©2015 Experian Information Solutions, Inc. All rights reserved. Experian and the Experian marks used herein are trademarks or registered trademarks of Experian Information Solutions, Inc. Other product and company names mentioned herein are the trademarks of their respective owners. No part of this copyrighted work may be reproduced, modified, or distributed in any form or manner without the prior written permission of Experian. Experian Public. What should organizations tell a consumer after a data breach? Not all approaches provide the best advice

3 ©2015 Experian Information Solutions, Inc. All rights reserved. Experian Public. What happened? We are very sorry to inform you The attack started on May 21, 2014 It included SSN, address, insurance card, Passport Acme was the victim of a sophisticated intrusion We discovered the attack on June 1, 2015 We believe the information that was viewed is limited to This is not a serious event Many companies are effected by these events in our industry

4 ©2015 Experian Information Solutions, Inc. All rights reserved. Experian Public. Why it happened An administrator lost his credentials A non production server was left in production Criminals broke into our offices and had access to servers We had not implemented the new authentication process No mention Forensics is still determining the exact cause(that never comes out) This was a sophisticated attack Recent events have been attributed to terrorist states

5 ©2015 Experian Information Solutions, Inc. All rights reserved. Experian Public. How do I protect myself? It is important to take these steps to protect yourself We encourage you to enroll in 2 years of Protect My ID In addition to enrolling in the FREE services, consumers should Consumers should sign up as soon as possible No action is required at this time If you detect an issue on your own, call XXX-XXXX Consumers have the option of a number of services We are standing by if you need assistance You are automatically enrolled

6 ©2015 Experian Information Solutions, Inc. All rights reserved. Experian Public. Best Practices for ID Theft Protection Credit Report- the average time to detecting a breach is 229 days Fraud Surveillance-looking for your PII on the Dark Web Credit Monitoring-real time alerts for any changes to your file $1M insurance-for out of pocket expenses like wire fraud Customer Service-to answer ANY questions about the incident Fraud Resolution-that help fix EVERY issue no matter what or when

7 ©2015 Experian Information Solutions, Inc. All rights reserved. Experian Public. What advice to give your business leaders Communicate upfront with you(your AG) and ask for a heads up Work with law enforcement Have a pre-breach plan in place BEFORE an event Practice the plan regularly Rely on the experts(Data breach resolution, legal, forensics, PR) State the facts and be transparent to consumers Commit to a specific action plan Execute

8 ©2015 Experian Information Solutions, Inc. All rights reserved. Experian Public.