This message is horribly misleading, though: if you're not in the database, by definition you haven't been part of the breach. For example, I have no credit his

This message is horribly misleading, though: if you're not in the database, by definition you haven't been part of the breach. For example, I have no credit history, but if I put my name and SSN into this site (I'm not going to, for obvious reasons) it would tell me that I was probably hacked. A better solution would have been to not put this on a website to begin with: give everyone an extra free credit report on top of their usual three yearly, and add a field to it saying whether or not you were hit. This re-uses all of the regular security precautions of that process, rather than hastily inventing a whole new procedure. I can also see a potential advantage for them: since it's more annoying to request a credit report than to put your name into a website, fewer people would find out that they were part of the mess and get angry at them, while they could say "look how generous we are, we gave everyone an extra credit report!"