I filed a complaint about this same issue earlier this month. The company submitted a canned response to my complaint, copies of which litter the internet with all the complaints they receive around the country through the XXXX  and other regulatory agencies. 

On XX/XX/XXXX after being denied credit due to information published about me by XXXX XXXX, I faxed a request to XXXX. My requests were : 1 ) Permanently opt-out from them selling any of my data to anyone 2 ) A freeze placed on my " account ''. 
3 ) A report of the data they are storing and publishing about me. 

On or about XX/XX/15 I received in the mail a letterhead envelope from XXXX XXXX XXXX. The envelope had never been sealed. See attached photos showing the glue on the envelope has never been wet. I apologize the photos are not the greatest, but it's kind of hard to get a good picture of glue that's never been wet. The enclosed documents had been rifled through, were out of order, were upside down, and backwards inside the envelope. Unless XXXX expects us to believe that is the way they prepare their mail, it means at least one person obtained all my personal information from the unsealed envelope. The enclosed documents were the verification that my information would not be sold to third parties and the verification that a freeze had been placed on my account, and included a PIN number should I ever need to access my information. 

I promply called XXXX. You can not reach them by phone. They lied to you in their response to my first complaint. They did not call back the same day. It was 3 days later they called. I was told the PIN number they sent was useless to them, that they don't use it for anything to access my account. I was offered a string of phone numbers and cities to verify my identity. I've had the same phone number for 10 years and did not recognize any of the phone numbers they listed. I was given a list of 4 cities to identify which one I had lived in ; I've lived in the area for 61 years and have lived in all 4 of the cities they named at one time or another. Ultimately, they were not INTERESTED in verifying my identity in order to make any corrections to the security breach they have created with my information. 

I still have not received any copy of the information they are publishing about me. Obviously, at least some, if not all, of the information is incorrect since they seem to have hundreds of phone numbers under my name. By refusing to send me a copy of the information they are storing on me, they are refusing my right to correct the erroneous data they are storing and publishing about me. 

The FTC needs to shut this company DOWN. Just do a XXXX search on this company, XXXX XXXX to see the horrible nightmares they are creating for consumers. The internet is littered with hundreds and hundreds of consumer complaints about this company, all in the same vein as my own complaint. It appears they are established specifically to publish erroneous and fraudulent information about consumers, which in turn enables car dealerships and would-be lenders to use the fraudulent data to charge higher interest rates on loans. 
At best this company is extremely negligent in handling sensitive information. I wouldn't be surprised if at some point in the future we see XXXX XXXX in the national news for selling consumer information to identity thieves and XXXX groups. They definitely do not have any respect for security of sensitive information and they definitely do not have any interest in addressing their violations of federal laws.