Hibbett Retail, Inc. Data Breach Notice (Washington Attorney General)

What to do now

Steps that match what this notice says was exposed

Every step below is free and you do it yourself, and none of it depends on Hibbett Retail, Inc..

1. Freeze your credit — this is the one that matters. A freeze is free, it takes minutes, and it has to be done separately at all three bureaus: Equifax, Experian and TransUnion. It stops a new account being opened in your name, which is what a Social Security number in the wrong hands is for. You can lift it temporarily whenever you need credit.
2. Tell your bank before you do anything else. Account and routing details are the fastest-moving of the fields in this notice. Call the number on the back of your card rather than any number in an email, and ask them to watch the account and reissue the card.
3. Report the licence number to your state DMV. Most states will note the number as compromised, and some will issue a new one. It is the field that turns a stolen identity into a usable one in person.
4. Report the passport number. A compromised passport number can be reported to the US State Department, which will flag it. Replacing it is neither quick nor free, so report it before you need to travel.

One more, whatever was exposed: a breach notice is a favourite disguise for a phishing email. If a message about this arrives, do not use its links — go to the company’s site yourself, or call the number on your statement.