Sony Pictures Hack: How to Avoid Identity Theft

Senior editor, security and privacy
Updated

Seth Rogen and James Franco in a detail from the theatrical poster of the \Seth Rogen and James Franco in a detail from the theatrical poster of the "The Interview." Credit: Sony Pictures

In late November, as has been widely reported, Sony Pictures Entertainment suffered a devastating network intrusion at the hands of still-unknown attackers.

The corporate computer network of the entire company, a division of the larger Sony conglomerate, has been shut down since Nov. 24. Four unreleased Sony movies have been posted on file-sharing sites.

Worst of all, intimate personal details about almost every one of Sony Pictures' 6,800 employees, including full names, birth dates, medical data, Social Security numbers, salaries and company-issued credit cards are up for grabs on the Internet. [Update: The names and Social Security numbers of about 40,000 former employees and freelancers, including prominent actors and directors, was also released.]

MORE: What to Do If Your Social Security Number Is Stolen

Speculation over who hacked Sony Pictures runs from North Koreans angry over an upcoming Seth Rogen comedy to a disgruntled former employee out for revenge. The only thing that's clear is that Sony Pictures employees are at dire risk of identity theft. If you've worked for Sony Pictures — or even if you haven't — here's what you need to do if you suspect your data has fallen into the wrong hands.

Call a credit-reporting agency to place a credit alert, also called a fraud alert, on your file. While the alert is active, you will be notified of every request made for your credit information.

In the United States, the three major agencies are Equifax, Experian or TransUnion, and the one you contact will alert the others. In Canada, the agencies are Equifax and TransUnion. Fraud alerts can be renewed every 90 days, indefinitely.

Request a credit report from at least one of the credit agencies. U.S. residents are entitled to one free report from each agency per year, which can be obtained immediately online; it's best to stagger them so you get a fresh report every four months.

In Canada, a free credit report by mail can be requested at any time, but you'll have to wait a few weeks for it to arrive. Alternately, you can pay about $15 for an immediate online version.

Bear in mind that anyone who has your full name, date of birth and Social Security/Social Insurance number will be able to open an account in your name any time over the next few decades. You'll want to keep up the free-credit-report cycle for years to come.

File your tax returns in January. Criminals use stolen names and Social Security numbers to file false tax returns and claim other people's tax refunds. Beat them to it by filing your returns as early as possible.

Consider subscribing to an identity-protection service. It's worth paying $15-$30 per month if you know your identity is at grave risk of being stolen. Some identity-protection services monitor activities beyond the purview of credit-reporting agencies, such as DMV records, property transfers and insurance filings.

Consider instituting a credit freeze, also known as a security freeze. This is a drastic step, as no one will be able to access your credit information without your explicit permission. It will take much longer to get credit of any kind, even for such mundane activities as getting a new cellphone or cable-TV contract.

You'll have to contact each credit-reporting agency individually to institute a freeze, and, unless you have a police report stating that you were indeed a victim of identity theft (not just that you suspect you might be), you'll probably have to pay nominal fees.

Paul Wagenseil is a senior editor at Tom's Guide focused on security and gaming. Follow him at @snd_wagenseilFollow Tom's Guide at @tomsguide, on Facebook and on Google+.