National Public Data Breach: Step-by-Step Guide to Freezing Your Credit at Experian, Equifax & TransUnion

By FoxyShield Lab Editor · Independent lab note · Updated 15 September 2026

Lab note, checked 15 September 2026. A credit freeze at Experian, Equifax, and TransUnion is free under US federal law. We completed all three on 10 September 2026 in 27 minutes using only a browser. Store the PINs offline. A freeze is not a fraud alert and not credit monitoring.

Why this dump is still a 2026 problem

National Public Data was a people-search / background-data broker. In 2024 a breach dumped a file that included names, addresses, and Social Security numbers at a scale large enough that ‘I was not a customer’ is not a defense. The file keeps circulating. New account fraud and tax-refund fraud can show up months later.

A freeze tells a bureau not to release your file to a new creditor until you thaw it. It does not close existing accounts. It does not stop someone who already has a card number. It does stop a clean new auto loan or credit card from opening in your name without a thaw.

The three-bureau sequence we actually ran

Do Experian, Equifax, and TransUnion. Skipping one leaves a hole. Use a browser you control. Do not freeze from a public PC. Have your SSN, date of birth, and current address as the bureaus know it — a mismatch is the usual delay.

We used the official freeze pages, not a ‘one form for all three’ startup. Those aggregators add another vendor to the pile. The federal rule is that each bureau must let you freeze for free.

1. Experian: open the official freeze center, pass knowledge-based questions, save the PIN to an offline password manager. Lab time: 4 minutes on 10 Sep 2026.
2. Equifax: same job, different KBA set. Lab time: 6 minutes. The PIN appeared on the confirmation page; we also waited for the email.
3. TransUnion: slowest of the three. Two KBA retries because a prior address was missing. Lab time: 11 minutes. Do not guess KBA answers; a lockout wastes a day.
4. Innovis is a fourth, smaller bureau. Optional. ChexSystems is a bank-account file, not a credit freeze; that is a different silo (see FoxyFinance if your problem is a closed checking account).
5. Record the three PINs on paper in a house safe or a password manager that is not SMS-reset only.

Freeze vs fraud alert vs monitoring

A fraud alert is weaker: creditors are supposed to take extra steps, but the file still moves. A freeze blocks the file until you thaw it with the PIN. Paid monitoring tells you after an account appears. Freeze first. Monitoring is optional and is not a freeze.

When you later apply for credit, thaw the specific bureau the lender names, for a window of days, then freeze again. Do not leave a permanent thaw because an auto dealer asked you to ‘just lift it’.

If an account already opened

Freeze anyway, then file at IdentityTheft.gov and call the creditor’s fraud desk. A freeze does not unwind a loan that already exists. Tax-season: PIN your IRS account and watch for a rejected e-file, which is often the first sign someone else filed.

We did not bind IdentityIQ or other paid monitoring on this page. If a live hop appears later, it will render as a /go/ link. Until then, the free freeze is the control.

Pros

• All three bureaus completed in 27 minutes with $0 statutory cost.
• PINs are the only secret you must store; no new app required.
• Stops most new-file underwriting without touching existing cards.

Cons

• TransUnion KBA can lock you out if a prior address is wrong.
• A freeze does not recall a dump that already leaked.
• You must thaw before a legitimate new loan, which is friction on purpose.

FAQ

Does a freeze hurt my score?

No. It restricts access to the file. It does not add a late payment.

I already have LifeLock / IdentityIQ.

Keep it if you want alerts. It is not a substitute for the three freezes.

Should I freeze ChexSystems too?

If a bank closed an account on you, yes — that is a bank file, not a credit bureau. Different form.

The 27-minute lab clock is the whole offer: three official freeze pages, three PINs, no paid middleman. Revisit the PINs when you change address.

This page is independent editorial research. It is not legal, medical, or financial advice. Partner hops, when present, use first-party /go/ routes with rel="sponsored nofollow" and are advertising, not an approval or a guarantee.