CLEVELAND, Ohio -- One of the big three credit bureaus, Equifax, on Thursday confessed what's almost unbelievable -- it's been hit by a massive cybersecurity breach that compromised Social Security numbers, birthdates and other personal information on more than half of the adults in the United States. 
 
 
 
 Cyber thieves hacked into electronic files to obtain all sorts of personal information on 143 million Americans, including people's names, addresses, dates of birth, Social Security numbers and driver's license numbers in some cases, the company said. In addition, credit card numbers were disclosed for more than 200,000 consumers. 
 
 The data breach occurred between mid-May and sometime in July, according to Equifax, after thieves broke into parts of the company's database. The powerhouse credit bureau said is discovered the disastrous problem on July 29. And we're just finding out about this six weeks later because why? That wasn't disclosed. 
 
 "This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do," Equifax EO Richard Smith said in a face-palm statement posted on Equifax's web site. "I apologize to consumers and our business customers for the concern and frustration this causes." 
 
 
 
 Equifax has created a website, www.equifaxsecurity2017.com, so that people can learn whether their information has been compromised. Consumers can go to that site to sign up for credit monitoring and identity theft protection. The service will include credit monitoring for all three credit bureaus -- Equifax, TransUnion and Experian -- as well as copies of their Equifax credit report. Consumers also will be able to scan fraudulent use of their Social Security number on the internet; lock and unlock their Equifax credit report; and obtain identity theft insurance. All services will be provided free for one year. 
 
 "Dark web scans are a nice feature, but they don't do much in the way of protecting you," said Boston identity theft expert, Robert Siciliano, CEO of IDTheftSecurity.com. "They may alarm people without providing much substance. " 
 
 People also may want to hold off signing up for Equifax's Trusted ID identity theft monitoring service, said identity and credit expert Robert Harrow of ValuePenguin. There's concern about whether consumers may be waiving their right to sue. 
 
 "There has been a lot of confusion over how their service will help, as well as language in the terms and conditions on opting out of a class action lawsuit if consumers sign up for the service," Harrow said. "In light of this, we recommend that consumers wait on Equifax to provide more clarification on what this will mean for them." 
 
 Traffic to Equifax's site was so heavy Thursday night that Equifax was providing staggered sign-up dates for the free services. 
 
 Equifax will mail notices to consumers if their credit card numbers or disputes on file with Equifax were compromised. 
 
 Equifax apparently had a vulnerability on one of its web sites that allowed thieves to get in, "which is further alarming that a public-facing site had any form of vulnerability in this day and age," Siciliano said. 
 
 
 
 Until more details come out, you should assume you are affected by this and take several precautions. 
 
 
 
 1. If you believe your information may have been breached or you have questions, go to www.equifaxsecurity2017.com or contact Equifax's special call center at 866-447-7559. The call center is open seven days a week, from 7 a.m. to 1 a.m., Eastern Time. If you want to check your exposure online, you'll be asked to enter your last name and last six digits of your Social Security number. 
 
 2. Be on guard for suspicious emails or phone calls that try to trick you into disclosing personal information. With a data breach of this scale, many of us will receive emails and calls that claim to be from Equifax or our banks or creditors or law enforcement, and ask us to click on links or fill out forms or provide even more personal information. 
 
 If anyone contacts you by email or phone and says he's from Equifax or anyplace else and calling about this breach, hang up immediately. (Unless you've called someone and left a message.) If you don't hang up for some reason, then do not provide any information, such as your Social Security number, date of birth, bank account information, etc. No entity will ever contact you out of sky blue by phone, email or mail and ask for personal information. Never. Ever. Don't click on links or respond with any information. 
 
 3. Monitor your statements for your bank accounts, credit cards, investments, etc., more carefully than ever. 
 
 -- a notice about a credit account you didn't apply for, a letter from a company thanking you for your recent phone call if you didn't call them, a bank statement that is more than a few days late or a medical explanation of benefits for a service you didn't have. These could be signs of identity theft. 
 
 
 
 5. Check your credit reports immediately, unless you've done it within the last month or two. You're entitled to one free credit report per year from each of the three major credit bureaus. Go to annualcreditreport.com or call 1-877-322-8228. Or you can fill out a paper request and mail it to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, Georgia 30348-5281. You'll be asked to provide your name, address, Social Security number, date of birth and which bureau you want a report from (Equifax, TransUnion or Experian). 
 
