What's documented

The Work Number is a product of Equifax Workforce Solutions, the same company that runs one of the three major credit bureaus. It isn't new — it started in 1985 as a service from TALX Corp, which Equifax bought for $1.4 billion in 2007. What it does is simple to describe and easy to miss: every payroll cycle, employers and the payroll processors they use — ADP is a confirmed partner — send Equifax your pay and employment data automatically. Equifax's own 10-K, filed with the SEC in February 2025, states it plainly: the company "relies on payroll data received from over four million organizations," and as of December 31, 2024, The Work Number held about 188 million active employment records and 734 million total, active and historic.

That active-record figure is larger than the entire U.S. civilian labor force, which the Bureau of Labor Statistics puts at roughly 168–171 million people. Read that as what it likely is — multiple job records per person, plus contractor and gig entries — not evidence that every single working American individually has an active file. But even read conservatively, the number describes a database that reaches deep into the American workforce, not a niche product.

Higher figures circulate on Equifax's own marketing pages — sometimes "839 million records" or "4.2 to 5 million employers." Those numbers could not be independently verified against a primary filing, so this piece uses the audited 10-K figures throughout.

The mechanism — and the part with no consent step

There is no employee opt-in. Your data enters The Work Number the moment your employer signs up with a payroll provider that feeds it — a decision made by your employer's HR or finance department, not by you, and one you're rarely told about at all.

The clearest documented example of how automatic this is: on July 1, 2021, Intuit announced it would begin sharing QuickBooks and Intuit Online Payroll data — covering 1.4 million small businesses — with The Work Number starting that fall. Reporting on the announcement at the time found the opt-out for this was available only to the business owner or account admin. Individual employees had no mechanism to prevent their own payroll data from being shared at all. One QuickBooks user's reaction, quoted at the time: "Equifax gets to proactively collect all payroll data just in case they need to share it later."

Once your data is in the system, you cannot remove it. The one control available to an individual is a "data freeze," submitted through Equifax's own site or by phone or mail, which stops third parties from pulling a report on you — it does not stop your employer from continuing to feed new payroll data in, and it has to be applied separately for each employer relationship. Equifax's own materials indicate a freeze request is typically processed within a few business days, with a written confirmation mailed separately.

Who buys access

Equifax's own language, from its 10-K: "lenders, employers/background screeners, and government agencies." In practice that expands further — tenant-screening companies and landlords also draw on Work Number data, and mortgage, auto, and credit-card lenders use it routinely to verify income before approving a loan.

The government use is the part most people don't know about, and it's substantial. Per Equifax's own newsroom disclosures, 25.5 million people had a social-service eligibility check run against their Work Number record in 2024, and 20.4 million more in 2025 — for SNAP, Medicaid, TANF, Social Security, and HUD housing assistance. No evidence surfaced of direct criminal-justice or law-enforcement use; the documented government use case is benefits and eligibility administration.

The 2017 hole nobody remembers

Two separate things went wrong with The Work Number in 2016 and 2017, and they're often conflated — worth being precise about which is which.

The first was a real tax-refund fraud scheme, running from April 2016 to March 2017, that Brian Krebs documented by name: fraudsters defeated the Work Number's four-digit PIN reset process — protected only by answering a handful of knowledge-based questions, not real two-factor verification — to pull salary and W-2 tax data on employees at Northrop Grumman, Allegis Group, Saint-Gobain, Erickson Living, and the University of Louisville. Equifax's TALX payroll division, which ran the portal, was the point of failure.

The second, separate finding came in October 2017 — weeks after Equifax's unrelated credit-bureau breach had already exposed the Social Security numbers and birth dates of 147 million Americans. Krebs found the Work Number's self-service consumer portal could still be broken into with nothing more than an SSN and a date of birth. Equifax took the portal offline October 8, calling it "routine maintenance," and brought it back November 2 with unspecified fixes. Reporting around that discovery also put the platform's employer customer base — not victims of either fraud incident specifically — at roughly 70,000 organizations, including large employers like Amazon, AT&T, Facebook, Microsoft, Oracle, Twitter, and Walmart.

What regulators are actually asking right now

This is where the story is live, not historical.

Equifax's own 10-K discloses that the Consumer Financial Protection Bureau has been investigating Workforce Solutions specifically — not the broader company — since July 2023, when it issued the first of three Civil Investigative Demands over "data accuracy and dispute handling." A second CID followed in March 2024, a third in August 2024. Equifax's filing states plainly it cannot predict the outcome. This is a separate matter from a January 2025 CFPB consent order that resolved a different Equifax issue (credit-bureau dispute handling and a legacy scoring bug) — that earlier settlement did not touch Workforce Solutions or The Work Number.

