22 Feb Hacked! What to do when data is stolen

Q. Last fall I received a letter from the U.S. Office of Personnel Management (OPM), whose records had been hacked, saying my information was included in the intrusion. I don’t know if it’s true. It offered me free identity theft insurance and identity restoration services for three years. When I called for more information, they said I’d have to sign up using my Social Security number, birth date, and all the information I don’t want give out. Do I need to sign up?
— Hacked

A. Sounds like your one of the 21.5 million people who had their personal information stolen in the attack against OPM.

When there’s a data hack, it’s common for the company to offer credit protection services, such as credit monitoring and identity theft insurance, to help victims protect their personal data and to catch identity fraud in the early stages.

You’re smart to be cautious when a company asks for your personal information, said consumer credit expert and bestselling author Beverly Harzog.

She said a reputable company will not ask you to send sensitive data via email or by phone.

“If you’re asked for information online, be sure you are on a secure site,” she said. “Check the URL to see if there’s an `s’ following ‘http.’ The address for a secure site will start with `https.'”

Harzog said you have the option to decline the free services offered by the provider, she said.

“But as long you check to make sure you’re on a secure site when you hand over personal data, your information is relatively safe,” she said. “I can’t say it’s totally safe, because it’s always possible that a site will get hacked. There isn’t anything online that’s absolutely safe and that’s why it’s important to stay on your toes to protect yourself.”

Whether or not you accept the offer, there are additional steps you can take to prevent fraud.

Harzog recommends you check your free credit report at AnnualCreditReport.com.

“I suggest looking at a report from one of the three bureaus every four months,” she said. “What you’re looking for is a sign that an account has been opened in your name. It’s also a good idea to check your bank accounts online to look for fraudulent purchases. You should do this daily or at least every few days.”

You can also place a fraud alert in your credit file. This tells potential lenders that they must contact you before any new accounts are opened, Harzog said. To set this up, call one of the credit bureaus and ask for an initial fraud alert on your credit report. The bureau you call must notify the others. This alert is free and lasts for 90 days. When it expires, you can renew it, she said.

A more permanent option is a credit freeze, which basically locks your credit report.

“With a fraud alert, a lender can still look at your reports as long as your identity is verified. With a freeze, your report can’t be seen unless you `unfreeze’ it,” she said. “Depending on your state, there may be a cost to freeze and unfreeze your credit report.”

To freeze your credit, you must contact each bureau separately, Harzog said. When you apply for a credit, you will be given a PIN that you can give a credit bureau that will unfreeze your report.

“A freeze is inconvenient, but it’s a good way to protect your credit when your information has been compromised,” she said.

Email your questions to .

This story was first posted in February 2016.