Attorney General Mark R. Herring is warning that 4,045,576 Virginia consumers could be impacted by a massive data breach from Equifax Inc., which is one of the country’s three major credit bureau monitoring agencies.

According to a data breach notification from Equifax received last week by Attorney General Herring, hackers have exploited a vulnerability in Equifax’s website application to gain access to files potentially impacting 143 million consumers nationwide, including more than four million in Virginia.

Attorney General Herring and his team are also aware of problematic language reportedly included in the terms of the monitoring program setup by Equifax, and are working with fellow state attorneys general to promptly address the problematic terms with Equifax.

“This data breach is breathtaking in scope and severity, and is especially troubling considering the source,” said Herring. “More than four million Virginians could be impacted by Equifax’s data breach, and all consumers should exercise caution in the weeks and months to come to protect their personal information and their wallets.

“I urge anyone who thinks they’ve been impacted to keep a close eye on their finances, and if anyone believes they have been a victim of a successful identity theft or financial crime in connection with this breach, to contact my Consumer Protection Section. It may be some time before the extent of the damage is known, and we will be sure to keep Virginians updated during a rapidly developing situation. ”

Equifax claims that hackers primarily accessed names, Social Security numbers, birth dates and addresses, though they also may have gained access to driver’s license numbers, credit card numbers and dispute documents containing personal information.

Those impacted are now at an increased threat of identity theft. Virginians can access Herring’s Consumer Protection Section’s Identity Theft Guide online for information on how to protect personal information and what to do if you think you’ve been the victim of an identity theft.

Herring urges all consumers to exercise caution and monitor their bank and credit card accounts for unauthorized charges, monitor credit reports, and change or strengthen passwords.

Virginians can visit https://www.equifaxsecurity2017.com, a website established by Equifax, for more information on the breach and ways to help protect themselves against misuse of hacked information.

However, consumers should closely and carefully review any terms and conditions prior to submitting any information as state attorneys general work to address the following problematic language that is reportedly included in the terms.

AGREEMENT TO RESOLVE ALL DISPUTES BY BINDING INDIVIDUAL ARBITRATION. PLEASE READ THIS ENTIRE SECTION CAREFULLY BECAUSE IT AFFECTS YOUR LEGAL RIGHTS BY REQUIRING ARBITRATION OF DISPUTES (EXCEPT AS SET FORTH BELOW) AND A WAIVER OF THE ABILITY TO BRING OR PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR OTHER REPRESENTATIVE ACTION. ARBITRATION PROVIDES A QUICK AND COST EFFECTIVE MECHANISM FOR RESOLVING DISPUTES, BUT YOU SHOULD BE AWARE THAT IT ALSO LIMITS YOUR RIGHTS TO DISCOVERY AND APPEAL.

Herring is currently working with fellow state attorneys general to remove this language from the Equifax terms because it could potentially lead consumers to waive their right to sue Equifax if they visit the site just to see if their data was compromised.

Equifax also reports that it is offering one year of credit file monitoring and identity theft protection for all U.S. consumers, whether or not the consumers are among those impacted by this breach. It includes credit monitoring for Equifax, Experian and TransUnion; copies of and the ability to lock Equifax credit reports; identity theft insurance and online scanning for Social Security numbers.