The hackers made off with the most crucial tools that identity thieves need to impersonate you. The worst-case scenario is a very real threat to millions of Americans.

If the stolen information from Equifax gets into the wrong hands, experts say data thieves can open bank accounts, lines of credit, new credit cards and even drivers’ licenses in your name. They can charge you with speeding tickets, steal your tax refund, swipe your Social Security check and prevent you from getting prescription drugs.

Recovering from identity theft could take months or even years. And no one is responsible for cleaning up your own mess but you.Equifax estimates that the hack impacts 143 million Americans. The thieves stole names, Social Security numbers, birth dates, addresses and a yet-to-be-determined number of driver’s license numbers.

The hackers also made off with 209,000 credit card numbers and 182,000 documents containing personally identifying information.

The data stolen in the Equifax hack is extremely valuable to cyberthieves. All that information packaged together sells for upwards of $30 per identity on online black markets, according to Mark Nunnikhoven, head of cloud research for cybersecurity firm Trend Micro.
“That’s the foundational identification information for U.S. consumers,” said Nunnikhoven. “It’s enough to allow cyberthieves to take over you online.”

If a cybercriminal maxed out a credit card in your name, you’ll have a very difficult time passing a credit check. Good luck getting a new cell phone, a student loan, a car or a mortgage.

If a data thief took out a prescription using your identity, that goes on your medical record. That could seriously screw up your ability to get treatment at a hospital or from your pharmacy, particularly if the fraudster obtained medicine that counteracts with yours.More sinister cybercriminals could use that data to pin crimes on you, according to Eva Velasquez, CEO of the Identity Theft Resource Center, a nonprofit that assists fraud victims.
If someone gets a driver’s license in your name and runs a red light or gets a speeding ticket, you’re on the hook. The criminal’s not going to pay it — and soon enough there could be a warrant out for your arrest.
“This is not hypothetical,” said Velasquez, who notes her organization annually helps thousands of victims of some truly complex identity fraud. In a few extreme cases, Velasquez’s organization dealt with fraud victims who discovered prisoners were serving sentences in their names.
Of the roughly 17 million reported cases of identity theft last year, about 4% was of the “criminal” variety (assigning speeding tickets, warrants and other violations to fraud victims). It’s a small, but not insignificant number. And that was before the massive Equifax hack.
“Data breaches involving Social Security numbers are not rare, but this is the largest ever recorded,” said Velasquez. “This is a unique situation because of the quality of data that was stolen along with the scale of the breach.”

“It becomes a game of ‘he said, she said,'” said Nunnikhoven. “The good news is you know all of your own history, and this breach is so well known and far reaching that if you are a victim, it should be easier than usual to fight.”

Experts say the single most effective action potential victims can take now is to freeze their credit. It can be a pain in the neck, because you’ll have to unfreeze it every time someone needs to run a credit check on you — but it should prevent most forms of identity theft spelled out in this report.

Regular credit monitoring is also painful but important. And online resources, including the Identity Theft Resource Center, provide excellent tools to discover how to defend yourself against identity theft. The ITRC is funded by credit protection companies, such as Experian and LifeLock, but also by the U.S. Justice Department.The truth may be on victims’ sides, but it can take a very long time and hard work for victims to clear their names.
“For most of respondents, their incidents are not yet cleared when we talk to them a year later,” said Velasquez.

The earlier you get a jump on cleaning up the mess the better. But most people don’t find out about fraud until it becomes a roadblock for them, according to Velasquez. That means you could have to provide months or years of information to clear your name.

Equifax already waited six weeks to tell the world about the Equifax data breach — that gave hackers a six-week jump on all of us, Nunnikhoven noted.