Consumer complaint received 2017-09-09
Company: EQUIFAX, INC.
State: NY
Product: Credit reporting, credit repair services, or other personal consumer reports
Sub-product: Credit reporting
Issue: Improper use of your report
Sub-issue: Reporting company used your report improperly

Complaint:
As announced on XXXX XXXX publicly, Equifax gave up approximately 143 million consumers ' social security numbers, birth dates, license numbers, full names, addresses, and potentially more information due to negligent computer security practices. Rather than receive notification of this breach shortly after it occurred by personal mail, I only found out via a press release to popular news and social media several months after the release occurred.
I can not confirm my information has been compromised using Equifax 's web site, www.equifaxsecurity2017.com, for several reasons as of XXXX/XXXX/XXXX : 1 ) The cybersecurity of www.equifaxsecurity2017.com is suspect ( even ignoring Equifax 's current reputation for cybersecurity ). It uses an SSL certificate granted by an authority different from Equifax 's other domains, and many organizational fields are left blank so that the authenticity of the site can not be authoritatively confirmed. These are traditionally viewed as security warning signs by cybersecurity researchers. It requests serious personal information ( 6 digits of SSN ) in order to check the database, so any potential leak of this data only exacerbates the problem.
2 ) www.equifaxsecurity2017.com has a broad terms of service document with an ambiguous mandatory arbitration clause. While Equifax 's marketing department has stated that it does not apply to verification on the site, multiple legal experts have weighed in ( via new media such as the XXXX XXXX XXXX explaining that the language is ambiguous enough that arbitration may apply once any information as sent using the site. Given the potential damages I face from identity theft, mandatory arbitration is unacceptable. The site should not have such unclear terms of use when dealing with this serious issue. 
3 ) The site gives unclear answers about whether a consumer 's information was in fact released. It proffers an Equifax product ( with mandatory arbitration ) that will identify fraud for 90 days, but does not give a clear, obvious signal as to whether one is  affected. Marketing speech should not obscure such a serious issue. The site could easily provide a list of the particular personal details that have been leaked ( given Equifax has spent months working on this leak before public disclosure ). 

Obviously I can not change my birth date, and changing my full name is professionally and personally onerous. While SSN may be potentially re-issuable, that also poses a significant burden. These details are used by many if not all of the financial institutions, utilities, businesses, and other entities that I deal with my in daily life to verify personal identity. Now that they have been compromised, I am at risk of identity theft by someone who is nearly indistinguishable from me. With those details, a vast majority of the telephone systems I use to confirm my identity would be subject to fraud by someone with my Equifax records. 

The sensible first course of action is to initiate a credit freeze with each credit reporting agency so that there is less risk of fraud. However, the data breach exposes one critical vulnerability : *** Each of the 3 credit agencies allows freezes to be removed even if the user is missing the secure PIN that the company provides when the freeze is initiated. To remove the freeze without a PIN, the agency requires proof of identity in the form of personal details such as birth date, SSN, and address. These are the details that have been released by Equifax. Even a freeze may not offer sufficient protection from a dedicated criminal because they possess the necessary information to remove the freeze. *** Thus far I have not yet confirmed the presence any new fraudulent accounts. But given the permanence of the leaked information, I will have to be vigilant long into the future. I do not have a commercial relationship with Equifax. They are not a creditor, bank, financial advisor,  insurer, or other institution with which I choose to do business. They gathered my personal information without my express consent and then stored that information on insecure computer systems. That information may now be effectively public, and if it is not already searchable and open on the darker sides of the Internet, it soon will be ( if past leaks are any indication ). This is unacceptable.

Company response to consumer: Closed with explanation