TFPU - EQUIFAX FAIL (YOUR'E WELCOME?)

The credit reporting agency Equifax said Thursday that hackers gained access to sensitive personal data — Social Security numbers, birth dates and home addresses — for up to 143 million Americans, a major cybersecurity breach at a firm that serves as one of the three major clearinghouses for Americans’ credit histories.

Equifax said the breach began in May and continued until it was discovered in late July. It said hackers exploited a “website application vulnerability” and obtained personal data about British and Canadian consumers as well as Americans. Social Security numbers and birth dates are particularly sensitive data, giving those who possess them the ingredients for identity fraud and other crimes.

Most states do not put a timeline on how quickly companies must notify customers after discovering a breach, though eight do:

Connecticut, Florida, Maine, New Mexico, Ohio, Rhode Island, Tennessee and Vermont.

The timelines range from 30 days to 90 days. (California sets a timeline, but just for notice on breaches of medical information.)

Many companies and lawmakers have called for a national data breach notification law to provide a baseline standard for when customers should learn about hacks to help streamline the process.

Equifax has changed its terms of service to note that users checking to see if they've been affected by a massive breach it endured are not waiving their right to file a class action lawsuit.