Mahoney, says a federal law should provide a baseline for state-level protections to build on.Ĭonsumers still need to take steps to protect themselves. Like some lawmakers at the hearing, Consumers Union and other consumer advocates want to see Congress pass a strong federal data-breach notification law that includes, at a minimum, strong civil penalties for violating data-breach notification laws, and enforcement by state attorneys general. 'The burden should be on them to proactively inform the consumer.' 'Equifax makes you proactively check the site,' says Chi Chi Wu, staff attorney at the National Consumer Law Center.

Other advocates say Equifax puts the burden on consumers to find out about the breach. 'While Equifax may be following the law, ‘doing enough' doesn't just mean meeting the bare minimum state requirements,' Mahoney says. In his testimony, Barros said that 30 million individuals have used the website.Ĭonsumer advocates say that is far from enough. His response was that the company was contacting consumers as mandated by law.Įquifax says it has mailed notices to about 391,000 consumers, posted two press releases about the breach, and created a website to inform consumers about the incident. 'Inconsistent state laws mean that not all consumers have adequate protections in the event of a data breach,' says Maureen Mahoney, policy analyst at Consumers Union, the policy and mobilization division of Consumer Reports.ĭuring a Senate hearing on Wednesday, Equifax's interim CEO Paulino do Rego Barros was asked whether Equifax had proactively reached out to all 145 million consumers who may have been affected by the breach, even in states that don't demand that the company do so. Michaud says she hasn't gotten any letters or emails from Equifax informing her about the breach.

'If I didn't watch the news as much as I do, I would have never known about it,' Danielle Michaud, a 32-year-old mother of three from Volusia County, Fla., told Consumer Reports. adults (more than 30 percent of the population) haven't heard anything at all about the Equifax breach, according to a recent study from. The uneven reporting requirements help explain why 71 million U.S. In Utah, posting a notice in a general circulation newspaper is sufficient, but California requires broader media notification and sending an email message to those people who may have been affected.

Equifax data breach lookup