What You Need to Know About the Equifax Data Breach

Sage Rutty & Co., Inc.

Victoria Chase Ferren, CFP®

Director of Financial Planning

100 Corporate Woods

Suite 300

Rochester, NY 14623

585-512-2340

vferren@sagerutty.com

On September 7, 2017,

Equifax announced a

massive data breach that

exposed vital personal

identification data on as

many as 143 million

consumers, roughly 55% of

Americans age 18 and older.

On September 7, 2017, Equifax, one of the three main credit reporting agencies, announced a massive

data security breach that exposed vital personal identification data — including names, addresses, birth

dates, and Social Security numbers — on as many as 143 million consumers, roughly 55% of Americans age

18 and older.1

This data breach was especially egregious because the company reportedly first learned of the breach on

July 29 and waited roughly six weeks before making it public (hackers first gained access between

mid-May and July) and three senior Equifax executives reportedly sold shares of the company worth nearly

$2 million before the breach was announced. Moreover, consumers don't choose to do business or share

their data with Equifax; rather, Equifax — along with TransUnion and Experian, the other two major credit

reporting agencies — unilaterally monitors the financial health of consumers and supplies that data to

potential lenders without a consumer's approval or consent.2

Equifax has faced widespread criticism following its disclosure of the hack, both for the breach itself and for

its response, particularly the website it established for consumers to check if they may have been affected.

Both the FBI and Congress are investigating the breach.3 In the meantime, here are answers to questions

you might have.

1. What's the deal with the website Equifax has set up for consumers?

Equifax has set up a website, equifaxsecurity2017.com, where consumers can check if they've been

affected by the breach. Once on the site, click on the button "Potential Impact" at the bottom of the main

page. You then need to click on "Check Potential Impact," where you will be asked to provide your last

name and the last six digits of your Social Security number — a request that was widely mocked on social

media as being too intrusive when the standard request is for only the last four digits.

Equifax has stated that regardless of whether your information may have been affected, everyone has the

option to sign up on the website for one free year of credit monitoring and identity theft protection. You can

do so by clicking the "Enroll" button at the bottom of the screen. Note: Just clicking this button does not

mean you're actually enrolled, however. You must follow the instructions to go through an actual enrollment

process with TrustedID Premier to officially enroll.

More wrath was directed at Equifax when some eagle-eyed observers noted that enrolling in the free year

of credit protection with TrustedID Premier meant that consumers gave up the right to join any class-action

lawsuit against the company and agreed to be bound by arbitration. But an Equifax spokesperson has

since stated that the binding arbitration clause related only to the one year of free credit monitoring and not

the breach itself; Equifax has since removed that language from its site.4

2. What is TrustedID Premier?

Equifax's response to the data breach is to offer consumers one free year of credit file monitoring services

through TrustedID Premier. This includes monitoring reports generated by Equifax, Experian, and

TransUnion; the ability to lock and unlock Equifax credit reports with a credit freeze; identity theft insurance;

and Social Security number monitoring.

Consumers who choose to enroll in this service will need to provide a valid email address and additional

information to verify their identity. A few days after enrolling, consumers will receive an email with a link to

activate TrustedID Premier. The enrollment period ends November 21. After the one free year is up, consumers will not be automatically charged or enrolled in further monitoring; they will need to sign up

again if they so choose (some initial reports stated that consumers would be automatically re-enrolled after

the first year).5

3. What other steps can I take?

It is always a good idea to monitor your own personal information and be on the lookout for identity theft.

Here are specific additional steps you can take:

• Fraud alerts: Your first step should be to establish fraud alerts with the three major credit reporting

agencies. This will alert you if someone tries to apply for credit in your name. You can also set up fraud

alerts for your credit and debit cards.

• Credit freezes: A credit freeze will lock your credit files so that only companies you already do business

with will have access to them. This means that if a thief shows up at a faraway bank and tries to apply

for credit in your name using your address and Social Security number, the bank won't be able to access

your credit report. (However, a credit freeze won't prevent a thief from making changes to your existing

accounts.) Initially, consumers who tried to set up credit freezes with Equifax discovered they had to pay

for it, but after a public thrashing Equifax announced that it would waive all fees for the next 30 days

(starting September 12) for consumers who want to freeze their Equifax credit files.6 Before freezing

your credit reports, though, it's wise to check them first. Also keep in mind that if you want to apply for

credit with a new financial institution in the future, or you are opening a new bank account, applying for a

job, renting an apartment, or buying insurance, you will need to unlock or "thaw" the credit freeze.

• Credit reports: You can obtain a free copy of your credit report from each of the major credit agencies

once every 12 months by requesting the reports at annualcreditreport.com or by calling toll-free

877-322-8228. Because the Equifax breach could have long-term consequences, it's a good idea to start

checking your report as part of your regular financial routine for the next few years.

• Bank and credit card statements: Review your financial statements regularly and look for any transaction

that seems amiss. Take advantage of any alert features so that you are notified when suspicious activity

is detected. Your vigilance is an essential tool in fighting identity theft.

4. How can I get more information from Equifax?

Consumers with additional questions for Equifax can call the company's dedicated call center at

866-447-7559. The call center is open seven days a week from 7 a.m. to 1 a.m. Eastern time. Equifax said

it is experiencing high call volumes but is working diligently to respond to all consumers.7

1, 3-5, 7) The Wall Street Journal, September 8, 2017, September 10, 2017

2) CNNMoney, September 8, 2017

6) The New York Times, September 12, 2017

IMPORTANT DISCLOSURES

Broadridge Investor Communication Solutions, Inc. does not provide investment, tax, legal, or retirement

advice or recommendations. The information presented here is not specific to any individual's personal

circumstances.

To the extent that this material concerns tax matters, it is not intended or written to be used, and cannot be

used, by a taxpayer for the purpose of avoiding penalties that may be imposed by law. Each taxpayer

should seek independent advice from a tax professional based on his or her individual circumstances.

These materials are provided for general information and educational purposes based upon publicly

available information from sources believed to be reliable — we cannot assure the accuracy or completeness

of these materials. The information in these materials may change at any time and without notice.