Tuesday, September 12, 2017

It's Time to Panic...Almost

If you're like most Americans, you found out you were the victim of the largest data breach (of its kind) in U.S. history.
Equifax is one of the largest credit reporting agencies in the world. It stores credit information on, essentially, everyone. Last week we were treated to the news of 143 million identities which had been compromised. Information includes, but is not limited to:
  1. Names
  2. Birth dates,
  3. Social Security numbers
  4. Drivers License numbers
  5. Home Addresses
  6. Credit Card numbers
Armed with this information, a person can steal YOU. Not in a physical kidnapping sense, but everything about you. Your good name, your house, your car, your money, your savings, your retirement, your tax refund...EVERYTHING.
This should have every American in near panic. Why? Because, the information is going for $30 a name on the dark web.
You can freeze your credit report, buy identity theft insurance, place a fraud alert, obtain your credit report, and sue Equifax into oblivion. None of that will solve the problem.
What people are just now getting is the longevity of this issue. It won't EVER go away. Unlike the Target, Adobe, Yahoo, or other hacks, this isn't about your password or credit card number. It gives the culprits everything they need.
It's literally the keys to your identity kingdom. Everything about you is out there for anyone to obtain. And, since it's on the internet, it's NEVER going to completely be safe again.
What makes matters worse is how Equifax chose to handle this problem:
  • It took them almost 2 months to know what was going on.
  • It took over a month to clue the public in.
  • The website Equifax created https://www.equifaxsecurity2017.com/ looks like a phishing scam. It's actually legitimate. 
  • Initially Equifax barred people from suing if they signed up for protection.
  • Equifax charges victims for protection (freezes and protection after 1 year).
  • Equifax never contacted victims directly, despite knowing who they are.  
  • The site for checking if you were impacted doesn't actually tell you if you are a victim.
Everything they have done SCREAMS "Sue me in a class action lawsuit".
I'm not a litigious person, but I DID contact an attorney today to see if I could sue them. Why would I do it? This is textbook negligence.
A tort (civil wrong that causes someone else to suffer loss or harm resulting in legal liability for the person who commits the tortious act.) of negligence requires 3 things:
  1. Duty to act.
  2. Failure to act.
  3. Harm caused by the failure to act.
Equifax did all three. Because the problem is a time-bomb, you probably won't know you're a victim until it's too late.
Let's face it, Equifax is in the business of handling sensitive information regarding your identity. They let lenders know what kind of a credit risk you are. In order to do that, they track every aspect of your life.
  • Do you pay your bills on time?
  • Do you have a job?
  • Do you have people suing you?
  • Do you spend more than you make?
  • How much do you owe?
  • Where do you or where have you EVER lived?
  • Have you ever declared bankruptcy?
These are all things that get tracked by the credit companies, and it's all the information you need to get a loan, job, or housing.
It's you - quantified. It has a long memory (up to 10+ years), and it reveals everything about you.
Why should you worry?
Criminals now have all the information they need to clone your ID. You could be on the hook for loans, debt, and crimes committed in your name. What is worse is that you have to PROVE that it wasn't you, and the burden is entirely on you. It also only counts once you file a complaint AFTER you're a victim. Don't count on any help clearing it up, because most law enforcement agencies don't really know how to handle these cases.
If a criminal wants your house, they can take it.
If they want you to take the rap for doing 90 in a 70, they show a driver's license with your name and their picture.
They can use your identity when committing a crime. It's up to you to prove it wasn't you.
If they want your tax refund, they can file with your name before you do.
If they take out a student loan your name, you might not know about for years. It happened to a co-worker of mine.
They can get a job in your name. Now the IRS thinks you earn more than you actually do.
If they want your Social Security, 401K, or pension, they can claim it.
If they want your life's savings, they can withdraw it.
They can cast multiple votes in an election under other people's names.
They can even get medical care and prescriptions with your information. If they shop around for opioids, you could be arrested for their drug habit. If they get a medication that interacts with your new prescription, you could be denied that therapy. They could also have expensive medical care, and you have to foot the bill.
You get the picture.
So, what do you do with this catastrophic problem? My advice is to handle this NOW and not wait until it's too late.
Pull your credit report for Free (annually) IMMEDIATELY and check for fraud.
File a complaint with the Internet Crimes Complaint Center at the FBI and a complaint with the FTC.
Go to all three credit agencies and file a freeze IMMEDIATELY! (there may be a fee)
Place a fraud alert with all three credit agencies.
Most of them have a credit monitoring service, Transunion is free (covering only the basics), but like the other agencies they have multiple plans.
Sign up for Identity theft insurance. (optional)
If you have children under 18, do the above for them as well.
Don't bother changing your passwords, they didn't take those - they took your identity.
If you're planning on suing Equifax, be advised: They are only a $15 Billion dollar company, and it's unlikely you will see enough of a payout to cover the expenses.
Some people have made a big deal about a report that managers from Equifax sold stock as soon as they found out about the breach, but I'm not worried about that. The Securities and Exchange Commission, and FBI will take care of the criminal aspect of this problem. It's outrageous, but they knew the laws regarding insider trading. Let them spend twenty years in federal prison with a $5,000,000 fine.
The most galling thing is the scope of the problem. The number of people affected, the type of data exposed, and the limited ability to cope with the problem. If you've ever had your identity stolen, it is devastating.
I can only imagine this will get much worse as time goes on. Identity thieves tend to wait until the uproar dies down before they strike. It's now up to you to monitor every account, every transaction, every inquiry, and every aspect of your life - every day for the rest of your life.