Freezing your credit is the first step to avoid identity theft, expert says. Here’s what to know

So far, 2024 has been a huge year for data breaches.

There had already been more than 1 billion personal records compromised before the National Public Data breach that has been making headlines, according to Michael Bruemmer, head of global data breach resolution at consumer credit reporting company Experian.

National Public Data, a background check company, was alleged to have made 2.9 billion records vulnerable in a recent lawsuit. The company has said the actual number of records exposed is much lower, around 1.3 million.

The breach, however, may be bigger than the company is reporting, according to Bruemmer, based on the data Experian has mined from the breach.

National Public Data did not respond to requests for comment from CNBC.

More from Personal Finance:
‘Was my Social Security number stolen?’ Answers to top breach questions
How a ‘seriously delinquent tax debt’ can leave you without a passport
5 money moves to consider before the Federal Reserve’s rate cut

“It’s a big deal,” Bruemmer said, and it follows other recent sizeable breaches from Change Healthcare, AT&T and Ticketmaster.

Stolen data typically ends up on the dark web, where hackers will dump the information and often attempt to resell it.

The dark web is a part of the internet made up of hidden sites you can’t find through conventional search engines. Unlike credit files, which can be disputed and updated, information on the dark web can’t be brought back or deleted.

“Once it’s out there, it stays,” Bruemmer said.

To protect your data, experts say freezing your credit should be a priority.

“Freezing your credit is the single most important thing you can do when you get a data breach notice,” James E. Lee, chief operating officer at the Identity Theft Resource Center, a nonprofit working to minimize the risk of identity theft, recently told CNBC.com.

The good news is the process can be done in just minutes, Bruemmer explained.

A credit freeze will limit access to your credit report and prevent the opening of new accounts in your name, either by you or other parties.

Notably, freezing your credit is free.

What’s more, a credit freeze will last until you remove it, which can be done either temporarily or permanently.

If you want to apply for new credit — for a credit card or auto loan, for example — you will have to unfreeze your report.

“I’d recommend a freeze if you suspect that you might have been impacted by a breach, or you just want to have good identity hygiene,” Bruemmer said.

To effectively freeze your credit, you will need to complete the process at all three major credit reporting agencies — Equifax, Experian and TransUnion. This will require setting up free online accounts with each agency. You can request a freeze by phone or mail, but online is usually the fastest option, experts say.

It’s also a good idea to look at your free credit report to monitor the latest activity to ensure there are no errors, experts suggest.

Because of the size of the National Public Data breach, children’s information may also have been stolen, according to Bruemmer.

For that reason, parents should be on the lookout for signs that data about their children may have been compromised, such as unsolicited credit card offers, tax bills from the IRS or notices from bill collectors.

Whether it makes sense to freeze a child’s credit depends on whether a file on them exists, Bruemmer said.

“Most children will not have a credit file, and we don’t recommend placing a freeze on a child’s file that the bureau would have to create,” Bruemmer said.

Parents can try to pull a free credit report on their children annually at AnnualCreditReport.com. If a credit file exists, parents and children would want to freeze it, Bruemmer said.

Freezing your credit is a just a first step among the precautions you should take to protect your personal data.

Changing passwords to make sure you have unique codes for each website can help. An online password manager can help generate long and complex passwords and also store them in one place, Bruemmer said.

Two factor authentication or encryption — which requires more than one way of verifying your identity when logging into accounts — can also help prevent bad actors from gaining access to important information.

It also helps to remove personal information on social media that can be used by identity thieves, Bruemmer said.

Consumers may also consider setting up alerts on their accounts to keep them up to date on the latest activity.

Additional services may be purchased to alert individuals when their information has been posted on the dark web or monitor whether a credit file has been established for a minor, Bruemmer said.