Consumers finding that their personal data may have been exposed in the massive Equifax cyberattack might be surprised to learn how many companies have access to different bits of their personal information.

The credit-reporting company announced last week that the personal information of over 140 million Americans could have been accessed by hackers between May and July. Why is that number so big? Equifax is one of the “Big Three” credit reporting companies operating in the U.S. TransUnion and Experian are the other big ones.

Their businesses are based on getting customer data from banks, which allows them to track things like whether you’ve been paying your mortgage, your credit card or auto loan.

They track checking and savings accounts, too, in case you’ve been bouncing checks. These companies have all the data anybody would need to steal your identity: name, Social Security number, date of birth, etc. And it’s all given to them by third parties, not the customers themselves. There’s no opting out, though you can take some steps to secure your information.

But it goes way beyond those “Big Three” companies.

There are literally hundreds of smaller consumer-reporting companies operating in the U.S. and the smaller ones are collecting information you might not expect. The Consumer Financial Protection Bureau maintains a self-reported list of the companies.

Consider Milliman IntelliScript, for example. The company collects information on the prescription drugs you buy. If you’ve ever authorized the release of your medical records to an insurance company, they might have shared them with Milliman.

Or look at Retail Equation, a company that monitors consumers’ return and exchange behavior at retail companies. Company critics say the information collected can prevent legitimate returns from being accepted. Still, fraudulent returns are a big concern for retail companies, costing them billions of dollars a year, company reports say.

The companies did not respond to requests for comment. Consumer-reporting companies are governed by the Fair Credit Reporting Act, according to the CFPB. That means consumers can request copies of their reports, though some will charge you for it.

There are consumer-reporting companies that track truckers, small business owners and payments of child support obligations. People who have payday loans are being tracked; those who buy furniture from a rent-to-own store are being tracked, too.

Unfortunately, many consumers are completely unaware. They don’t know who the companies are, what they track or that they even exist. Consumer advocates say that at the very least, companies should have to disclose the information they’re collecting.

These companies are smaller and it’s not clear how much money they can spend on cybersecurity, or how vulnerable they might be to a hack similar to the one that hit Equifax.