My Equifax account was hacked, and Equifax doesn't care

Below is the text of my email to Equifax today.  Note: Separately from below, but for additional context, one of my Chase credit cards kicked off a fraud alert 1 day before the original Equifax email notice.  Apparently, someone was running around Brazil with a physical credit card with my name and number on it.  Chase said that sometimes scammers generate #s on physical cards, try to charge low-value amounts, and when they succeed, ratchet up the amount.

I'm sharing this because this past week has underscored how fragile our credit system is.  Now I'm navigating through credit alerts, reports, and monitoring services, and the process is byzantine and painful.  It feels like an arms race and one group is clearly losing: the customer. The industry needs to come up with a better way to manage this and threats to the system and its users - without making its customers bear the burden, as is happening today.

# part 1/3 #

* My account - and possibly Equifax - was hacked.  The account has been marked for investigation.  However, Equifax possesses information that would help me investigate this breach.  I would like to request that the investigation be expedited and that that information be released to me as soon as possible so I can investigate this. *

On May 28, I received an email notification from Member.Benefits@equifax.com that someone had changed the email address on my account.  A notice had been sent to the old and new email addresses.  The old account was .  It did not indicate what the new email address is.

The same day, I marked the email urgent in the subject line and wrote back that I did not request a change to my email address, and inquired whether this was a security intrusion.  Since I had not used Equifax or AnnualCreditReport.com recently, I was confident this was an unauthorized third party.

# part 3/3 #

I am deeply concerned that my account - and possibly Equifax itself - has been hacked, and would like to request the following:

- Please expedite the investigation into this intrusion. - Please release the email address that the account was changed to, so I can investigate this.  Otherwise, please work with the email provider and authorities to locate the person who breached my account.

In addition, I would like to request that Equifax please fix it's protocol for handling this type of situation.  For instance:

- In the original email notice, Equifax asked me to email back if the change was not initiated by me.  I did, but no one responded for 3 days, and when they did, they did not act on the information and instead closed the ticket.  When I called, I was told I should call back during a weekday.  Equifax should treat this as a security issue and act quickly, and have a way for issues like this to be addressed immediately instead of waiting days.

- didn't have anyone to transfer me to.  Equifax should have a phone number or email to report fraud - not outside of Equifax, but affecting Equifax's systems.

- didn't have access to my full account info and was unable to release any information that would help me investigate this fraud.  Equifax should have an escalation process for situations like this.  Ideally, Equifax should investigate potential breaches; and if they are unable to, should release information to the user to help the user investigate breaches on their account.

Sincerely,

> I indicated that if there was a hacking involved, this might be time-sensitive, and could affect other Equifax accounts. I was told there was no other way to get assistance.

That's typical. A long time ago, I received an offer to sell me 100k stolen credit cards, complete with phone numbers and zip codes of the card owners. This was before the era of mega breaches and so 100k was a pretty impressive list size. The offer included a sample of 10k cards. I did some investigation and was able to determine that the sample, at least, seemed to be legit.

I then contacted the credit card companies, figuring they would be interested in this. I figured they would take the samples, analyze them to find out the common factors to identify where the cards were stolen from, and then flag those cards, and the people they were stolen from and the merchants they were going to be fraudulently used at would be protected by the next day.

Boy, was I wrong.

This was a Friday and it was after 5 PM. The best I got was one card company gave me an email address that I could mail the 10k sample cards and the information about the offer for 100k cards to, and someone would look at it Monday.

I also tried law enforcement. The FBI suggested that I call the Secret Service. The Secret Service was not interested.

I mailed the information to the email that the one credit company provided, and gave up trying to get someone interested.

I feel your pain. The credit bureaus are antiquated in their processes and make resolving issues a burden on the consumer. That is why I believe identity theft is so prevalent because the thieves know that (a) by the time you catch it they will be long gone, and (b) that the burden really falls on you to prove something is going on buying them extra time to commit the crime.

I had my identity stolen several years ago and am still recovering from it. While most of it has been resolved, from time to time I find issues that have significant impacts. I even tried to get a new social security number but was denied because the amount of damages was not significant enough to trigger a reissue, although I have no idea and was never told what the trigger amount was.

The best advice I can give you, is to do everything by snail mail. Send certified letters (you can even do overnight if you have a few extra bucks for quicker delivery) and keep track of everything. File a complaint with your state attorney office (most have departments dedicated to working with you on this). Send copies of everything to the state attorney as well as the credit bureau. Snail mail takes longer (depending on how you send from a day or two to receive all the way up to a week), but for some reason it actually escalates your issue and does result in quicker resolutions than fighting with people on the phone. It sounds like you caught it fairly quickly. Call the other bureaus as well (Transunion and Experian) and put fraud alerts on your file. It is simple to do with a quick phone call. They will also send you a free copy of your report from them so you can double check. Finally, if you have a good credit card company some will help you with resolving the issue and dealing with the bureaus on your behalf. It is in their benefit to help you if they can.

Good luck.

I have my own subdomain, and every time I'm asked I usually put @mydomain.com.

When Equifax asked for my email address I gave equinox@.com

Guess where I started receiving spam shortly thereafter? Yep, their mailing database was hacked. Proof: http://postimg.org/image/j3qwslemb/full