More than half a million Mainers are among the 143 million Americans whose personal information was affected by a data hack at credit reporting giant Equifax, the state’s credit regulatory agency said Friday.

Approximately 524,517 people in the state potentially had their names, Social Security numbers, addresses, dates of birth and in some instances, driver’s license numbers, accessed by criminals.

That figure represents nearly half of the adults in the state, according to recent data from the U.S. Census Bureau. The breach began in May and was not discovered until July, Equifax said in a statement. It is believed to be the largest data breach in history involving Social Security numbers.

David Leach, a principal examiner at the Maine Bureau of Consumer Credit Protection, said Equifax has not yet identified the half-million residents to his agency, and he was unsure whether the credit reporting company would reach out to those whose data was accessed illegally.

Leach recommended Mainers contact each of the three major credit bureaus to lock their credit report, a process that allows only the true credit-holder to give access to third parties to run a credit report. In theory, this would keep a thief from using a stolen Social Security number to borrow money or secure credit, which usually require a credit report.

“It’s putting a deadbolt lock on your credit files,” said Leach, who said locking down one’s credit is useful even if someone’s data was not affected by this most recent hack. “The message I would impart is this is not the last data breach.”

In addition to the personal identifying information, Equifax also lost control of 209,000 consumers’ credit card numbers. Leach said Equifax has not yet indicated how many Maine residents are part of this group.

Chris Pinkham, president of the Maine Bankers Association, said he has not yet received guidance or communication from federal regulators regarding the massive data breach.

Similarly, Equifax executives have not released details of how the breach occurred.

Pinkham said it may still be too early in the investigative process following the breach for guidance from regulators. Companies who experience intrusions such as these typically prioritize their work with law enforcement to catch perpetrators before communicating details to the public.

“We rely on the three credit reporting agencies to not only be the collectors of the data, but the protectors of the data. It’s important, not only in the banking world, but in other industries,” Pinkham said. “I think it raises some serious questions about the security at that company.”

Already, industry watchdogs and public officials are raising questions about the company’s response to the breach.

Equifax is offering one year of free credit monitoring, but in exchange consumers must agree to a terms of service contract that strips them of the right to later bring a lawsuit against Equifax or join a class-action suit. Consumers who agree to the terms are bound to enter into arbitration, a process that can hinder their ability to build a favorable case.

New York State Attorney General Eric Schneiderman tweeted Friday that the arbitration language is “unacceptable and unenforceable,” and that his staff would demand the company remove the language.

Matt Byrne can be contacted at 791-6303 or at:

mbyrne@pressherald.com

Twitter: MattByrnePPH