Thanks to a 2007 state law, Equifax has no obligations to inform people who live in Oregon if their data was comprimised.
The Oregon Consumer Identity Protection Act is ironically named. OPB reports that the law has a provision to protect companies that get hacked from spending resources notifying people. Companies, including Equifax, are not required to inform people their information was hacked if the cost of doing so would exceed $250,000 or the total number people involved is greater than 350,000.
1.7 million Oregonians have been affected by Equifax hack. The Oregon Department of Justice says nearly half of all Oregonians had thier Social Security numbers, dates of birth, addresses and driver's license numbers compromised. A smaller number also had their credit card numbers stolen.
Equifax waited months to inform the public. The Oregon law does require that hacked companies do inform the media. Equifax waited at least 41 days to inform the public and some executives even sold off their shares in the company during that time. Oregon Senator Ron Wyden wants answers.
What can you do? The state Department of Justice suggests freezing your credit immediately. You can also call the state consumer protection hotline at 1-877-877-9392.