During the five weeks after hackers stole 143 million Americans’ data from Equifax, and while its execs were selling off their stock by the millions, the company sprang into action, producing an insecure site for checking whether your own data was breached that produces the same output no matter what name and SSN you input.
But though the website has a broken cryptographic certificate and is running an unpatched stock version of WordPress, it’s not wholly useless: the site does subject you to a “license agreement” that makes you give up your right to sue Equifax (the company claims that this clause was not intended to limit your ability to sue it over the mass breach).
Like many forced arbitration clauses, the Equifax EULA makes a nod towards equitable treatment: after clicking it, you have 30 days to inform the company, in writing, that you do not agree to arbitration.
Paul Butler, “a quant in New York City,” has put up a website called “Unarbitrate” that has a form you can fill in to produce a printable letter to this effect. He’s even offering to print and mail your letter for you. He promises not to retain or share your data.