 6. Make sure all of your passwords on all of your accounts, especially your personal email, are solid and not something like your birth year or pet's name. If someone hacks into your primary email account, she can use that to change passwords on a number of financial accounts. 
 
 for email and/or text alerts for existing bank, debit card and credit card accounts, so you're notified immediately of activity -- purchases, withdrawals, etc. -- that you want to be notified about. 
 
 8. Be more cautious about anything you post on social media -- Facebook, Twitter, Instagram, etc. You can provide identity thieves with a lot of information without meaning to. This is especially troubling if you post the name of your high school and photos of your dog online, and then use that information as the answers for security questions for bank accounts. Go through your social media accounts and start cleansing. 
 
 And remember that even if your social media accounts are accessible only to friends or family, the information is still on some company's database and can be accessed or sold. 
 
 and other types of financial accounts. Ask whether you can put additional verbal passwords on your accounts that don't involve any public record data such as your mother's maiden name or date of birth. We're talking about PINs or passwords that are random words (like smelly socks or oak tree). You want to make sure someone can't access your accounts for wire transfers or to change your contact information without your secret password. 
 
 10. Consider paying for identity theft protection after the free Equifax protection ends. You're looking for the kind that can alert you to any underground use of your Social Security number, credit card numbers, driver's license number or email. 
 
 you can on your financial accounts. If you can use two passwords, do it. If you can require codes to be sent to your cellphone in order for you to log in, do it. If you can request email or text alerts for purchases or bank account withdrawals or changes to your contact information, then do it. While you're at it, make sure that companies you do business with have all of your current contact information in their files. 
 
 
 
 12. It's almost come to the point where everyone should consider having their credit files frozen so that someone can't open new accounts in their name. 
 
 Yes, credit freezes can be a hassle if you need to unfreeze your reports because you're applying for a loan or insurance or renting a new apartment. It can take up to three business days to unfreeze it and allow access. And yes, freezing and unfreezing them costs $5 per credit bureau. 
 
 But a credit freeze would prevent any new accounts from being opened without your expressed permission, indicated by providing your 10-digit PIN that you're given when you freeze the files. 
 
 If you want to do a credit freeze, you'll have to contact each of them individually: 
 
 Equifax: http://www.equifax.com/help/credit-freeze/en_cp or call 1-800-685-1111. 
 
 TransUnion: https://freeze.transunion.com or call 1-888-909-8872 
 
 Experian: https://www.experian.com/freeze/center.html or call 1-888-397-3742. 
 
 One of my primary sticking points with credit freezes is that they can give people a false sense of security. Credit freezes won't help prevent fraud on existing accounts, which constitutes 88 percent of identity theft. 
 
 on your credit files through all three credit bureaus. You can do this by phone or online. You need to contact only one of the bureaus; the first one must contact the other two. 
 
 A 90-day fraud alert is free. 
 
 Experian.com/fraudalert 1-888-397-3742 
 
 TransUnion.com/fraud 1-800-680-7289 
 
 Equifax.com/CreditReportAssistance 1-888-766-0008 
 
 14. Check your credit reports regularly for forever. Stagger them, checking one every four months. For example, check Equifax in September, TransUnion in January and Experian in May. ||||| 39 SHARES 
 
 In recent years, many Americans’ personal information has become compromised by big data breaches. In 2018 alone, prominent companies like Adidas, Best Buy, Delta, Kmart, Macy’s and Sears have fallen victim to cybercriminals. According to the Identity Theft Resource Center’s most recent Data Breach Report, between January 1, 2005 and August 31, 2018, there have been 9,395 breaches. That accounts for over 1.1 billion records compromised. 
 
 The federal government and various businesses in recent years have taken more aggressive measures to build up our defenses. The Trump administration recently released a new cybersecurity plan, including taking more offensive measures toward foreign cyberattacks. Despite this, criminal strategies continue to evolve and grow in sophistication, keeping consumers vulnerable to identity theft and fraud. 
 
 But some Americans are more susceptible than others to such crimes. In order to determine who is most likely to be exposed to and affected by identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across ten key metrics. Our data set ranges from identity-theft complaints per capita to average loss amount due to fraud. Read on for our findings, tips for protecting your personal information and a full description of our methodology. 
 
