On 7 September 2017, Equifax Inc in the US, announced that it had been the victim of a criminal cyber-attack and that some historical UK data had been affected.
This fact sheet is designed to answer questions that UK consumers may have about the incident and how it could impact them.
Who is Equifax and what do you do?
Equifax is a Credit Reference Agency (CRA) that is authorised and regulated by the Financial Conduct Authority.
CRAs collect data from a variety of sources, including the electoral roll and public records such as details of county court judgments and bankruptcies. Organisations may check your application details with a CRA if you apply for credit to:
understand your financial position
make sure that the product is suitable for your individual circumstances
understand whether you are likely to be able to afford the repayments and are protected from potentially over-extending yourself
help confirm the person they are dealing with is actually you and not someone attempting to commit identity theft or any other kind of fraud in your name.
You can find out more about us on our website www.equifax.co.uk
What has happened?
A criminal cyber-attack took place against our US parent company, Equifax Inc, earlier in 2017. Our UK business, Equifax Ltd, was not breached but unfortunately, the attack impacted the personal information of some UK consumers.
What UK consumer data has been impacted in this cyber-attack?
Files containing 15.2 million UK records dating from between 2011 and 2016 were attacked in this incident. Regrettably these files contained data relating to actual consumers, as well as sizeable test datasets, duplicates and spurious fields.
Having analysed the impacted data, we established that we need to contact 693,665 consumers by post. This number comprises four consumer risk categories as follows:
– 12,086 consumers who had an email address associated with their Equifax.co.uk account in 2014
accessed
– 14,961 consumers who had portions of their Equifax.co.uk membership details – such as username,
password, secret questions and answers and partial credit card details – from 2014 accessed
– 29,188 consumers who had their driving licence number accessed
– 637,430 consumers who had their phone number accessed
What are you doing to help consumers?
On 13 October 2017, we began the process of posting letters to impacted UK consumers to let them know they could be at risk of fraudulent activity. We are still in the process of notifying impacted consumers by post, and expect to complete this process in the coming weeks. The letter describes the risks to the impacted consumer based on the information we believe was accessed by the criminal. For the vast majority of impacted consumers, there is a greater risk of text or cold calling campaigns to attempt to defraud you, or use of your details to enter into fraudulent contracts.
The letters we are sending to impacted consumers describe a range of services that we are offering individuals to help protect against the risk of ID theft. These services monitor personal data, including credit information, and provide alerts by email or SMS message to potential signs of fraudulent activity. We also provide links to services provided by other UK regulated organisations which these consumers may prefer to take-up in addition to, or instead of, the free services provided by Equifax.
What should I do if I receive a letter?
Any individual that receives a letter from Equifax should read it carefully and call the helpline with any questions. Equifax will never call you or email you unless you ask us to. We will never ask you for your full credit card details or bank account details. If anyone asks you for this information and claims to be from Equifax, do not respond to their request.
Impacted consumers can register for most of the services via www.equifax.co.uk/protect and enter the reference number contained in their letter.
We have a freephone helpline (0800 587 1584) that provides advice and helps consumers sign up for the protection services on offer. It is staffed between 8am and 8pm every day.
How can I contact Equifax if I have any questions?
We have a free helpline that UK consumers can contact to register for our protection and monitoring services or if they have any questions about this incident. Please call 0800 587 1584. It is open seven days a week, 8am to 8pm. Information is also available on www.equifax.co.uk
I heard there were issues with your helpline. Is that still the case?
There were some interim technical issues that affected some calls to our helpline, but these have now been resolved and we are working hard to reduce the risk of any future problems. Our absolute priority has always been to ensure that impacted consumers get the advice, support and protection they need in a quick and straightforward way. We apologise sincerely for any inconvenience caused.
Where else can I get information?
There are several independent websites providing useful information on how to identify if fraud has taken place and actions you can take to protect yourself.
The ICO (Information Commissioners Office) www.ico.org.uk/for-the-public/identity-theft
Action Fraud www.actionfraud.police.uk
UK Finance www.financialfraudaction.org.uk/consumer
CardWatch www.cardwatch.org.uk
National Crime Agency www.nationalcrimeagency.gov.uk/crime-threats/cybercrime/online-threats-to-consumers