Full Notification

FOR IMMEDIATE RELEASE:

Tuesday, February 10, 2015

Data breach creates spike in interest by consumers in Credit Freeze
AG: Demand for free service very high after hack attack; credit bureaus’ websites busy

INDIANAPOLIS – In the wake of the Anthem Inc. data breach where the personal information including Social Security numbers of millions of people was apparently accessed by computer hackers, the Indiana Attorney General’s Office has seen exceptionally high demand in recent days for the free credit freeze function on its web site, www.IndianaConsumer.com. Available since 2007, the free credit freeze is one tool Hoosiers can use to protect themselves against identity theft because it prevents fraudsters from opening up an unauthorized line of credit in the consumer’s name while allowing the consumer to continue to use existing credit. Since news broke late Wednesday night Feb. 4 that Anthem policyholders’ names, birthdates, Social Security numbers and membership numbers were accessed by cyber-thieves, consumers have rushed to the credit freeze web page on the Attorney General’s website to be linked to each of the three major credit bureaus and register
for the free service.

Just seven people had visited the AG’s Office’s credit freeze page Feb. 4, before Indianapolis-based Anthem announced the data breach. On Thursday Feb. 5, the number of visitors clicking on the page increased to 1,677. The following day, Friday, Feb. 6, online visitors to the page jumped to 7,295. Demand continued through the weekend as news of the Anthem data breach sunk in, with 5,563 visiting the page Saturday Feb. 7 and another 3,014 visiting on Sunday, Feb. 8. Indications are the influx of visitors linked to the three credit bureaus’ sites and either registered for the free security freeze or explored how to do so. “We recommend Hoosiers register for the free credit freeze with all three credit bureaus – either online, or in writing – whether they are Anthem customers or not, as the freeze will limit the damage identity thieves can inflict and it can be lifted at the consumer’s request at any time. A credit freeze at the front end is better than credit monitoring which only alerts you to fraud after the fact,” Indiana Attorney General Greg
Zoeller said.

The Indiana General Assembly passed a law in 2007 creating the free credit freeze service for Indiana residents. High demand for the credit freeze service in recent days is believed to be a factor in the feedback from constituents that the three credit bureaus’ websites periodically have been slow to navigate. The Attorney General’s Office has reached out to the three credit bureaus – Equifax, Experian and TransUnion – in an attempt to get the slow navigation issues addressed.

Here are frequently asked questions consumers have posed about the credit freeze following the Anthem
data breach:

Q. Does the Attorney General’s Office know where the cyber-attack against Anthem originated or
whether the breached data is being sold?

A. Neither the cyber hackers nor their intended purpose have been identified so far as we are aware. The
Federal Bureau of Investigation is investigating, and the Indiana Attorney General’s Identity Theft Unit will assist our counterparts in law enforcement as needed.

Q. How can people register for a free credit freeze?

A. Visit the Attorney General’s Office’s web site, www.IndianaConsumer.com, scroll down the menu to
“Identity Theft and Data Breaches” and then click on “Credit Freeze.” The page also can be accessed directly at http://www.in.gov/attorneygeneral/2891.htm. From there, you can link directly to the sites of each of the three credit bureaus, Equifax, Experian and TransUnion. Under normal circumstances, the
registration process involves answering several questions and is relatively easy to complete. If an identity thief obtains a consumer’s personal information, they would not be able to use it to fraudulently open a new line of credit if the consumer already has a credit freeze in place. The consumer can visit the same websites to lift the credit freeze at any time – if, for example, they want to apply for a loan – and then reinstate the freeze.

Q. One of the credit bureau sites was very slow or would not give a PIN number. What should people do?

A. Each of the three credit bureaus operates its own website independent of the AG’s Office and of each other. The Attorney General’s Office web site portal http://www.in.gov/attorneygeneral/2891.htm links to
the three credit bureaus’ credit freeze registration pages; the AG’s Office does not operate the freeze registration directly. If the navigation for one credit bureau appears slow during a busy time of day, then consumers might try that one again later and move on to registering with one of the other two credit bureaus. Remember, to have the full protection of the credit freeze, consumers should register separately with all three credit bureaus.

Q. Can people sign up for the credit freeze if they don’t have access to a computer?

A. Yes. Registering online is best, but if doing so online is not convenient, then consumers also can register for a free credit freeze by U.S. mail, by sending letters to each of the three credit bureaus. Form letters for registering by mail can be obtained at this link:
http://www.in.gov/attorneygeneral/files/SecurityFreezeLettersFinal.pdf If someone is without Internet access or ability to download and print the form letters, they can call the Attorney General’s Office at 1-800-382-5516 which can mail them back the sample form letters that they can complete and in turn mail to the three credit bureaus in order to register for free.

