Vermont AG: Don't Use Equifax's Site To See If Your Data Is Compromised

Sep 8, 2017

State officials are urging Vermonters to find out whether they’re among the 143 million people affected by a massive data breach at Equifax. But experts say it's unclear if the website established by the company in response to the breach requires consumers to waive their right to sue over the incident.

The credit reporting agency says hackers have gained access to customers’ social security numbers, driver license numbers and other personal information.

State officials initially advised Vermonters to use a service set up by Equifax to determine if their data was compromised. Since then, Vermont's Attorney General has advised people to avoid the site because users might inadvertently waive their rights to sue Equifax over the data breach.

Zack Whittaker, the security editor for the technology news site ZDNet, tweeted Friday morning that anyone who uses that site to determine if their data has been compromised forfeits their right to sue the company over the breach.

The screenshot in Whittaker's tweet is from the Terms of Use on the site developed by Equifax.

Whittaker later tweeted that the Equifax website changed throughout Friday, and it's not clear what legal rights, if any, users are forfeiting by using the site.

Chris Geidner, the legal editor at BuzzFeed, tweeted that his understanding is that users who use the website to check if their information was compromised are not giving up any of their rights, but users who sign up for identity theft monitoring are forfeiting the right to join a class action.

Whatever the case, multiple experts are unsure of the legal implications for people who use the Equifax site, and Whittaker tweeted that Equifax is not responding to his questions on the topic.

In an interview Friday, Vermont Attorney General TJ Donovan said Vermonters should avoid using the Equifax website for now.

“We are not recommending that right now. We need to do more research and figure out what’s going on … Frankly that’s why we didn’t put that in our press release," he said. "I’m very concerned about waiving any rights Vermonters may have as a cost, if you will, a price of protecting their information and their property.”

“That website gives you information about what has happened, and how to enroll in credit monitoring,” says John Quinn, the the secretary of the state Agency of Digital Services.

Quinn says people will find out whether their data has been breached by following the instructions on the website, and also will be able to enroll in the free credit monitoring being offered by the company.

Quinn says people whose data is compromised should also run a credit check on themselves, to see if there’s any suspicious activity.

"It’s important that Vermonters stay vigilant and do all that they can to protect their information,” Quinn says.

Vermont Attorney General TJ Donovan issued an alert to Vermonters about the data breach using the VTAlert emergency alert system. Donovan's office says may have affected more than 240,000 Vermonters – more than a third of the state's population.

Donovan's office did not direct Vermonters to the Equifax site. Instead, the Attorney General's office encouraged people to use AnnualCreditReport.com and seek help from the Federal Trade Commission.

Update 12:25 p.m.This story has been updated to include information from Zack Whittaker of ZDNet.

Update 2:47 p.m. This story has been updated to include new information from Zack Whittaker of ZDNet, Chris Geidner of BuzzFeed, and Attorney General TJ Donovan.

Taylor Dobbs contributed reporting to this piece.