I’m not much for hyperbole, but it’s tough to understate the seriousness of the data breach that consumer credit reporting agency Equifax (NYSE: EFX) announced on Sept. 8. 

In case you haven’t been paying attention, stop what you are doing and pay attention.

The Equifax breach is orders of magnitude worse than those announced previously by Target (NYSE: TGT) and The Home Depot (NYSE: HD). In those cases, hackers stole credit card numbers.

My immediate family was impacted by the Target hack. We had to deal with fraudulent charges, and even though it was time-consuming and stressful, we resolved the issue.

That’s not the case with the Equifax hack. In this case, what’s been done can’t be fixed. And the liability to Equifax could easily exceed the company’s worth. 

The bad guys almost certainly have your social security number. They have your birth date, your address, and your credit history. They have what they need to open credit accounts in your name, to file false tax returns in your name, and to receive government benefits in your name–for the rest of your life. 

Target issued new credit cards and ultimately had to pay a settlement. But the government isn’t going to issue you a new social security number. 

What You Need To Do

Equifax announced that the breach impacts up to 143 million Americans. That covers most adult Americans with a credit history.

I checked everyone in my family, and each person who has a credit history was listed among those impacted. You can check to see if you are among the victims here.

If the hack impacts you, Equifax is offering free credit monitoring services for a year (from the link above). The catch is you have to give them your social security number again. I know, right? But this is a level of protection against identity theft.  

You should also pull a free copy of your credit report. You can request one free copy annually from each of the three major credit reporting agencies–Equifax, TransUnion (NYSE: TRU), and Experian (OTC: EXPGY)–at AnnualCreditReport.com.

I would note which one you pulled, and then mark your calendar to retrieve from one of the two remaining agencies in four months (if you want to keep your costs to a minimum). 

For maximum protection against thieves opening up credit lines in your name, you can place a security freeze on your credit report. This usually costs money, but Equifax is waiving the fees until November 21.

Go here to request a security freeze from Equifax. It’s possible that the other reporting agencies may waive fees as well (or be forced to by Congress), but as of now, it’s going to cost you money to freeze your report at the other agencies.

Freezing your credit prevents potential creditors from accessing your credit report, in which case they won’t give a loan to criminals trying to open up credit lines in your name.

The downside is that if you need credit, you are going to have to at least temporarily unfreeze your credit at the agency used by the potential creditor. It will cost you up to $10 for each lock and unlock at each company, depending on where you live.

I will note that at the time I tried to freeze my credit report, the Equifax site was overwhelmed. I have been told that their phone lines are also jammed.

It took several attempts, but I finally succeeded. You may have better success late at night or early in the morning. 

The Cost to Equifax

What will this ultimately cost Equifax? I would argue that this incident creates an existential crisis for the company. It isn’t clear to me that they will survive.

Consider that the Target breach compromised 40 million credit and debit cards. The ultimate cost to Target was reportedly in the range of $300 million. But the Equifax breach impacted 3.5 times as many people, and the information stolen was orders of magnitude worse than credit card numbers. 

Equifax ended last week with a market capitalization of $11.2 billion, which works out to be about $78 per impacted person. Over your lifetime, this is going to cost you a lot more money and aggravation than that. 

Equifax has a negative balance sheet, meaning there is no money there to pay claims.

Over the past three years, Equifax’s pretax annual income has averaged about $700 million. That works out to be less than $5 per impacted customer. Would you settle for that?

Customers are going to flee Equifax, and many (like me) are freezing their credit reports with the company. As more people do that, fewer institutions are going to rely on Equifax for credit reports. 

Two dozen class action lawsuits have already been filed against Equifax. They may be facing the largest class action lawsuit in U.S. history. It has been widely reported that the company had the patch to fix the vulnerability two months before the hack, and failed to do so (which implies negligence). 

Trading on Equifax’s Blunder

Your first consideration in this situation needs to be protecting yourself from identity theft.

Beyond that, as an investor, you may wonder if there is an opportunity here. There are several ways to play this, from investing in Equifax’s competitors to betting that Equifax shares continue to decline. 

Let’s consider the latter. 

You could short Equifax. I am not a fan of that approach because you have limited upside and unlimited downside. It seems highly unlikely that Equifax shares will move higher anytime soon, but stranger things have happened. 

You could buy put options, which give you the right, but not the obligation, to sell shares at a defined price.

This approach provides a known downside with an extremely high upside. Equifax put option values surged following the breach, with some rising by triple digits in one or two trading sessions.

This kind of options trading is how Linda McDonough of the Profit Catalyst Alert service often generates triple-digit profits in a short amount of time.

I went for a more conservative strategy, which can quickly generate double-digit returns while limiting the downside risk. I learned this strategy from our resident options guru, Jim Fink.

Jim utilizes different spread strategies in his Options for Income service that can profit regardless of the direction of a company’s stock (or even if it doesn’t move at all).

Equifax shares quickly fell by 20% after they announced the breach, but I felt like the share price was still vulnerable to a lot more downside.

I executed a call credit spread at the beginning of last week that had a potential short-term return on risk of 51% unless the share price rallied.

Just over the course of last week this spread generated a 48% return on risk (as the share price fell by another 25% during the week). It’s not the fabulous upside you could get from buying puts, but there is more protection from losses in using this strategy.

How much further could shares fall? In the wake of the breach, all 16 analysts following Equifax either made no change to their advice or urged clients to buy more on the dips. 

Evercore ISI analyst David Togut told clients to buy aggressively, acknowledging the headline risk, but insisting there’s been no material development that would hurt the long-term earnings of the company.

I’m sorry, but this is the textbook definition of a material development that will hurt long-term earnings. Shares fell another 25% after Togut’s recommendation.

Morgan Stanley (NYSE: MS) finally broke ranks late last week and laid out the “bear case” for Equifax, cutting the price target in that scenario to $50 a share. That is 46% below last Friday’s closing price for Equifax.

Final Thoughts

I won’t be surprised if Equifax is sued into oblivion. There’s going to be a huge judgment against Equifax.

Combined with the loss of customers this incident will entail, it’s not hard to imagine that this will threaten the long-term existence of the company. 

As a consumer, you can’t afford to ignore this incident. If you choose not to act, there’s a good chance you’ll be forced to spend much more time clearing your name after your identity has been stolen.