If you’re concerned about risks to your credit, because of this incident or others, here are steps you can take:
Credit monitoring. Commercial services can monitor your credit reports for activity and alert you to changes. SAIC offers this free for a year to any Tricare patient whose personal information was in the stolen data. Others considering purchasing credit monitoring should check out the service with the Better Business Bureau, state consumer protection agency and state attorney general.
Fraud alerts. These serve as red flags for anyone looking at your credit file with the credit reporting agencies, signaling lenders and others that you may have been a victim of suspicious activity. The lender should verify with you that you have authorized any activity, such as opening a new account in your name, increasing the credit limit on existing accounts, or obtaining a new card on an existing account.
You can place an initial fraud alert for 90 days. Make sure these agencies have your current contact information. Those called to military duty away from their usual duty station may be eligible for an active-duty alert, which stays in your file for a year and provides protections similar to the initial 90-day fraud alert. It also removes your name from pre-screened credit offers for two years. If you have evidence of fraud or are the victim of identity theft, you can place an extended fraud alert in your files that remains for seven years.
Credit freeze, or security freeze. This locks down your credit files — potential creditors and others won’t be able to access your credit report unless you temporarily lift the freeze. Credit freeze laws vary from state to state. You can find more information about state policies here.
A military spouse has raised good questions about protecting his family from identity theft following the recent theft of many military families' private information.
After an employee of Tricare contractor SAIC reported that tapes containing the information of 4.9 million patients had been stolen in September, Tricare Management Activity directed SAIC to provide one year of credit monitoring and restoration services to patients who express concern about their credit. A letter was sent to each patient whose information was included in the stolen data.
Among those affected was the Ng-Baumhackl family. Navy husband Mitja Ng-Baumhackl is concerned because his wife is deployed to Afghanistan and his family is living in Singapore, making it difficult to closely monitor their credit, even with SAIC's credit-monitoring services, because of the time difference and other logistical concerns.
A monitoring service doesn't keep a thief from getting credit in your name; it lets you know about suspicious activity. But Ng-Baumhackl wants more drastic measures for his accounts — a credit freeze, also known as a security freeze.
A security freeze locks up your file with credit reporting agencies and prevents it from being reported to lenders and other third parties unless you give permission using a secret code. The Federal Trade Commission says it's unlikely that an identity thief would be able to open new accounts in your name under such a freeze.
The national credit reporting agencies charge fees for this, depending on the state you live in. States set the fees for placing the credit freeze, and again each time you temporarily unlock the freeze and when you remove it. But if you are the victim of identity theft, many states allow you to get this free, often requiring a police report as proof.
Rod Griffin, a spokesman for Experian, one of the national credit reporting agencies, said although Ng-Baumhackl hasn't been the victim of identity theft, his situation would qualify for the free service if a police report was available.
If you're living overseas and your address is a military base, Experian will work with you based on fees and policies set by the state of your last U.S. address in your credit file, Griffin said. But if you live off base overseas, he said, Experian requires more documentation of your identity as a safeguard. For military folks living in the U.S., the laws of the state you're living in apply.
Ng-Baumhackl has been unable to get a police report from SAIC or information about where it reported the theft. It would be simple for SAIC to provide a statement from law enforcement authorities to beneficiaries, he said, paving the way to freeze the accounts at no cost.
Ng-Baumhackl suggested that a simple statement could be provided without naming the employee who reported the theft.
SAIC spokesman Vernon Guidry said the company has decided not to make the police report available "given the totality of the circumstances."
Tricare spokesman Austin Camacho said it's important to remember that there is no evidence that any of the stolen data has been misused.
Experian's Griffin said data breaches don't necessarily lead to identity theft, and his advice for most people is an initial fraud alert, plus careful monitoring of credit reports. He said a credit freeze is an extreme step, especially if you think you might apply for credit or make a large purchase in the near future.
But in situations similar to the Ng-Baumhackl's, it could make sense to ask for a credit freeze, he said.
"Since we have no big purchases on the horizon, in our situation a security freeze makes sense and is not much of a hassle," Ng-Baumhackl said. "For those willing to set up a fraud alert, a security freeze takes about the same amount of time. Most importantly, it's the only measure to truly protect [yourself] instead of leaving someone to clean up a big mess later, even with SAIC's identity theft assistance contractor."