The security breach at the US credit bureau Equifax is bad news for everybody. But one of the most galling things about the hack is how Equifax has made victims responsible for limiting the damage. And since Equifax still hasn’t given reliable information on who exactly was affected, that means everyone in the United States is on the hook.
Equifax is waiving the fee to freeze credit at the bureau and offering free credit monitoring for one year. That just delays by 365 days the date that a nefarious party can abuse the stolen information. It’s up to consumers to seek out additional measures, like setting fraud alerts and freezing credit at Experian and TransUnion (the other two major US credit bureaus), requesting and reviewing credit reports from the three bureaus, and monitoring their accounts indefinitely.
The number of people actively pursuing those measures at this point seems small. As many as 143 million people may have been affected by the breach, but as of Sept. 12, as Quartz’s Karen Hao reported, only 15 million people—a mere 10% of potential victims—had visited the Equifax website to see if they were affected. Everyone is at risk, but consumers with less financial literacy—and fewer financial resources to absorb any resulting losses—are even more so.
“The Equifax data breach poses serious problems for consumers of all socio-economic levels, but in particular, those consumers who are less educated on the repercussions associated with data theft and identity theft,” said Thomas Hinton, CEO of the American Consumer Council.
He said that the consumer advocacy non-profit “is deeply concerned that Equifax—and all credit reporting companies—are not doing enough in a timely manner to protect under-served consumers who have been victimized by this data breach and stand to suffer the most.”
Identity theft is an upsetting, time-consuming, and financially burdensome crime for any victim. For those already financially strapped, the fallout is particularly devastating.
The Identity Theft Resource Center (ITRC) conducts an annual survey of people who contacted the center after their identities were stolen. The impacts reported by fraud victims show the disturbing risks of a breach like the one at Equifax, with thieves using stolen identities to file taxes, obtain drivers’ licenses, run up medical bills, or commit crimes. Of the 300 respondents in the 2016 survey, 52% earned household incomes below $50,000 per year, and 33% earned less than $25,000.
Identity theft costs the average victim $1,343 in stolen assets and expenses like legal fees, according to a US Department of Justice survey. In a country where more than half of people say they’d have a hard time coming up with $500 in an emergency, that’s a lot of money. Sixty percent of respondents to the ITRC survey said they had to borrow money to make ends meet after the crime. Thirty percent had to apply for government assistance, and 31% lost their home.
Furthermore, the federal government can discontinue benefit payments like Social Security or welfare assistance if fraudulent activity is detected with the recipient’s Social Security number, placing low-income and elderly people at greater risk.
Equifax will soon be sending letters to potential victims, so even those without internet access will be aware of the breach, ITRC president and CEO Eva Velasquez said. The US Consumer Financial Protection Bureau and the ITRC offer free resources to potential identity theft victims. But it doesn’t change the fact that the people with the most to lose from Equifax’s mistake are those who had less to start with.