 Main Findings 
 
 States With the Most Identity Theft & Fraud 
 
 Overall Rank* State Total Score ‘Identity Theft’ Rank ‘Fraud’ Rank ‘Policy’ Rank 1 Nevada 72.66 2 5 27 2 Florida 69.11 12 2 27 3 New Jersey 68.52 1 25 5 4 Delaware 68.34 21 1 50 5 California 64.12 6 17 16 6 District of Columbia 63.89 20 3 5 7 New York 62.17 9 15 27 8 West Virginia 62.10 8 29 5 9 Michigan 61.71 10 13 41 10 North Dakota 61.64 4 37 5 11 Ohio 61.44 3 41 41 12 Maryland 59.60 7 19 51 13 Illinois 59.39 5 40 18 14 New Mexico 59.38 13 21 27 15 Colorado 59.20 14 14 41 16 South Carolina 57.83 22 9 41 17 Texas 57.72 18 12 27 18 Oregon 57.06 33 4 18 19 Tennessee 56.85 26 8 27 20 Georgia 56.36 23 10 27 21 Arizona 56.35 17 16 41 22 North Carolina 56.16 31 6 27 23 Pennsylvania 55.63 24 23 1 24 Minnesota 55.62 19 28 5 25 Virginia 55.28 25 11 18 26 Oklahoma 55.09 15 44 5 27 Nebraska 54.87 11 51 18 28 New Hampshire 53.70 30 20 1 29 Massachusetts 53.34 16 48 5 30 Missouri 51.04 32 27 1 31 Alabama 50.22 46 7 5 32 Rhode Island 49.86 28 47 4 33 Washington 49.32 27 38 18 34 Mississippi 48.91 34 18 18 35 Connecticut 48.16 29 36 27 36 Louisiana 46.48 39 22 18 37 Utah 45.49 36 30 27 38 Idaho 45.48 37 43 5 39 Alaska 44.38 38 39 18 40 Arkansas 43.35 35 45 41 41 Kansas 42.95 40 31 41 42 Wyoming 42.78 44 32 5 43 Montana 42.72 41 42 27 44 Indiana 42.35 47 24 27 45 Kentucky 41.83 45 35 16 46 Wisconsin 41.25 43 33 27 47 Maine 40.42 49 46 5 48 Iowa 39.25 42 49 41 49 Vermont 38.86 50 34 27 50 South Dakota 37.85 51 26 18 51 Hawaii 36.79 48 50 41 
 
 
 
 *No. 1 = Most Vulnerable 
 
 Quick Tips for Avoiding Identity Theft & Fraud 
 
 Emphasize Email Security : It’s obviously important to use strong passwords for all financial accounts, but you may not realize how essential it is to focus on email. Your primary email address will likely serve as your username and means of resetting your password on other websites. If it’s vulnerable, all of your other accounts will be, too. As a result, make sure to use an especially secure password and establish two-step verification for this account. 
 
 : It’s obviously important to use strong passwords for all financial accounts, but you may not realize how essential it is to focus on email. Your primary email address will likely serve as your username and means of resetting your password on other websites. If it’s vulnerable, all of your other accounts will be, too. As a result, make sure to use an especially secure password and establish two-step verification for this account. Sign Up for Credit Monitoring : Credit monitoring is the best way to keep tabs on your credit report. It provides peace of mind in the form of alerts about important changes to your file, including potential signs of identity theft. WalletHub offers free monitoring of your TransUnion credit report. 
 
 : Credit monitoring is the best way to keep tabs on your credit report. It provides peace of mind in the form of alerts about important changes to your file, including potential signs of identity theft. WalletHub offers free monitoring of your TransUnion credit report. Leverage Account Alerts & Update Contact Info : Setting up online management for all of your financial accounts (e.g., credit cards, loans, Social Security), and keeping your phone number, email address and street address up to date will make them harder for identity thieves to hijack. Establishing alerts for changes to your contact info and other suspicious account activity will serve as a safeguard. 
 
 : Setting up online management for all of your financial accounts (e.g., credit cards, loans, Social Security), and keeping your phone number, email address and street address up to date will make them harder for identity thieves to hijack. Establishing alerts for changes to your contact info and other suspicious account activity will serve as a safeguard. Use Common Sense Online: Don’t open emails you don’t recognize. Don’t download files from untrustworthy sources. Don’t send account numbers and passwords via email or messenger applications. And don’t enter financial or personal information into websites that lack the “https” prefix in their URLs. 
 
 For more tips and information, check out WalletHub’s Identity Theft Guide. 
 
 Ask the Experts 
 
 As a cyber-oriented culture, it’s natural to wonder whether and how our daily habits assist hackers in stealing our personal information. We consulted a panel of experts for answers to such questions and advice on how to safeguard our data against cybercriminals. Click on the experts’ profiles to read their bios and thoughts on the following key questions: 
 
 What can individuals do to guard against identity theft? How should consumers choose among third-party providers offering services to protect their identity and personal data? Should victims of identity theft be able to change their Social Security number? How can we make this number more difficult to steal and use (e.g., add more digits)? Is the recent expansion of social media facilitating identity thefts? Should the federal government intervene to establish a clear process for victims of identity theft looking to clear their name? What measures can authorities undertake in order to avoid cases like the recent Equifax leaks? Should credit bureaus be tested for security breaches by authorities on a regular basis? If so, would the Consumer Financial Protection Bureau play a larger role in regulation and enforcement of bureaus? 
 
