Consumer complaint received 2017-09-08
Company: EQUIFAX, INC.
State: CA
Product: Credit reporting, credit repair services, or other personal consumer reports
Sub-product: Credit reporting
Issue: Improper use of your report
Sub-issue: Reporting company used your report improperly

Complaint:
Summary : Equifax is deceptively phishing people into waiving the right to participate in class action lawsuits. They 're doing this by setting up sites like https : //trustedidpremier.com/, that ask for PII ( last 6 of social and last name, which can be used to derive entire SSN ) without explaining that entering the information means you agree to the Terms of Use, which includes waiving the right to class action lawsuits. And after a hack that exposed close to 50 % of the US population, it 's a bait-and-switch designed to cover their interests instead of the people who info they exposed. 


Long Form : EquiFax got hacked in XXXX, and 3 managers sold {$1.00} million USD in stock between the time of the hack and when the details were announced ( XXXX ). 

Equifax touts itself as a credit authority, forcefully storing my private data, including my full SSN, addresses, accounts open/closed/loans, full name, and other facets of my identity. Apparently they participated in painfully lackluster Operational Security between sites, leading to a breach that affected about 1 in every 2 adults in the United States.
All that aside, they 're probably going to walk with a slight fine, and they 're still going to have access to my information.
They 're pushing sites like https : //trustedidpremier.com/ to " check to see if you 're affected '', but do not tell people : ( 1 ) Checking to see if their private information was exposed when their systems got hacked means they automatically agree to their Terms of Use, containing a clause that waives your right to class action lawsuits.
2 ) They still need to wait a week and physically see if the company whose poor security threatens your credit threw you under the bus. No automated emails, I have to manually go onto their website next week. 

For something that is completely out of consumers ' control, why do people have to go out of their way to mitigate their exposure to the mistakes of a " credit authority ''? I get it, I work in XXXX, and the User Agreement/ToU helps catch bad guys and things like that, but for something that will very likely lead to a class action lawsuit, it 's a deceptive practice to create a website that claims to check whether or not their main business exposed PII to hackers, but instead allows for them to have a list of everyone who waived the right to participate in the all-but-inevitable class action lawsuit. 

Since XXXX is a " company of EquiFax '', one is led to believe : 1. The time between the hack and the announcement was filled setting up XXXX as a corporate phishing attempt to get a list of people who " volunteer '' for ID theft mitigation at the cost of participating in a class action lawsuit. Mind you, I can freeze my credit outside of Equifax, so their service is not only redundant, but anti-consumer. 

2. They still intend to passively accept and store people 's PII as though whatever attack vector has n't been exposed. 

They also lied ; they said that people 's SSNs were n't exposed, but other reports indicate that they were

Company response to consumer: Closed with explanation