On Equifax’s Offer of Their Own Credit Monitoring Service ⇥ krebsonsecurity.com

Brian Krebs:

Credit monitoring services rarely prevent identity thieves from stealing your identity. The most you can hope for from these services is that they will alert you as soon as someone does steal your identity. Also, the services can be useful in helping victims recover from ID theft.

My advice: Sign up for credit monitoring if you can, and then freeze your credit files at the major credit bureaus (it is generally not possible to sign up for credit monitoring services after a freeze is in place). Again, advice for how to file a freeze is available here.

The fact that the breached entity (Equifax) is offering to sign consumers up for its own identity protection services strikes me as pretty rich. Typically, the way these arrangements work is the credit monitoring is free for a period of time, and then consumers are pitched on purchasing additional protection when their free coverage expires. In the case of this offering, consumers are eligible for the free service for one year.

There may be nothing inherently unethical about Equifax using a product of their own to try to assist people affected by their breach, but it feels scummy. Even if Equifax disables subscription renewal notices for anyone who takes advantage of their offer — and I sincerely doubt they will — it still looks like they’re taking advantage of one of the worst data breaches in recent history to pitch one of their products.