previous addresses of residence cannot be changed. (While theoretically possible to get a new SSN, the Social Security Administration only assigned 274 new numbers in 2015). Consumers can consider signing up for credit monitoring services, one of which is offered by Equifax. Affected individuals can also consider "freezing" their credit to prevent new lines from being opened in their name. More information is available on the Federal Trade Commission website.

CNA's Chief Information Security Officer Larry Lidz, said, "The real risk isn't people opening a new credit card under your name - credit companies are used to ID theft and can undo the card quickly. The much larger risk is people using the personal information to reset passwords on financial systems (banks, payroll, 401(k), etc.) and then drain the account and/or redirect your paycheck." Many institutions utilize credit bureaus for "identity verification", which requires consumers to verify information like previous residences, loans/lines of credit or vehicle make/model. Now that some of this information has been compromised, consumers may be left unprotected.

In addition to the above, consumers can place a freeze on their children's credit. Consumers can also request a copy of their credit reports. A credit freeze, however, will not prevent income tax refund fraud that may be subsequently attempted. Additionally, they consumers should consider opting out of pre-screen credit offers and request an annual explanation of benefits from their healthcare provider to ensure that no fraudulent claims have been filed under their identity. 
 
Any references to non-CNA websites are provided solely for convenience and CNA disclaims any responsibility with respect thereto.