How the Equifax Hack Lets Crooks Peer Into Your Work and Salary History

It’s been about a month since credit-reporting agency Equifax publicly announced it had been hacked. But there’s more bad news for the up to 145.5 million consumers whose data was stolen in the breach.

Brian Krebs, the journalist behind the blog KrebsOnSecurity, reported Sunday that lax security at Equifax’s payroll division made it easy for crooks to access “detailed salary and employment history on a large portion of Americans using little more than someone’s Social Security number and date of birth — both data elements that were stolen in the recent breach at Equifax.”

Even worse, you might be at risk even if you weren’t affected by the Equifax hack. According to Krebs, Social Security numbers and dates of birth have been stolen in thousands of other security breaches in recent years, and these sensitive numbers are already for sale online.

Krebs detailed exactly how someone might access salary and employment history through an Equifax service called The Work Number. He also explained how you can make your own data in The Work Number database less vulnerable.

As of Monday morning, The Work Number system was down for “maintenance,” however. I was unable to attempt to access my own information for that reason. Perhaps Equifax is addressing the lax security issue.

This news serves as a scary reminder that it’s critical for consumers — particularly those affected by the Equifax hack — to keep up their guard after such an attack. Your stolen personal information — particularly data that doesn’t change, like your Social Security number and date of birth — can be used by identity thieves at any time, not just in the first few weeks after a breach.

A credit freeze is generally considered the best way for Equifax hack victims to protect themselves. For more on credit freezes, check out:

• “After Equifax Data Hack, Should I Freeze My Account?“
• “Why a Credit Freeze Beats Equifax’s Free ‘Credit Lock’“

A credit freeze won’t fully protect you in the wake of the Equifax breach, however. And a freeze might not be an option for folks whose credit files must be accessible to people like creditors. For example, if you’re preparing to apply for a mortgage or other loan, a credit freeze might be impractical.

Everyone should pull their credit reports, though, to make sure nothing is amiss. We break down this process in “How to Get Your Free Credit Report in 6 Easy Steps.”

Everyone should also review their bank, credit card and investment statements regularly. This is perhaps the best way to catch fraud early on, when it’s easier to address.

I don’t even wait until my household’s monthly bank and credit card statements arrive. I go online to check on accounts at least once a week, although that’s something I was already doing because my household tracks expenses.

A fraud alert also might be an option for folks who don’t want to freeze their credit. We explain the difference between these measures in “Should You Use a Credit Freeze to Protect Yourself?”

What’s your take on this news? Sound off below or on our Facebook page.