Got a Data Breach Notice? What to Do First, Next and Later

Every US state has a data breach notification law, so if a company loses your personal information, you will often hear about it by letter or email. A notice does not mean someone has used your data. It means your information is somewhere it should not be, and a few targeted steps now make it much harder to misuse. What you should do depends almost entirely on what leaked.

Step 1: Read the notice carefully

Breach notices tend to follow a similar structure. Look for:

• What happened and when. The date range of the breach matters if you need to check old statements.
• What data was involved. Names and emails are a different problem from Social Security numbers or passwords.
• What the company is offering. Often free credit monitoring or identity protection for a set period, with an enrollment code and deadline.
• How to contact them. A dedicated phone line or website.

Then verify it. Scammers send fake breach notices to harvest the very data they claim was stolen. Do not use links or phone numbers from the message; go to the company's site directly and look for an official statement. Many state attorneys general also publish the breach notices filed with them.

Step 2: Match your response to what leaked

Most breaches involve several of these at once, so work down the list.

Step 3: Fix passwords and logins

If a password was involved, change it immediately, and change it anywhere else you used the same or a similar password. Criminals routinely try leaked email-and-password pairs on banks, shopping sites and email accounts, an attack called credential stuffing.

• Use a unique password for every account. A password manager makes this practical.
• Turn on two-factor authentication, preferring an authenticator app, a passkey or a security key over text-message codes. Our guide on setting up two-factor authentication walks through each option.
• Secure your email first. Your email account can reset almost everything else, so it deserves your strongest protection.
• Check breach-lookup services. Free sites such as Have I Been Pwned let you see which known breaches include your email address.

Step 4: Freeze your credit

If your Social Security number was exposed, a security freeze (credit freeze) is the single most effective step. It stops lenders from opening new credit in your name because they cannot pull your report.

• It is free. Federal law requires the three nationwide credit bureaus, Equifax, Experian and TransUnion, to place and lift freezes at no charge.
• You must freeze at each bureau separately. A freeze at one does not apply to the others.
• It does not affect your score or existing accounts.
• You can lift it temporarily when you apply for a loan, credit card or apartment, then refreeze.
• Keep your login or PIN safe, since you will need it to lift the freeze.

You can also freeze credit for children and for adults you are a guardian for, which is worth considering if a breach involved family members' Social Security numbers.

Fraud alerts and monitoring: useful extras

A fraud alert is lighter than a freeze. It tells lenders to take extra steps to verify your identity before opening credit. You only need to contact one bureau, which must notify the other two. An initial alert lasts one year; identity theft victims can get an extended alert.

Credit monitoring, often offered free in breach letters, alerts you when something changes on your credit report. It is a good early-warning system but does not prevent anything on its own. Enroll if it is offered, and keep the freeze in place.

You can also check your credit reports directly at AnnualCreditReport.com, the official site for free reports from all three bureaus. Look for accounts, addresses or inquiries you do not recognize.

Step 5: Protect your taxes and benefits

A stolen Social Security number can be used to file a fraudulent tax return in your name and claim your refund.

• Get an IRS Identity Protection PIN. The IRS offers an IP PIN to anyone who can verify their identity online. It is a six-digit number that must be on your federal return, which blocks someone else from filing with your Social Security number.
• Create your my Social Security account at the Social Security Administration's website before a fraudster does, and review your earnings record.
• Watch for IRS notices about returns you did not file, and respond promptly through official channels.

Step 6: Watch for the scams that follow

Big breaches generate follow-up fraud. Criminals know which company you use and may know your address or account details, which makes their messages convincing.

• Fake "refund" or "compensation" calls asking you to verify your identity.
• Phishing emails that look like they come from the breached company.
• Fake class-action settlement sites. Real settlements are administered through official settlement websites; check details through court records or news coverage from established outlets.
• Callers claiming to be your bank's fraud team who ask you to read back a code or move money. Banks do not ask for either.

When in doubt, hang up and call the number on the back of your card or on the company's official website.

If your identity is actually misused

If you find accounts you did not open, charges you did not make or a tax return filed in your name, go to IdentityTheft.gov, the Federal Trade Commission's site. It creates an identity theft report and a personalized recovery plan with prefilled letters to send to creditors and the credit bureaus. Report the fraud to the company where it happened, and consider a police report if a creditor asks for one.

Keep notes: dates, who you spoke to, reference numbers and copies of letters. Identity recovery can take a while, and a clear paper trail speeds it up.

The short version

1. Verify the notice through the company's official website.
2. Change exposed passwords and turn on two-factor authentication.
3. If your Social Security number leaked, freeze your credit at all three bureaus.
4. Enroll in any free monitoring offered, and check your reports.
5. Get an IRS IP PIN.
6. Treat every follow-up call, text and email with suspicion.

Most people who get a breach notice never become identity theft victims, and these steps are a big reason why.