HN Explorer

Ask HN: SSN breached, what should I do now?

24 points by whyage ↗ HN
Today I got a credit monitoring alert indicating that my social security number, driver's license (number and state), first and last name, address, and phone number were found "on the dark web".

I'm likely more careful with my personal data than most: I enable 2FA everywhere (with an authenticator app where available), use a unique email and a long random password on all my accounts, use DeleteMe for personal data removal, and have a credit freeze in effect with all reporting agencies.

I'm very concerned now that so much of my personal data is in the wild, and I'm not sure what to do about it. Any ideas?

26 comments

[ 318 ms ] story [ 2276 ms ] thread
gvb
1) Is the alert for real? From an reputable source and not spoofed? Not phishing?

2) Welcome to the New Normal[tm]. Do what you are currently doing (2FA everywhere) and watch your financial statements for unauthorized charges.

whyage
1) Yes, it's from CapitalOne's credit monitoring service. 2) The new normal is scary.
kobalsky
to be fair it's scarier that someone with a immutable secret number can steal your identity.

credit companies now have to do their due diligence before shooting loans left and right.

this is THE normal in most of the world.

aaaaaaaaata
> credit companies now have to do their due diligence before shooting loans left and right.

Hopefully we'll arrive at what it should have always been — sign here with your private key, please.

(An SSN is a [short] public key with no private key-pair)

linsomniac
Check https://haveibeenpwned.com/ and put in your e-mail address, it may provide more details about where the leak was originated. A coworker got a "Your credentials found in the Dark Web" and HIBP showed more details.
whyage
Found in 34 breaches... not sure what do with those details now that the cat is out of the bag.
aaaaaaaaata
Start changing reused passwords from those services leaked, for starters.
linsomniac
You can submit a request to the credit bureaus (TransUnion, Equifax, Experian) to "lock your credit" which will prevent many types of new credit accounts being created. This is probably a good idea to do unless you are actively applying for credit anyway.
whyage
I already have that, is it enough though?
gorjusborg
I had all of my personal information leaked, and this is all I did. The responsible party offered credit monitoring for a time, but that still doesn't really prevent any damage being done.

Locking your accounts at the credit bureau level prevents many credit accounts from being opened in your name, which is big issue with having your info out there.

yakak
I think pretty much everyone should do the locks but my understanding is that it doesn't apply to any organisation that already has a relationship to you, even for extending new credit.

I would also talk to existing bank(s) to see if I could add a passcode instead of mother's maidens name, 2FA method and so on, setup alerts, and close out unnecessary banks, etc.

gorjusborg
For me, MFA is a must on anything of importance, so I didn't include that in my response, but I agree whole-heartedly.
toast0
What else could you do?

Once you've locked down your reports, there's nothing really actionable to do. If you've got evidence of actual stuff going on, maybe figure out if you can get enhanced security at your banks, so it's harder for someone with your information to 'recover' your account, but SSNs are more or less public information at this point.

txsoftwaredev
At this point I assume anyone that wants my SSN, etc. has easy access to it. I did some work for a govt. agency and they ended up having a breach that included all my personal details including fingerprints. I use a credit monitoring service (paid for by them) and keep an eye on it.
Marsymars
On the plus side, you’ve now got plausible deniability if your fingerprints ever turn up at a crime scene.
fatnoah
Hey! I'm in the same boat. I'm really glad I got that Secret Clearance in the late 90's!
aerostable_slug
Be sure you use a credit freeze, not lock. Freezes are stronger protection, are regulated by Federal law, and the credit bureaus don't like them because you and your data cannot be as easily monetized. I'd call the latter point a sign that the freeze is working.

It's more of a pain to thaw your credit than unlock it, but how often are you shopping for a loan? The slight inconvenience is worth it.

t. used to work in that foul industry

sc00ty
Is the pain of thawing a credit freeze just the fact that you have to do it for each of the three bureaus or is there more? It seems like other than that, as long as you have a 1 hour notice you should be fine.

https://consumer.ftc.gov/consumer-alerts/2018/09/free-credit...

aerostable_slug
It's not any more than that minor inconvenience. Also, you only need to thaw the account with the credit bureau your lender (or whomever) uses, so you just need to ask if they use Experian, TU, or Equifax.
4oo4
It's not that bad. As long as you have the links bookmarked and have your PIN saved, it's a 5 minute process. And you can even make it temporary, so if you are looking at getting qualified for a loan you could give yourself just enough time to get that accomplished.

https://www.experian.com/freeze/center.html

https://www.equifax.com/personal/credit-report-services/cred...

https://www.transunion.com/credit-freeze

Also, only kinda related but this is extremely useful too, it prevents you from getting junk credit card offers in the mail, that others could potentially do in your name:

https://www.optoutprescreen.com/

And if you want to make identity theft even harder for someone, using a service like this to make your info less searchable is also great:

https://joindeleteme.com/

op00to
It is generally free now and I can unlock all my freezes quickly and it instantly takes effect. I did it on the phone with a lender once. They didn’t believe it!
starwind
You're 85 percent of the way there with 2FA and a credit freezes and the monitoring.

The SSA lets you set up an online account. It's a good idea to do this before some tries to do it in your name—that scenario is probably unlikely unless you're close to retirement. You definitely want to get an IRS pin so no one tries to file for a tax refund before you do.

Talk to your doctor's office about adding a note to your and your family's medical records that they have to call you before faxing your records to someone claiming to be a doctor bearing an official looking form.

You can add fraud alerts to the 3 credit bureaus so creditors are supposed to call you before they issue credit in your name. Useful if someone tries to unlock your credit with your PII.

You should add a freeze/fraud alert to your NCTUE report. They deal with utilities and cell carriers pull from them. There was a scam going on with Verizon for while where people would sign up for a contract, get 4 "free" unlocked phones and disappear.

If you want, you can also add fraud alerts and freezes to your Innovis (a smaller credit rating agency) report, and your Chex system (basically a credit report for banking) report, and freeze your LexisNexus (background stuff mostly for insurance) and Work Number (salary info) reports.

Many states allow you to suppress your public voting records like your address and phone number. That's where a lot of those data brokers first get your address.

Your phone carrier probably lets you set up a pin to prevent sim swapping. And you might be able to opt-out of them selling some info to advertisers.

If you find out your identity was stolen, you can file a police report, send that to the creditor saying to close the account, and include that with a letter to the credit rating agency to get it removed from your record. At that point you can probably get a new drivers license number.

polski-g
AllState sells identity theft insurance, something to consider. They basically pay for a lawyer to clean up the mess it causes
gdfgjhs
In addition to credit freeze, contact IRS and let them know that your social security number has been stolen. They will give you a pin that you will need to use when you file your taxes.

It happened to me, someone filed taxes with my name. Took almost a year before IRS fixed this and then they locked my account. So now every year, I need to use the pin.

Also file police report/FBI report, I think you can do all this online. When my identity was stolen they told me to do this although they knew no action will be taken. The reason is if someone use your identity to commit a serious crime, you will have an official police report to proof.

In end, it really sucks. You will need to keep paying for credit/identity monitoring services forever and occasionally take actions against events like some random credit card account opening up in some random state.