Consumer complaint received 09-12-2017 about Credit reporting, credit repair services, or other personal consumer reports (Credit reporting) with EQUIFAX, INC. (CA).
Issue: Improper use of your report
Sub-issue: Reporting company used your report improperly

Complaint: Equifax has created a situation where any criminal can hack my personal finances and even fake my waiving my right to sue. Their gross negligence has endangered much of our nation and they absolutely should be taken apart so the funds can be used to take care of the victims. Further, please investigate insider trading as after the company knew and started an investigation but before publicly announcing the breach, multiple executives sold millions of dollars worth of stock. They claim that the executives did n't know about the breach, but as executives this is their company and to not know of the breach for a month after the company knew and began an investigation speaks even more poorly of the company 's character than having been hacked. They did not encrypt the information but left a gold mine for anyone to easily break and find. Once hacked, everything is clearly accessible. This is unacceptable and I soon present some solutions of what to do with the funds from dismantling Equifax and imprisoning the criminals who allowed it to happen while cashing in on it. 

Equifax did not properly secure my protected personal information from intrusion, such as through appropriate patching, 2-factor authentication at the point of service, segmentation of data, etc. As such, it appears my full name, Social Security numbers, birth date, addresses, and possibly driver license number is cross-matched to each other and in the hands of criminals who can use this data to breach any number of accounts in perpetuity such as my banking and financial data, medical data, legal complaints, political data, and any other number of sensitive accounts. 

Further, I am unable to secure these accounts because they ask for the very personal information that is breached in order to verify my identity and approve a change. 
Equifax is currently offering a limited credit monitoring service, which does n't even activate immediately. Even this had to be sought out by those who see the news reports, follow the news links to the Equifax page, which in turn link to a shady third-party website asking for 2/3 of one 's social security number plus last name and a waiver of all class action recourse in order to discover if one is among the breached accounts, only changed to waive class action recourse from the third party site if it too is breached with the sensitive data it is querying once the news of this spread. This is insufficient to the need created by their negligent protection of my information, which I did not give them myself, but which they curated as their business from other businesses.
In order to address this, I suggest : 1. Unlimited free credit freezes and unfreezes for life for all identified as being a victim of the breach in order to keep our credit accounts appropriately locked down, which is the time frame we are now at risk for identity fraud 2. Reimbursement for 3-bureau credit monitoring of my choosing for life up to a reasonable fee amount, including pulling my own report at any time with no charge and without any credit penalties 3. Support to proactively resolve any breaches identified on my accounts in perpetuity, which if necessary can be used by my heirs who might be dealing with a breached account following my XXXX 4. Guidance on who to proactively reach out to and what can be done to protect myself from identity fraud in the future ( for example, setting up a newly unique security question and answer at all banks, doctors, dentists, political representatives, and places I have my credit card or other personal info on file ) along with case management assistance for accomplishing this if I request it 5. Commitment for leading the industry to using 2-factor authentication at the point of service in the near future ( such as by 2020 ) 6. Reimbursement for any fees directly associated with addressing the breach and any aftermath of it, in perpetuity, which if necessary can be used by my heirs who might be dealing with a breached account following my XXXX 7. Correcting the security issue that allowed the breach 8. Due diligence to confirm that all affected are notified of the breach, it 's lifelong implications, and their options for support including through following up by letter, phone, and other resources as appropriate with any who do not opt-in or opt-out via notice through the news. Allowing easy opt-in at any time, not confined to a certain short period or burdensome process. 8. Thorough external audit for the security of all systems, databases, applications, processes, etc 9. Setting up a process by which people may opt themselves out of the company 's services and/or submit their own information directly to the company. Perhaps a separate database of people who are not placed on an external server could be kept for those who make this opt-out request.

Company response to consumer: Closed with explanation