Consumer complaint received 2025-10-14 00:00:00
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Improper use of your report — Credit inquiries on your report that you don't recognize
Company: EQUIFAX, INC.
State: VA

Complaint narrative:
I am submitting this complaint to formally notify the Consumer Financial Protection Bureau ( CFPB ) that I am a confirmed victim of a data breach, which has directly compromised my personal and financial information. As a result, I have reason to believe that one or more accounts and items currently appearing on my credit report are inaccurate, fraudulent, or unverifiable, and were not authorized or created by me. 

Under the Fair Credit Reporting Act ( FCRA ) and the Fair Debt Collection Practices Act ( FDCPA ), I am exercising my rights as a consumer to request that these disputed and potentially fraudulent items be thoroughly investigated, verified, or permanently deleted within the legally required timeframe. 

Relevant Consumer Protection Laws : FCRA 602 ( A ) ( 15 U.S.C. 1681 ) : Establishes that consumer reporting must be accurate, fair, and respectful of consumer privacy.

FCRA 611 ( 15 U.S.C. 1681i ) : Requires credit reporting agencies to reinvestigate any disputed information within 30 days ( extendable to 45 days only with additional verification ). If an item can not be verified, it must be deleted promptly.

FCRA 605B ( 15 U.S.C. 1681c-2 ) : Grants identity theft victims the right to block fraudulent information resulting from identity theft or data breaches from appearing on their reports.

FCRA 623 ( a ) ( 3 ) : Furnishers of information are required to report accurate data and must not continue to furnish disputed information without verification.

FDCPA 807 ( 15 U.S.C. 1692e ) : Prohibits any false, deceptive, or misleading representation in connection with debt collection, including attempting to collect debts that are not owed or can not be verified.

FDCPA 809 ( 15 U.S.C. 1692g ) : Requires debt collectors to provide proper validation of debts upon request and cease collection activities until validation is completed.

Because my personally identifiable information ( PII ) was exposed in a confirmed data breach, any account or tradeline that can not be independently verified through original documentation including my original signed application, date of account opening, and chain of custody of the debt should be considered unverified and deleted.

I am requesting that the CFPB ensure this matter is fully investigated and that the credit reporting agencies and furnishers of information comply with all provisions of the FCRA and FDCPA, including : Immediate reinvestigation of the disputed items ; Written documentation proving the accuracy and legitimacy of each item ; Deletion of unverifiable or fraudulent items within 90 days or less, as permitted under the FCRA ; Confirmation that all data furnishers and debt collectors cease reporting or collecting on disputed items until verified ; and Assurance that no future reporting or collection activity occurs on any item found to be related to the data breach.

Failure by any party to comply with these federal laws constitutes a violation of the FCRA and FDCPA and may subject them to civil liability, statutory damages, and CFPB enforcement action.

I respectfully request that the CFPB review this matter and take all necessary measures to ensure that my rights under federal law are upheld, that fraudulent or unverifiable accounts are deleted, and that my credit file is fully corrected to reflect accurate and legitimate information only.

Company response to consumer: Closed with non-monetary relief