Attorney General Christopher S. Porrino announced today that New Jersey has signed onto a multi-state letter calling on the credit reporting firm Equifax to disable web links for enrollment in its fee-based credit monitoring service in the wake of a massive data breach with potential to impact 143 million consumers, including nearly 4 million in New Jersey.
A multi-state investigation into the breach began last week as soon as Equifax publicly disclosed it. In the wake of the breach, Equifax has offered free credit monitoring services.
But in a letter to Equifax today, the participating attorneys general objected to Equifax “seemingly using its own data breach as an opportunity to sell services to breach victims.” Enrollment information regarding fee-based services has featured prominently on the Equifax website.
”We believe continuing to offer consumers a fee-based service in addition to Equifax's free monitoring services will serve to only confuse consumers who are already struggling to make decisions on how to best protect themselves in the wake of this massive breach,” the letter asserts. “Selling a fee-based product that competes with Equifax's own free offer of credit monitoring services to victims of Equifax's own data breach is unfair, particularly if consumers are not sure if their information was compromised.”
The multi-state letter also notes that, although Equifax has agreed to waive credit freeze fees for those who would otherwise be subject to them, the other two credit bureaus -- Experian and Transunion -- continue to charge fees for security freezes.
The letter contends that Equifax should be taking steps to reimburse consumers who incur these fees while seeking to completely freeze their credit.
“This is one version of a consumer’s worst fear -- having his or her sensitive financial and other personal information compromised by a cyber-data breach,” said Attorney General Porrino. “In New Jersey and across the nation, many people are angry, confused and stressed by the potential for harm in this breach. In our view, Equifax now has a duty to ensure that consumers don’t end up paying for credit monitoring, and Equifax also has a duty to reimburse consumers for the cost of a complete credit freeze – which will require paying fees to the other two credit reporting companies.”
“While the multi-state investigation remains active,” Porrino added, “one thing we know is that consumers aren’t at fault here. They had no hand in creating the cyber-security crisis now confronting Equifax. As such, consumers should have access – at zero cost – to the best available credit monitoring services and protections.”
In a letter sent to Equifax last week, the investigating multi-state group requested information about the circumstances leading to the breach, the reasons for a months-long delay between the breach and Equifax’s public disclosure, what protections the company had in place at the time of the breach, and how the company intends to protect consumers affected by the breach.
The attorneys general also have had communications with Equifax expressing concerns about terms of service relative to the offered free credit monitoring services, and the prominence of service enrollment information on Equifax's Web page.