Return to: Page Section Navigation

Cybersecurity Incident & Important Consumer Information

Cybersecurity incident overview

What happened?
On September 7, 2017 Equifax Inc., our U.S. parent company, announced a cybersecurity incident. On October 2, we announced we completed our investigation. With respect to potentially impacted Canadian citizens, we shared in a news release on October 2 and with customers the same week that personal information of approximately 8,000 Canadian consumers was impacted. In addition, it was determined that some of the consumers with affected credit cards announced in the company’s initial statement may be Canadian. The company previously had stated that there may have been up to 100,000 Canadian citizens impacted, but that number was preliminary and did not materialize.
When did the company learn of this incident?
We learned of this incident on July 29, 2017, and acted immediately to stop the intrusion and conduct a forensic review. During that review, we identified unauthorized access to limited personal information for certain Canadian consumers.
Over what time period did the unauthorized access occur?
Based on our investigation, the unauthorized access occurred from mid-May through July 2017.
What information is impacted?
The potentially impacted information may include names, addresses, Social Insurance Numbers and, in limited cases, credit card numbers. Other potentially impacted information includes username and password, and secret question/secret answer, which we believe are several years old and were login credentials for use of our direct-to-consumer website.
Who and how many people are affected?
With respect to potentially impacted Canadian citizens, it was determined that personal information of approximately 8,000 Canadian consumers was impacted. In addition, it was also determined that some of the consumers with affected credit cards announced in company’s initial statement are also Canadian. The company previously had stated that there may have been up to 100,000 Canadian citizens impacted, but that number was preliminary and did not materialize.
I have heard that this impacted far more Canadian consumers than the 8,000 you are contacting directly. Were more Canadian consumers impacted in some other way?
With respect to potentially impacted Canadian citizens, it was determined that personal information of approximately 8,000 Canadian consumers was impacted. In addition, it was also determined that some of the consumers with affected credit cards announced in company’s initial statement are also Canadian. The company previously had stated that there may have been up to 100,000 Canadian citizens impacted, but that number was preliminary and did not materialize.
Are Equifax’s core consumer or commercial credit reporting databases impacted?
Equifax Canada can confirm that Canadian systems are not affected. We have found no evidence of unauthorized activity on Equifax’s core consumer or commercial credit reporting databases. Equifax Canada systems and platforms are entirely separated from those impacted by the Equifax Inc. cybersecurity incident reported in the U.S.
Is the issue contained?
Yes, this issue has been contained and Equifax is in the process of notifying impacted Canadians by mail and offering them free credit monitoring and identity theft protection.
What are you doing to prevent this from happening again?
In addition to credit monitoring and identity protection offered directly to consumers, Equifax Canada continues to invest heavily in our infrastructure, including significant recent efforts to further secure our data from unauthorized access.
Why am I learning about this incident through the media? Why didn't Equifax notify me directly?
Equifax issued a statement and a national press release to notify Canadian consumers of this incident. We are reaching out directly to impacted consumers by mail and continue to work closely with the Office of the Privacy Commissioner of Canada (OPC), privacy commissioners in Alberta, British Columbia, and Quebec, and consumer reporting registrars from Ontario, Alberta, and Saskatchewan.

How to find out if you're impacted

What steps should I immediately take?
Equifax is in the process of notifying impacted Canadians by mail. For impacted Canadians, we are providing complimentary credit monitoring and identity theft protection for 12 months. Additionally, Canadian consumers, regardless of whether they are impacted, can call the Equifax Consumer Call Centre and have a fraud alert put on their account free of charge for up to six years.
How do I find out if my data was impacted?
Our investigation is now complete and Equifax is notifying impacted Canadians by mail and offering them free credit monitoring and identity theft protection.
Is there any way for me to see if I have been impacted online?
Equifax is reaching out directly to impacted consumers by mail. While Equifax Canada will only be directly notifying impacted consumers by mail, Canadians who have reason to believe their information has been breached, but have not received a letter, can contact the Equifax Consumer Call Centre at 1-866-699-5712.
When will impacted consumers receive their letters?
Equifax Canada began mailing notification letters on Oct 13, 2017.
How will I know if my credit card is affected?
Consumers should continue to monitor their credit cards for fraudulent activity and contact their financial institution or card provider directly if they notice suspicious activity.
If I am impacted, why am I being notified by mail, and not by phone or email?
We have chosen to notify impacted Canadians by mail to help protect their privacy. It’s important to note that no Equifax representative will contact impacted Canadians by phone or email. Please do not provide personal information to anyone who contacts you by phone or email and claims to be an Equifax representative.

Next steps for those impacted

If I am impacted, what will Equifax do to protect me?
Equifax continues to work with the Office of the Privacy Commissioner of Canada (OPC) and is in the process of notifying impacted Canadians by mail and outlining the next steps they can take. For impacted Canadians, we are providing complimentary credit monitoring and identity theft protection for 12 months. Although only a limited number of Canadians have been impacted, Equifax reminds Canadian consumers to be vigilant in reviewing their account statements and credit reports and that they immediately report any unauthorized activity to the financial institutions. We also recommend that they monitor their personal information to avoid identity theft as well as information about fraud alerts and other services available to Canadian consumers.
What if I am impacted but I do not receive a direct notice from Equifax?
Equifax is directly contacting by mail all impacted Canadians. Should you not be contacted, but still have questions, please contact us at EquifaxCanadaInquiry@equifax.com or call 1-866-699-5712.
My data was impacted. How long do I have to sign up for your services?
Impacted consumers will receive instructions on how to sign up and will have until January 31, 2018 to register.
Does the product start on the notification date or on the enrollment date?
For impacted Canadians, the product starts on the date that you activate your subscription and will be complimentary for one year.
If I am already a customer, what happens to my current subscription?
If you are an impacted Canadian consumer who already has a similar Equifax subscription, we will extend your subscription for 12 months at no charge.
What are the features offered in this monitoring service?
For impacted Canadians, we will be providing complimentary credit monitoring and identity theft protection for 12 months. Additionally, Canadian consumers, regardless of whether they are impacted, can call the Equifax Consumer Call Centre and have a fraud alert put on their account free of charge.
My bank notified me that my account has been improperly accessed. What should I do?
If you believe that your bank account has been compromised, please work with your local financial institution and local law enforcement agencies.

Call Centre

It's taking me a long time to get through to the call centre. Why is this?
We are experiencing high call volumes, and we are working diligently to respond to all consumers. In the meantime, if you have been impacted, we will notify you directly by mail. We also recommend that you contact  EquifaxCanadaInquiry@equifax.com.

Return to: Page Section Navigation

Certain conditions, exclusions and limitations apply to all products, for details please refer to the Terms of Use and your product documentation.