Everyone needs to freeze their credit right now, and more

Now that there’s a class action lawsuit against the company, last week background check data aggregating company National Public Data in the most nonchalant way possible announced that “there appears to have been a data incident that may have involved some of your personal data,” which first appeared for sale on the dark web in April 2024. 

The file of nearly 3 billion records is 277 gigabytes uncompressed and contains information on people in the U.S., U.K. and Canada. The file includes full name, date of birth, phone number, and Social Security number. There are also lots of records for previous addresses, which is why there are 3 billion records but only 453 million Social Security numbers have been issued to-date. 

Guess what happens when smarty pants you already enabled two-factor authentication for that  extra layer of security but your cellphone number is stolen via sim-swap because your cell carrier asks for now-compromised information as verification? 

Cybersecurity company Pentester has created a free way for you to verify if and how much of your information has been leaked at http://npd.pentester.com. 

How to freeze your credit

There are three credit bureaus you need to take action with: Experian, Equifax and TransUnion. It’s free to do and the only downside is that if you are trying to get your credit checked to take out a loan or get a new credit card, you have to temporarily unfreeze your credit. Trust me, it’s worth the extra step. 

Experian

https://www.experian.com/freeze/center.html

(800) 397-3742

Equifax

https://www.equifax.com/personal/credit-report-services/credit-freeze/

(800) 298-0045

TransUnion

https://www.transunion.com/credit-freeze

(800) 916-8800

Freezing your credit is easier to do online than calling in, but you’ll need to create an account with each credit bureau if you don’t already have one. You can also download their apps to your smartphone to easily manage freezing/unfreezing.

I haven’t yet been able to confirm that information from minors is showing up in the data breach, but regardless you should freeze your children’s credit as well. I wrote about this back in May, but it’s important enough to use my word count in this column to repeat as minor identity theft can go unnoticed for years and can be financially devastating: 

“Go to your internet browser and type “freeze minor credit report Experian” (or TransUnion or Equifax — you will have to make each request separately). Make sure you are clicking on the actual domain URL of the credit bureau you are searching for and not some other website.”

Here’s what to do next

Next, turn on two-factor authentication (2FA) for all of the online accounts that have this feature (almost all online companies will require it soon enough anyway). Ideally you use a multifactor authentication app as opposed to receiving a text message due to the next item below. Use a password manager so you don’t repeat passwords.

Then, call your mobile carrier and enable their security measure that prevents SIM swapping so your phone number doesn’t get stolen. Carriers call this feature different things so you’ll want to talk to someone directly. It could be “port freezing,” “number lock,” “port-out protection,” “setting up your SIM security pin,” or “account lock.” Phone numbers were never designed to be records of identity, and most people have not implemented protections on their cell numbers — but when it’s stolen, you very quickly see how much you relied on your phone number as an identifier. 

Lastly, check https://haveibeenpwned.com/ and see what other personal information of yours has been leaked and change all of those passwords. Until the DELETE Act (Senate Bill 362 by state Sen. Josh Becker, D-San Mateo, passed January 2024) is implemented in August 2026, use tools like https://joindeleteme.com or https://www.privacybee.com which proactively remove your personal information from data brokers. Since late 2022, DeleteMe has removed my information 2,610 times from data brokers. What do you think your number will be?

These are the minimum steps you should take to protect your identity online. Unraveling  identity theft is extremely arduous, painful and expensive and can take years to recover from. The FTC logged over 1 million identity fraud cases in 2023, costing Americans $43 billion — do this bare minimum to minimize the probability that you are a part of 2024’s numbers. 

Annie Tsai is chief operating officer at Interact (tryinteract.com), early stage investor and advisor with The House Fund (thehouse.fund), and a member of the San Mateo County Housing and Community Development Committee. Find Annie on Twitter @meannie.