Equifax breach impacted 2.5 million more peopleWhen credit bureau Equifax disclosed that it had suffered a massive data breach nearly a month ago on Sept. 7, it acknowledged that the investigation into the matter was not yet fully complete. A press release published on Oct. 2 reported that Mandiant — the firm contracted to complete the forensic investigation into the hack — has completed its investigation. The final results indicated that the Equifax breach impacted an additional 2.5 million people than what was originally reported, bringing the total number of consumers affected up from 143 million to 145.5 million consumers impacted. Mandiant was originally hired in August to investigate the security breach, which is believed to have begun sometime around mid-May 2017 and lasted through the end of July.

Who are the additional 2.5 million consumers impacted?

Equifax noted in its press release that these additional names are not indications of new activity or access by the hackers. They instead represent the final amount of confirmed potentially impacted consumers based on Mandiant’s investigation. To reduce confusion, Equifax will be notifying these additional affected people by U.S. postal mail. The online tool, which enables citizens to check whether they were potentially impacted or not, will be updated by Oct. 8 to include these 2.5 million extra people. Equifax also confirmed that approximately 8,000 Canadian consumers were impacted — a drastic reduction from the 100,000 it said might have been impacted when the news first broke. Although the investigation into U.K. consumer impact is complete, Equifax is still working with regulators there to analyze the findings and has not confirmed how many were impacted there. So far, there has been no indication as to who the hackers were, though it is known that they exploited a known vulnerability to gain access.

What happens next?

It’s important that all U.S. consumers, whether impacted or not, take some time to consider what steps they can take to protect their credit. You may or may not want to sign up for the free credit monitoring and identity theft protection that Equifax is offering to all U.S. consumers; the company recently extended the enrollment deadline to Jan. 31, 2018. One of the best things you can do to protect yourself, whether the Equifax breach impacted you or not, is placing a freeze on all three of your credit reports. You can learn all about freezing your credit by reading our new guide. Additionally, keep your eyes and ears open for future updates based on Mandiant’s findings, as it is unlikely that we’ve heard the last from the firm’s investigation. This week, you’ll want to pay attention to the testimony of former Equifax CEO Richard Smith, who is speaking in front of the House Energy and Commerce Committee. Multiple state and federal government officials have proposed new laws and regulations in the wake of this data breach, and it’s hopeful that this incident will spur actual change when it comes to corporate cybersecurity and data practices.

We’ll be following this story as it continues to develop, so bookmark our Equifax breach blog to stay up-to-date.