Impact of the Equifax Data Breach on Student Financial Aid
The recent Equifax Cybersecurity Incident could affect applications for federal student aid — including the Free Application for Federal Student Aid (FAFSA) and Federal PLUS Loans — for millions of students and parents.
Equifax, a credit reporting bureau, announced September 7, 2017, that hackers had breached their website’s data security. The hackers obtained personal information on approximately 143 million people, including names, date of birth, addresses and Social Security Numbers. The hackers also might have obtained driver’s license numbers and credit card numbers for 209,000 people.
The unauthorized access to Equifax data was discovered July 29, 2017 and occurred from May 13, 2017 through July 30, 2017.
Impact on Student Financial Aid
The Equifax data breach may affect the FSA ID that is used to electronically sign the FAFSA. It also might affect applications for the Federal PLUS loan.
- The compromised personal information includes all of the information needed to create a FSA ID. A FSA ID may be used to apply for federal student aid and to receive federal grants and loans.
- The U.S. Federal Trade Commission (FTC) recommends that consumers consider placing a freeze on their credit reports with each of the three credit bureaus if their personal information was impacted by the Equifax data breach.
If a student or parent places a credit freeze on their credit reports, it will affect their ability to obtain Federal Grad PLUS and Federal Parent PLUS loans. Eligibility for the Federal PLUS loan involves a review of the borrower’s credit history. Eligibility for other federal loans, such as the Federal Stafford loan, does not depend on the applicant’s credit history and will not be affected by a credit freeze.
The FAFSA and other federal student aid, such as federal grant and student employment programs, are not otherwise affected by the Equifax security breach. Applications for college admission are not affected by the Equifax security breach.
If a student or parent discovers that their personal information has been used to create a FSA ID and they do not recall creating a FSA ID, they should call the U.S. Department of Education’s Federal Student Aid Information Center at 1-800-4-FED-AID (1-800-433-3243).
According to the U.S. Department of Education, borrowers who have placed a freeze on their credit will need to temporarily lift the freeze before applying for the Federal Direct PLUS loan. The temporary release of the credit freeze will need to be maintained until the borrower is notified that their application for a Federal Direct PLUS loan has been approved.
What is Equifax Doing?
Equifax has created a free web site, equifaxsecurity2017.com, to allow consumers to determine whether their personal information is affected by the security breach. Click on the “Potential Impact” button to check whether your personal information was compromised. You will need to supply your last name and the last six digits of your Social Security Number.
Equifax is providing a year of free credit monitoring for all consumers, regardless of whether their information was affected by the data breach. When you request the free credit monitoring through the equifaxsecurity2017.com web site, it will give you a date when you can return to enroll. Consumers will be able to enroll until November 21, 2017 for free.
The credit monitoring is provided through TrustedID Premier. This service monitors credit reports on all three credit bureaus and provides the ability to lock/unlock Equifax credit reports.
What Else Can You Do?
Consumers can check their credit reports at all three credit bureaus at www.annualcreditreport.com once a year for free. When reviewing your credit reports, look for new accounts, telephone numbers and addresses that you do not recognize.
The Equifax TrustedID service provides the option of a credit freeze for Equifax credit reports only, and for just one year. It does not include a credit freeze on Experian and TransUnion credit reports.
Students and parents should consider placing a credit freeze on all their credit reports indefinitely. Your personal information has been permanently exposed by the Equifax cybersecurity incident. The risk to your credit does not end after a year.
A credit freeze prevents anyone from opening a new account in your name until you lift the credit freeze temporarily. Credit bureaus may charge a fee to place and suspend a credit freeze.
To place a credit freeze, contact each of the three credit bureaus:
Even with a credit freeze and credit monitoring, consumers must remain vigilant. A credit freeze does not prevent a hacker from making changes to your current accounts, such as changing your mailing address and PIN. If there is unusual activity in your credit card, loan, bank and brokerage accounts that you don’t recognize, contact the financial institution immediately.
If you decide against placing a credit freeze on your credit reports, consider placing a fraud alert instead. There is no charge for a fraud alert. A fraud alert does not prevent someone from opening new accounts in your name, but it does require financial institutions to take extra steps to verify your identity before opening a new account. An extended fraud alert stays on your credit report for up to seven years.
Consider filing your tax returns early. This will prevent tax refund fraud, where a hacker steals your income tax refund by filing a tax return in your name before you. Hackers will need your previous year’s adjusted gross income (AGI) in addition to your name, address and Social Security Number to file a federal income tax return in your name. Equifax has not stated whether AGI information was accessed as part of the security breach.
Consumers also should beware of the potential for medical service fraud, where someone tries to get medical services in your name. Medical professionals might increasingly ask to see government-issued photo IDs before providing services to prevent this form of fraud.