I didn't really want to have to write this, but given how many readers have asked, it seemed wise to see this one through:

Millions of people likely just received an email or snail mail notice saying they’re eligible to claim a class action payment in connection with the 2017 megabreach at consumer credit bureau Equifax. Given the high volume of reader inquiries about this, it seemed worth pointing out that while this particular offer is legit (if paltry), scammers are likely to soon capitalize on public attention to the settlement money.

https://krebsonsecurity.com/2022/12/the-equifax-breach-settlement-offer-is-real-for-now/

More important, from my view anyway, is the info at the bottom of the piece:

Equifax surpassed Wall Street’s expectations in its most recent quarterly earnings: The company reported revenues of $1.24 billion for the quarter ending September 2022.

Of course, most of those earnings come from Equifax’s continued legal ability to buy and sell eye-popping amounts of financial and personal data on U.S. consumers. As one of the three major credit bureaus, Equifax collects and packages information about your credit, salary, and employment history. It tracks how many credit cards you have, how much money you owe, and how you pay your bills. Each company creates a credit report about you, and then sells this report to businesses who are deciding whether to give you credit.

Americans currently have no legal right to opt out of this data collection and trade. But you can and also should and freeze your credit, which by the way can make your credit profile less profitable for companies like Equifax — because they make money every time some potential creditor wants a peek inside your financial life. Also, it’s probably a good idea to freeze the credit of your children and/or dependents as well. It’s free on both counts.

The Equifax Breach Settlement Offer is Real, For Now – Krebs on Security

@briankrebs What are the downsides to freezing my credit (other than needing to temporarily unfreeze it to get a new credit card or request a credit line increase)?

@jessesands Some potential employers will try to run background checks on you, which may fail to varying degrees depending on how they do that. Some people cope with that by disclosing in their application that their credit is frozen but can be thawed if an interview is being sought. Others just unfreeze their credit while applying for work, although that's a less than ideal situation in cases where it takes a long time to secure a job.

It's not just applying for new credit in the traditional sense, either, that can get stymied by a freeze. Any attempt to open an account at what could be considered a public utility -- like water, electricity, cable/satellite tv etc -- will also likely involve a credit check that requires a thaw. Don't wait till you're standing in line at the cable store (assuming those still exist).

@briankrebs Thanks! And they do exist -- I replace my cable box remote control there every 3-5 years :)

@briankrebs

"Americans currently have no legal right to opt out of this data collection and trade."

I might be wrong, but IIUC the CCPA gives Californians in particular some recourse here?

@theruss Unless a given right is exercised and affirmed by the courts, it's not really more than a piece of paper. Not sure the Calif. law has been tested here, but I hope I'm wrong.

@briankrebs Well, Experian has a web form set up:

https://www.experian.com/privacy/california-consumer-privacy-act

So they're at least pretending to comply with the law?

Privacy Policy at Experian.com

If you are a California resident, the California Consumer Privacy Act ("the CCPA") provides you with certain rights relating to the data that Experian has collected about you.

@briankrebs Disgusting that they are still in business. There should have been a restraining order preventing this after the breach.
@briankrebs It has always angered me that I have no possible way to opt out of these "services" parasitically hoarding and selling information about me.
@briankrebs I wonder who thought the image of a prepaid card bursting out of an envelope with animated confetti was a good idea to in include in the settlement emails. 
@briankrebs If you apply for Social Security, they run a credit check on you too! Wait you mean they don't know everything about me already? I didn't unfreeze my credit, I went into the Social Security office and told them my credit was frozen and it was staying that way! They processed my application in the office and I was out of there in less than 30 minutes.
Adam Fields on Twitter

“It's 2022 and I am once again asking could we please please PLEASE have a separate validated TLD for court-verified settlement website domains that all look like scams?”

Twitter

@fields @briankrebs @piebob to start, maybe at least a subdomain of the company in question?

I know the companies themselves don't run the settlement sites, but surely "please create a CNAME" isn't too much to ask?

@mkopinsky @fields @briankrebs @piebob Agree, that should be a standard best practice any time someone is communicating on behalf of their corporate client.
@briankrebs Time to start monitoring spoofy domain names...

@briankrebs For example, the following all look like they don't have any connection to Equifax itself:

equifaxbreachsettlement,com
equifaxbriefsettlement,com
equifaxbreachsettlementbreach,com
equifaxsettlements,co
eportsupport-equifax,com
equifaxbreechsettlement,com
ecuifax,co.uk
equifaxfreecreditscore,com
indianaequifaxclaim,com

...and others

Shields up!

@ColonelPanic @briankrebs a company I advise called Red Sift addresses this risk directly https://redsift.com/
Red Sift. Cyber resilience starts here.

Red Sift helps security teams understand and remediate cybersecurity risk before an incident happens. Internet-scale cybersecurity intelligence meets trusted AI.

Red Sift
@ColonelPanic @briankrebs I think it's fair to say if it's not equifax.com or it's other country domain TLDs it's not legit.
@venivv @briankrebs That certainly seems to be the case here. Sometimes the legit company does a lot of defensive registrations of these kinds, but what I'm looking at does not appear to be that. Several of those domains have close ties to a lot of other sketchy domains (not specific to Equifax).

@ColonelPanic @briankrebs If anyone is reading this I wouldn't EVER trust anything from a company if it doesn't come from their TLD. Subdomains are fine, but if you get an email from "amazon" that isn't amazon.com or <subdomain>.amazon.com or what have you; it's not legitimate.

Spam is spam. Phishing is phishing. This is just a day to day internet safety rule.

@ColonelPanic @briankrebs is Equifax going to do any verification to make sure these are legit and not scams?
@ColonelPanic @briankrebs the annoying part is that EquifaxBreachSettlement./com is legit. https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement
Equifax Data Breach Settlement

Federal Trade Commission
@aaronh @briankrebs They certainly aren't doing themselves (or the public) any favors by registering the domain in the same manner as malicious actors do (smallish registrar [Bodis], full privacy, registrar-based nameservers)
@briankrebs this happens in Germany too, but there’s only one company that provides this “service”, called Schufa. Don’t have a score with them? You’re screwed, can’t even rent an apartment.
@briankrebs my email came while I was reading you linked article. $5.21 cause I’m lazy and sent in the minimum documentation.
@briankrebs A friend got his $5.21 settlement the other day. Where *will* he spend it all?