MyEquifax.com Bypasses Credit Freeze PIN
Summary: Krebs on Security reports that creating an account at Equifax's myEquifax portal required only an email address, SSN, date of birth and answers to four knowledge-based authentication questions, after which he could thaw his existing credit freeze without ever supplying the PIN Equifax had previously issued. Equifax spokesperson Nancy Bistritz-Balkan said the PIN-free process was by design, describing it as a multi-factor and layered approach, though Krebs says he encountered no multi-factor authentication in setting up or logging into the account.
Bottom line: SSN and date of birth are widely sold in the cybercrime underground, so the credentials needed to lift a freeze at myEquifax are the same data thieves already hold for most U.S. citizens - and the PIN that was supposed to be the backstop is never requested.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026