 Methodology 
 
 In order to determine where American consumers are most vulnerable to identity theft and fraud, WalletHub compared the 50 states and the District of Columbia across three key dimensions: 1) Identity Theft, 2) Fraud and 3) Policy. 
 
 We evaluated those dimensions using ten key metrics, which are listed below with their corresponding weights. Each metric was graded on a 100-point scale, with a score of 100 representing the most vulnerable. 
 
 Finally, we determined each state and the District’s weighted average across all metrics to calculate its total score and used the resulting scores to rank-order our sample. 
 
 Identity Theft – Total Points: 47.5 
 
 Identity-Theft Complaints per Capita: Full Weight (~23.75 Points) 
 
 Average Loss Amount Due to Online Identity Theft: Full Weight (~23.75 Points) 
 
 Note: This metric was calculated using the following formula: Total Loss Amount / Total Number of Online Identity-Theft Complaints. 
 
 Fraud – Total Points: 47.5 
 
 Fraud & Other Complaints per Capita: Full Weight (~11.88 Points) 
 
 Median Loss Amount Due to Fraud: Full Weight (~11.88 Points) 
 
 Note: This metric was calculated using the following formula: Total Reported Amount Paid / Total Number of Complaints Stating the Amount Stolen. “Total reported amount paid” is based on the total number of fraud complaints for which the amount paid was reported by the victims. The amount paid ranges from $0 to $999,999. 
 
 Persons Arrested for Fraud per Capita: Full Weight (~11.88 Points) 
 
 E-Commerce Attack Rates: Full Weight (~11.88 Points) 
 
 Policy – Total Points: 5.0 
 
 Availability of Security-Freeze Law for Minors’ Credit Reports: Full Weight (~1.25 Points) 
 
 Note: This binary metric considers the presence or absence of legislation allowing parents, legal guardians or other representatives of minors to place a security freeze on the minor’s credit report. 
 
 Availability of Identity-Theft Passport Program : Full Weight (~1.25 Points) 
 
 Note: This binary metric considers the presence or absence of Identity-Theft Passport programs that help victims of identity theft reclaim their identity. When presented to a law-enforcement agency, an “identity-theft passport” allows a victim to prevent his or her arrest for offenses committed by an identity thief. 
 
 Compliance with REAL ID Act : Full Weight (~1.25 Points) 
 
 Note: According to the Department of Homeland Security, the REAL ID Act “establishes minimum security standards for license issuance and production and prohibits Federal agencies from accepting for certain purposes driver’s licenses and identification cards from states not meeting the Act’s minimum standards. The purposes covered by the Act are: accessing Federal facilities, entering nuclear power plants, and, boarding federally regulated commercial aircraft.” This binary metric considers a state’s compliance, noncompliance or extension of time to comply with the ACT. An extension allows a state to accept driver’s licenses and identification cards issued by that jurisdiction to accept those forms of identification for official purposes, under the condition that the state has provided adequate justification for noncompliance. 
 
 
 
 Data Disposal Laws by State : Full Weight (~1.25 Points) 
 
 Note: This is a binary metric that measures the presence or absence of data disposal laws in each state. Businesses and government collect personal information and store it in various formats-digital and paper. Several states have enacted laws that require entities to destroy, dispose or otherwise make personal information unreadable or undecipherable. 
 
 
 
 Videos for News Use: 
 
 
 
 Sources: Data used to create this ranking were collected from the Federal Trade Commission, Internet Crime Complaint Center, Federal Bureau of Investigation, Department of Homeland Security, Experian Information Solutions and National Conference of State Legislatures. 
 
 Image: alexskopje / Shutterstock.com 
 
 Was this article helpful? Yes No Awesome! Thanks for your feedback. Thank you for your feedback. Sorry! Failed to send the feedback. Please try again later. Submit
– Given the recent Equifax security breach—alongside a 630% increase in data breaches in the past year, according to one report—identity theft is bound to be a concern for many Americans. But it turns out the state you call home has a lot to do with your risk. WalletHub reviewed identity theft and fraud complaints and policy across the US to come up with the most vulnerable states.