Hackers stole 147 million Americans' Social Security numbers. That's why freezing your credit is free

Freezing your credit at all three bureaus costs nothing and takes about fifteen minutes. Until 2018, it could cost money in a lot of states — every time you froze or unfroze. Here's what changed it.

The hole

In March 2017, a fix was released for a serious security flaw in Apache Struts, software used to run websites. Companies running it were told to patch.

Equifax — one of the three big credit bureaus that keep files on nearly every adult in America — didn't patch its online credit dispute system. In mid-May 2017, more than two months after the fix came out, attackers got in through that exact hole.

76 days

The attackers stayed inside Equifax's systems, undetected, for about 76 days, pulling out data. Equifax noticed at the end of July. It didn't tell the public until September 7, 2017.

What was taken: names, Social Security numbers, birth dates, addresses, some driver's license numbers, and around 209,000 credit card numbers. The records of about 147 million Americans — roughly half the country — were exposed.

In between discovering the breach and announcing it, three Equifax executives sold almost $1.8 million of company stock.

The fallout

• In 2019, Equifax agreed to a settlement of at least $575 million with the FTC, the CFPB, and the states.
• In 2020, the U.S. Justice Department charged four members of China's military with carrying out the hack.

The law

Here's the part that matters to you. People were told the best protection was a credit freeze — which blocks lenders from pulling your file, so nobody can open new credit in your name. But in many states, the bureaus could charge a fee to freeze, and another fee to unfreeze.

The backlash helped push Congress to change that. Under a law signed in May 2018, starting September 21, 2018:

• Credit freezes are free at all three bureaus, to freeze and to unfreeze
• Freezes requested online or by phone must be placed within one business day, and lifted within one hour
• Parents can freeze the credit of children under 16 for free
• Fraud alerts last one year instead of 90 days

What this means for you

Your data was very likely in this breach, or one of the many since. A freeze is the single strongest thing you can do, and it's free.

• Freeze all three: Equifax, Experian, and TransUnion. Each one is separate.
• Use the bureaus' official sites, and save the PIN or login each gives you.
• Unfreeze temporarily when you apply for a loan or card, then it refreezes.
• Don't pay for a "credit lock." Here's the difference.

Quick reference

• 2017: Equifax left a known flaw unpatched; data on about 147 million Americans was stolen
• Attackers were inside for about 76 days before Equifax noticed
• Since September 21, 2018, credit freezes are free by federal law
• You must freeze each of the three bureaus separately
• Freezes don't hurt your credit score