There are three big credit bureaus in the United States, and they produce the reports and scores that determine whether you can get a loan, a mortgage, an apartment or even certain jobs. Their strength is their depth: they hold detailed files on most adults. Their weakness is the same thing. When one of them was breached in 2017, the damage reached roughly 147 million people. Years later, millions are still at risk, because the most valuable data stolen is permanent. This updated guide explains what happened and what you should do in 2026.
1. What happened at Equifax
In 2017, attackers exploited a known vulnerability in web application software that Equifax had not patched. They accessed systems that held consumer data and extracted information over a period of weeks before the intrusion was discovered. The company announced the breach publicly in September 2017.
The data exposed for most affected people included:
- Full names
- Social Security numbers
- Dates of birth
- Addresses
For smaller groups, the exposed data included driver’s license numbers, credit card numbers and documents used in disputes. The scale was exceptional because bureaus hold information on people who never chose to do business with them. You were in their database whether or not you wanted to be.
The breach became a case study in how failing to apply a security update can cascade into one of the largest identity exposures in history. See also the three biggest data breaches for context.
2. The settlement and what it delivered
In July 2019, Equifax reached a settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau and attorneys general of states and territories. The settlement was announced as up to $700 million, consisting of a fund for consumer compensation, civil penalties and requirements to strengthen the company’s security program.
Consumers could claim free credit monitoring or cash payments for out-of-pocket costs and time. Claims windows closed some time ago. Many people felt the compensation was inadequate relative to the lifelong risk of exposed Social Security numbers, a view we discussed in Equifax should pay more. Official information about the settlement is posted by the Federal Trade Commission at ftc.gov.
The lesson is that settlements compensate for past costs, but they do not return the data. If your Social Security number was exposed, the protections you put in place yourself matter more than any payout.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
3. Why the risk persists in 2026
There are three reasons Equifax-era data remains dangerous.
Social Security numbers are permanent identifiers. Unlike a password, you cannot change it at will. A thief with your name, number and birth date can attempt to open credit, file taxes or claim benefits for many years.
Stolen data is traded and recombined. Once in criminal markets, records are merged with data from other breaches and with public listings, creating richer profiles.
New victims age into the risk. Children whose numbers were exposed are now adults, and new credit files may be created for them without their knowledge.
In 2025, the FBI’s Internet Crime Complaint Center recorded 31,675 identity theft complaints and 67,456 personal data breach complaints. Those are only reported cases, but they illustrate that exposed identity data keeps feeding fraud. See how long data leaks can affect you.
4. What to do now
- Freeze your credit at all three bureaus. Federal law makes freezes free, and they block most new-account fraud. Step-by-step instructions are in what is a credit freeze.
- Freeze family members’ credit, including children and dependents. See how to freeze your child’s credit.
- Get an IRS Identity Protection PIN. It prevents someone from filing a federal return with your Social Security number. Learn more at irs.gov.
- Check your credit reports. Free weekly reports are available through AnnualCreditReport.com. Look for accounts, addresses and inquiries you do not recognize.
- Use unique passwords and multi-factor authentication on email and financial accounts.
- Set transaction alerts on all cards and bank accounts.
- Opt out of prescreened offers at OptOutPrescreen.com to reduce mail that thieves can steal.
- Know the recovery steps. If fraud occurs, use IdentityTheft.gov and read how to report identity theft.
5. Freeze, fraud alert, credit lock and monitoring
These terms are often confused.
| Tool | What it does | Cost | Best for |
|---|---|---|---|
| Credit freeze | Blocks access to your report for new credit | Free | Strong, general protection |
| Fraud alert | Asks lenders to verify identity | Free | Short-term caution |
| Credit lock | App-based on/off control at one bureau | Often bundled with paid products | Convenience, but less regulated than a freeze |
| Credit monitoring | Alerts you to changes | Free or paid | Early warning, not prevention |
A freeze is the foundation. Monitoring adds alerts but does not stop new accounts. Our article on data breach: beyond credit monitoring explains why companies offering only monitoring leave gaps.
6. What bureaus do with your data
Credit bureaus collect information from lenders, collectors and public records, and sell reports and scores to authorized users. They also sell some marketing and screening products. You have rights under the Fair Credit Reporting Act, including to dispute errors and to limit prescreened offers. The Consumer Financial Protection Bureau explains your rights at consumerfinance.gov.
You cannot opt out of having a credit file, but you can limit access to it with a freeze. For the questions people ask about stopping data sales, read is there a way to stop reporting agencies from selling and sharing my data.
7. Limit what supplements the stolen data
Criminals who hold your Social Security number often need other details to complete a fraud: a current address, a phone number or the names of relatives to answer verification questions. People-search sites supply those details for free. Removing your listings makes it harder to pair stolen identifiers with a current identity. Use the data broker cleanup guide to start.