Two private lawsuits allege Equifax is abusing a near-monopoly. Mortgage lenders First Financial Lending and Greystone Mortgage filed an antitrust class action in May 2024 alleging Workforce Solutions controls well over 40 percent of the payroll data required for income verification. Then-CFPB Director Rohit Chopra separately told the Mortgage Bankers Association around the same period that "Equifax's market dominance has given it pricing power that it has exercised over the past several years" — a public comment that captures the same concern, though it isn't part of the complaint itself. Separately, the St. Louis Housing Authority sued in federal court in October 2024, alleging Equifax raised Work Number fees by more than 300 percent across two increases in 2022 and 2023 — including a new $125 annual fee plus $14.99 a month — while holding a dominant market position. Equifax has pushed back on that claim specifically: in the same litigation, the company points to contract language it says gives it the "categorical right" to change prices with 30 days' notice. Equifax disclosed $5.4 million in costs tied to Workforce Solutions antitrust litigation for full-year 2025 in subsequent filings.

And on February 2, 2026, Senators Elizabeth Warren, Ron Wyden, and Bernie Sanders sent a letter to Equifax CEO Mark Begor demanding answers about the company's plans around a new federal law requiring work-hour verification for Medicaid and SNAP recipients, set to take effect January 2027 — made public the following day. Begor had told investors over the summer of 2025, according to New York Times reporting the senators cite, that the policy represented a "massive" business opportunity for Equifax. The senators' letter states that roughly half of U.S. states already rely on The Work Number for Medicaid income and work-hour verification, a reliance critics describe as bordering on a monopoly. It cites reporting that South Dakota's payments to Equifax rose from about $244,000 in 2022 to about $1.2 million in 2025 — more than a fourfold increase — and that North Carolina saw a 24 percent price increase in 2022 followed by a 36 percent increase in 2024. A North Carolina official is quoted in the letter: "We have very little leverage and recourse to back out." Equifax has launched a product called TotalVerify, marketed explicitly to help state agencies "prepare" for the new work-requirement law.

What this piece is not saying

This isn't saying Equifax broke any law with the Intuit data-sharing arrangement — payroll providers disclosing data to Equifax is standard industry practice, and the objection here is to the lack of an individual employee opt-out, not to the legality of the arrangement itself. It isn't saying the CFPB's open investigation into Workforce Solutions will find wrongdoing — an open Civil Investigative Demand is a request for information, not a finding. It isn't asserting that either pending antitrust lawsuit will succeed; both are allegations a court has not ruled on. And it isn't claiming any specific person was denied a loan or an apartment because of a Work Number error — no such case with a name attached turned up despite a real search; general claims of that kind of harm on law-firm marketing pages carry no case citations and shouldn't be read as documented incidents.

What can I do

You have a right, separate from anything else here, to see what Equifax has on you. Request your free annual Employment Data Report at theworknumber.com, or by phone at 866-222-5880. Equifax must provide it within 15 days. If something in it is wrong — a wage, a job title, an employer name, dates of employment — you can dispute it directly with Equifax and with the original source under the Fair Credit Reporting Act, the same law that governs credit-report disputes.

You can also place a data freeze at employees.theworknumber.com/data-freeze-form, by phone, or by mail. Be clear-eyed about what it does: it blocks a lender or landlord from pulling your report. It does not stop your employer from continuing to send new payroll data in, and you have to apply it separately for every employer relationship you have. There is no setting that removes you from the database or stops the automatic feed at its source — that decision belongs to your employer's payroll provider, not to you.

Why this is a BL:UF story

Nobody asks you before you're in this database. There's no form, no checkbox, no notice most people ever see — it happens because of a vendor contract your employer signed with its payroll company. And the government itself is now a growing customer of the same system, using it to decide who keeps a Medicaid card under a work-requirement law that hasn't even taken effect yet. That's the pattern this whole series keeps finding: the system that watches you isn't hiding. It's disclosed in a contract you never saw, feeding a database you never joined, that a state agency can now use to decide whether you keep your health coverage.

The Receipts

Full sourcing detail, including everything flagged as single-sourced or unverified in the original research pass, is in newsroom/research-surveillance-sweep-2026-08-24.md.