More information about registering for the credit freeze by letter is at this link:

http://www.in.gov/attorneygeneral/2677.htm

Q. Can consumers register for the credit freeze directly by phone call?

A. Consumers can request a security freeze from Equifax by calling an automated line, 1-800-685-1111, and then press 3. More information is here: https://help.equifax.com/app/answers/detail/a_id/159/~/placing-a-security-freeze Consumers can request a security freeze from Experian by calling 1-888-397-3742 and then press 2 at
the prompt. More information is here: http://www.experian.com/consumer/help/states/in.html
We are not aware of a call-in option to register by phone with TransUnion. Registering for the freeze with that credit bureau is done online or in writing, as noted above. More information is here:
https://freeze.transunion.com/sf/securityFreeze/landingPage.jsp

Q. What about minors who are children of Anthem customers whose personal data also was
breached? Children often have social security numbers long before they establish credit.

A. This scenario was anticipated by the Protected Person Security Freeze, created by a new state law the Legislature passed in 2014, Senate Enrolled Act 394, as part of an ongoing effort by the Attorney General’s Office to help consumers protect themselves from identity theft and safeguard their credit. Because identity thieves could attempt to steal the information of individuals such as children or disabled adults who have clean credit history in order to assume their identities and perpetrate fraud, the new law offers a security freeze for protected consumers, similar to the credit freeze for adults. Parents can use it to protect their children from identity theft even if the minors don’t have credit yet. For mentally disabled adults who also should be protected against identity theft, their legal guardians can register them for the security freeze. Below are links to the three credit bureaus’ Protected Person Security Freeze sites. For the free service, each of the three credit bureaus requires that consumers register a minor or a protected consumer in writing, by mail, rather than online. And each credit bureau has a slightly different format for registering for a security freeze for a minor or other protected consumer, so read the directions carefully.

Equifax

Directions for registering for a credit freeze for a minor or protected person from Equifax are at this link: http://bit.ly/1rIFEKY

Experian

At this link, scroll down to the final two paragraphs on the Experian page for information on a security freeze for a protected consumer:
https://www.experian.com/consumer/help/states/in.html

TransUnion

Directions for registering for a credit freeze for a minor or protected person from TransUnion are at this link:
http://www.transunion.com/personal-credit/credit disputes/ProtectedConsumers.page

Consumers who have questions about the Protected Person Security Freeze can contact the Attorney General’s Consumer Protection Division at 1-800-382-5516. More information is at this link: http://bit.ly/1IEAzg4

Q. How can I get information about credit monitoring Anthem Inc. is offering?

A. Anthem Inc. on its web site has indicated it will notify consumers by U.S. mail soon of its process for
offering credit monitoring. More information is at this external link about the data breach: http://www.anthemfacts.com/faq

Q. What’s the latest on another scam involving Anthem?

A. Anthem has reported a phishing scam, where fraudsters impersonating Anthem and using its logo have sent misleading emails to the public, claiming to offer assistance to data breach victims and seeking customers’ personal information. Anthem has stated customers should ignore and not respond to such
emails, as they were sent by fraudsters and not sent by the company.

Q. Who is responsible for the cyberhacking attack and what is being done about it?

A. The criminal investigation into the data breach is being conducted by the Federal Bureau of Investigation. The Indiana Attorney General’s Identity Theft Unit is informing and educating consumers
on steps they can take to reduce the damage to their good name and credit rating.

Q. What warning signs or red flags should current or former Anthem/WellPoint policyholders look for that might indicate their identities have been stolen?

A. If consumers receive a debt collection letter for an unfamiliar debt, or have a credit application rejected when they have a strong credit rating, or receive a credit or charge card that they did not apply for, there is a strong possibility that a consumer has been the victim of identity theft. If identity theft occurs, then
consumers should file an ID theft complaint with the Attorney General’s Office. A complaint form can be accessed at www.indianaconsumer.com or https://indianaattorneygeneral.secure.force.com/IDTheftComplaintForm.

Consumers who suffer identity theft also should make a police report to their local police department or sheriff’s department.

Q. Where can I get more information about data breaches and preventing identity theft?

A. More information including the Consumer Protection Division’s “Identity Theft Tool Kit” is here: http://www.in.gov/attorneygeneral/2853.htm