Been ‘Equihacked’ in the Equifax data breach?

More than 1 million Iowans are believed to be among the 143 million people whose personal information kept by the Equifax credit reporting agency was compromised by hackers.

The information, Equifax reported this month, includes Social Security numbers, birth dates, addresses and, for some, credit card numbers.

The astonishing security breach may seem too overwhelming to deal with, but experts say there are simple steps you can be taking — and should be taking — to lessen the risk that someone else will use your information to pose as you and rack up huge debts in your name.

Q: What can I do now, rather than just hope that my ID will never be stolen?

A: You can put a freeze on your credit reports to prevent someone other than you from applying for credit in your name. When you want to apply for credit yourself, you can fairly quickly thaw the freeze with a PIN number you are issued by the credit bureaus. Just be sure to keep those PIN numbers because it can be a hassle to unlock your reports without them.

Q: So how do I go about doing this?

A: You can do this by phone or online at each of the three main credit reporting agencies. To get the ball rolling, visit the relevant websites of Experian (www.experian.com/freeze); Equifax (www.freeze.equifax.com); and TransUnion (www.freeze.transunion.com). You can also call Equifax (1-800-349-9960), Experian (1-888-397-3742) or TransUnion (1-888-909-8872). But be aware that you may be placed on hold or that the websites take a long time to load because of heavy volume — a lot of other people are trying to do this.

Q: How much does it cost to place a freeze?

A: Fees vary by state. In Iowa, each of the credit agencies charges $10 to place a freeze and $12 to lift a freeze for a certain period. If you are a victim of identify theft, the freeze is free.

Q: What are the limitations of a credit freeze?

A: The credit agencies will ask for your personal information including your name, address, date of birth and Social Security number. Once you've supplied those and frozen your credit report, nobody except your existing lenders, or their debt collectors, will be able to see it, according to federal regulators. The only other entities allowed to see your credit report at this point are government agencies carrying out a search warrant or subpoena.

Q: What else can I do to protect myself?

A: Consider a credit monitoring service. The credit reporting agencies all offer them. Be aware, though, that this information usually comes to you after the fact — in other words, after an impostor already has sought credit in your name. You also should take advantage of a 2003 federal law that allows you to see your own credit report one time a year per credit agency. With three agencies, that means you can review your credit report every four months for free. Please don't confuse this with enticements from private banks and credit card companies offering 'free' reports — only as long as you buy other products from them. The only website you'll need to obtain these truly free credit reports allowed by the government is AnnualCreditReport.com.

Q: What about these ads I see on TV for companies that say they will protect my identity?

A: Consider subscribing to a reputable company. One company, LifeLock, reported it had more than 100,000 new customers in the five business days since the Equifax breach was announced. Even so, the company said it has not seen a notable increase in clients calling to report identity theft — yet.

Q: How do criminals find my personal information once it has been hacked?

A: The information is offered for sale on the 'dark web' — defined by Secureworks, a division of Dell, as a 'collection of internet forums, digital shop fronts and chat rooms that cybercriminals use to form alliances, trade tools and techniques, and sell compromised data that can include banking details, personally identifiable information and other content.' Transactions usually are conducted using bitcoin — the internet currency that's difficult to trace. While your creditworthiness may be invaluable to you, it goes for a lot less than you might think on the dark web. Verified high-limit credit cards from countries including the United States, Japan and South Korea sell for the bitcoin equivalent of about $10 to $20, according to an annual report on cybercrime by Secureworks. For scammers on a budget, there's unverified stolen credit card data, which comes out to pennies a card when bought in bulk.

The Washington Post contributed to this report.