8. Myths about the Equifax breach
“It was years ago, so I am safe.” Social Security numbers do not expire. “Credit monitoring is enough.” Monitoring detects; a freeze prevents. “I did not claim my settlement, so I have no protection.” Your protection comes from the steps you take now. “A freeze will hurt my credit score.” A freeze does not affect your score.
9. Government resources for breach victims
The Federal Trade Commission maintains guidance for people whose information was exposed at ftc.gov, including advice about credit freezes, fraud alerts and recovering from identity theft. The Consumer Financial Protection Bureau explains how to dispute errors on a credit report at consumerfinance.gov. The Internal Revenue Service explains how to respond if you receive a notice that suggests someone used your Social Security number at irs.gov. Keep these official pages bookmarked, since scammers often impersonate the bureaus after a breach.
10. How to talk to older relatives about it
Older family members may not follow breach news and may be targeted by callers who claim to represent a bureau or a settlement fund. Explain that no legitimate settlement requires a fee, that a bureau will not call to ask for a Social Security number and that the safe response to any unexpected call is to hang up and use an official number. Offer to sit with them while they set up a freeze and alerts, which takes less time than most people expect.
11. Three scenarios
Scenario 1: You plan to apply for a mortgage. Keep the freeze, and lift it temporarily at the bureau the lender will use, then refreeze after the lender pulls your file.
Scenario 2: You find a credit inquiry you do not recognize. Contact the bureau and the lender, dispute the inquiry, and file at IdentityTheft.gov if you suspect fraud.
Scenario 3: Your elderly parent was affected. Help them freeze credit, set alerts and learn the common scam scripts. Protect their mail and their online accounts.
12. What to expect: a realistic timeline
| Step | Typical timing |
|---|---|
| Credit freezes | About 30 minutes for all three |
| IRS PIN | Quick enrollment; used at next filing |
| Temporary lift of a freeze | Minutes online |
| Fraud resolution if needed | Weeks to months |
| People-search opt-outs | Days to 4 weeks |
13. Common mistakes
- Believing that the breach was a one-time problem.
- Forgetting to freeze children’s files.
- Using a credit lock app as a substitute for a freeze.
- Ignoring credit reports until a loan is denied.
- Leaving personal listings public.
14. How Wiperts complements a credit freeze
A freeze guards the front door of your credit file. Wiperts reduces the supporting data criminals use to impersonate you. It scans more than 100 data brokers and people-search sites for your name, address and phone number, submits removal requests, requests removal of personal results from Google and Bing, blurs your home on maps and monitors 24/7 so relisted data is removed again.
See where your information is listed.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
15. Key takeaways
- The 2017 Equifax breach exposed permanent identifiers for about 147 million people.
- Settlements compensate but do not return the data.
- Freeze credit, get an IRS PIN, monitor and use strong authentication.
- Remove public listings so stolen data is harder to use.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
16. Frequently Asked Questions
What happened in the Equifax breach?
In 2017, attackers exploited an unpatched vulnerability in a web application and accessed personal data held by Equifax, one of the three major credit bureaus. The breach affected roughly 147 million people in the United States, along with some in other countries.
What information was exposed?
Names, Social Security numbers, dates of birth and addresses were exposed for most affected people, and for some, driver’s license numbers and credit card numbers. Dispute documents were also accessed.
What did Equifax have to pay?
A 2019 settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau and states was announced as up to $700 million, including funds for consumers, civil penalties and requirements to improve security.
Is my Social Security number still at risk?
If it was exposed, yes. It cannot be easily replaced, so protections such as a credit freeze, an IRS Identity Protection PIN and careful monitoring remain important years later.
Is a credit freeze really free?
Yes. Federal law makes credit freezes and unfreezes free at all three bureaus, and you can lift a freeze temporarily when you apply for credit.
Can I stop credit bureaus from selling my data?
You can limit some uses, such as prescreened offers through OptOutPrescreen.com, but bureaus are regulated by the Fair Credit Reporting Act and collect data as part of their business. A freeze limits access to your file.
Sources
Related Reading
- The Capital One Hack: How a Cloud Misconfiguration Exposed Millions
- What Is a Credit Freeze? How to Place, Lift and Use It in 2026
- The 3 Biggest Data Breaches: Yahoo, Equifax and Capital One
- Equifax Should Pay More: The Case, the Settlement, the Gaps
- What to Do After a Data Breach Notice: 10 Steps
- How Long Can Data Leaks Affect You?
- Beyond Credit Monitoring: What to Do After a Data Breach
- Can You Stop Credit Reporting Agencies From Sharing Your Data?
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing