Equifax must know whose data got compromised.  Why don't they automatically do credit monitoring and freezing for now and then contact the 134 million people to see what extra security measures they don't want.  Why make each individual go through the hell of going through the maze of authentication and choices, assuming the website works when you are on it.