Security or Data Breach
A security breach or data breach is one of the most common causes of disclosure of personal information. These breaches can expose the personal information of a few thousands, or even millions of individuals. It occurs when personal or otherwise sensitive information that is maintained by an entity is accessed in an unauthorized manner or when that information is inadvertently exposed. Such an incident certainly increases one’s risk of identity theft. However, it should be noted that not all personal information compromises result in identity theft.
The Arkansas Personal Information Protection Act requires entities that collect personal information to use reasonable security procedures and practices to protect such information. Additionally, the law mandates that in the event such information is compromised, the entity must notify the affected individuals in a timely manner. Notification to individuals whose personal information has been compromised allows them to take steps to mitigate the potential misuse of their information.
Although it is not required by Arkansas law, many entities that experience a security breach will offer credit monitoring services at no charge to affected individuals, usually for a period of one year. Credit monitoring can be useful in this context; however, it is entirely up to you whether you want to take advantage of such an offer.
What should I do if I receive a security breach notification?
- If the compromised information relates to existing financial accounts, contact your financial institution to close or change the account information as soon as possible.
- Consider placing a fraud alert on your credit bureau reports.
- Consider placing a security freeze on your credit bureau reports.
- Periodically monitor your credit bureau reports for any unusual activity and check for accuracy. Everyone is allowed one free credit report per year from each of the three major credit bureaus. To learn how to obtain your free annual credit report under federal law, visit AnnualCreditReport.com or call (877) 322-8228. A victim of fraud is eligible to receive one free credit report from each of the major credit bureaus. Requests for a free report based on a fraud claim should be made directly to the credit bureaus:
2017 Equifax Data Breach
The Attorney General's office learned on September 7, 2017 that Equifax experienced a cybersecurity incident that could potentially affect 145.5 million U.S. consumers. More than 1.3 million Arkansans have been affected.
The breach occurred due to a vulnerability in Equifax’s website application program. The breach occurred in mid-May and lasted until July 29, when Equifax discovered it.
The information accessed primarily includes names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. In addition, credit card numbers for approximately 209,000 U.S. consumers and certain credit dispute documents with personal identifying information for approximately 182,000 U.S. consumers were accessed.
Equifax has hired a security firm to conduct a forensic investigation to determine exactly how the breach occurred. Equifax is offering one year of free credit monitoring, and it has also established a website, equifaxsecurity2017.com, to help consumers determine if their information was potentially impacted.
Consumers will be given a date after which he or she can return to the website and enroll in credit monitoring services. The enrollment period ends November 21, 2017.
Credit monitoring services are offered through TrustedID Premier. These services include credit monitoring of Equifax, Experian and TransUnion credit reports; copies of Equifax credit reports; the ability to lock and unlock Equifax credit reports; identity theft insurance; and internet scanning for Social Security numbers – all free to U.S. consumers for one year.
Equifax has modified the language in its privacy agreement to state that you do NOT waive your right to sue by enrolling in free credit monitoring, if you choose to do so.
The Arkansas Attorney General's office, in connection with other states, will conduct a thorough review of this breach to assure that Equifax takes steps to minimize the exposure of Arkansans’ personal information.