What to Do After a Data Breach

A breach is not proof that your identity was stolen

A data breach is exposure. Identity theft is misuse. One can lead to the other and often does not, because breached records are sold in bulk, sit unused for long periods, and cover far more people than any criminal has the time to target individually.

That distinction changes the response. Exposure calls for closing the specific doors that were opened and then watching. Misuse calls for a formal report, disputes, and a paper trail, which is a different process described in reporting identity theft.

It also cuts both ways. A breach notice is not a reason to panic, and it is not a reason to ignore the letter either. The Federal Trade Commission puts the useful steps in a short list: change passwords right away, turn on multifactor authentication, and check what information was exposed so you can act on that specifically.

How to read the breach notice

The single most important line in the letter is the one naming what was exposed, and it is usually not the headline. Find it before doing anything else, because every later decision depends on it.

The FTC’s Data Breach Response guide for businesses sets out what a notice should contain: a clear description of how the breach happened, what information was taken, how the information has been used if that is known, what the company has done about it, what steps people can take given the type of information exposed, and contact information. Reading the letter against that list shows quickly whether you were told enough.

Five questions to answer from the letter itself:

• What categories of data were involved? Look for the specific list, not the summary sentence. Names and email addresses are a different problem from Social Security numbers.
• Was the data encrypted? Companies say so when it was, because it materially reduces the risk.
• When did it happen, and when did they find out? A long gap means more time for the data to have circulated.
• Does it say your record specifically, or all customers? Many notices go to everyone in a database.
• What is being offered, and for how long?

Verify the notice before acting on anything inside it. Breach notices are copied by scammers, so type the company’s address into the browser yourself or call the number on your statement or card instead of using a link or phone number from the message. If the letter names a health provider or insurer, the U.S. Department of Health and Human Services publishes reported breaches affecting 500 or more individuals on its Office for Civil Rights portal, which is one way to confirm that a health related breach is real.

The first steps, whatever leaked

Three actions are worth taking on any breach notice, before working out what was specifically exposed, because they cost little and close the most common paths.

1. Change the password for that account today, and change it anywhere else you used the same one or a close variation. The FTC’s advice is exactly this: if a company tells you about a breach involving your password, immediately change the password you use with that company and on any accounts using a similar password.
2. Turn on multifactor authentication where it is offered, starting with email and banking. An authenticator app or a security key is stronger than a code by text message, though a text code is still much better than nothing.
3. Check the account’s own security settings. Sign out of other sessions, remove devices you do not recognize, and look at forwarding rules and recovery addresses on email accounts, which are a common quiet takeover.

Email deserves special attention because it is the reset point for everything else. An attacker inside an email account can request password resets on banking, shopping, and social accounts without ever touching their passwords. The Cybersecurity and Infrastructure Security Agency keeps the whole of its guidance to four actions, and two of them are strong unique passwords and multifactor authentication.

Unique passwords across accounts are the part that makes the rest work, and keeping dozens of them is what a password manager exists for. How that tool works, and the risk people worry about with it, is covered in password managers.

What to do based on what was actually exposed

Different data creates different risk, and the proportionate response follows from the category. The FTC keeps guidance organized this way at IdentityTheft.gov/databreach.

Password or login credentials

Change it there and everywhere it was reused. Assume that any account sharing that password is also exposed. If security questions were involved, change those answers too, and treat the answers as passwords rather than as facts.

Payment card number

Ask the issuer for a replacement card and turn on transaction alerts. Card fraud has the strongest protections of any payment type, so the practical job is noticing early. Watch for small test charges, which are how a stolen number gets validated before it is used for something larger.

Bank account and routing number

Call the bank, ask what it recommends for that account, and consider whether an account number change is worth the disruption. Set alerts on withdrawals and transfers. Speed of reporting matters here more than with a card: the Consumer Financial Protection Bureau explains that liability for an unauthorized electronic transfer grows the longer the bank goes unnotified, and that going more than sixty days past the statement showing the transfer can leave you responsible for the full amount of the transfers that followed.

Social Security number

This is the exposure that justifies the strongest response, because a Social Security number is what opens new accounts. Consider a credit freeze at all three nationwide bureaus. The FTC explains that a credit freeze is free, that nobody can open a new credit account in your name while it is in place, and that a fraud alert is the lighter alternative, lasting one year and renewable, with an extended alert lasting seven years. The step by step is in how to freeze your credit, and the wider tax and benefit consequences are in what to do when a Social Security number is stolen.

Tax season is the second front. The IRS offers an Identity Protection PIN, a six digit number that prevents someone else from filing a return using your Social Security number, available to anyone who can verify their identity and valid for one calendar year.

Driver’s license or state ID number

Contact the issuing agency in your state and ask what it recommends and whether the number can be flagged or changed. Rules vary by state. A license number is useful for opening accounts and for presenting to police, so it is worth a call rather than a shrug.

Health records or insurance information

Medical identity theft shows up as care you did not receive. Ask your insurer for a statement of benefits and read it, and ask providers for copies of your records if something looks wrong. Health breaches also have their own federal reporting path through the HHS Office for Civil Rights.

Name, email address, or phone number only

This is the most common category and the lowest risk on its own. It does not justify a freeze. What it does predict is a rise in targeted messages, which is the next section.

The second wave: scams that use the breach itself

A breach reliably produces a wave of messages about the breach. Some come from the company, and some come from people who read the same news article you did and know that a specific group of customers is now expecting contact.

The approaches follow a few shapes. A call from the company’s fraud department asking to verify your identity. An email offering free monitoring through a link. A message saying suspicious activity was found and money must be moved to a safe account. A phone call offering to walk you through securing your computer.

All of them are versions of one mechanism, explained in impostor scams: someone you would trust, a problem that cannot wait, and an action that cannot be undone. The rule that defeats all of them is the same. End the contact, find the number or address yourself, and call back. A genuine company will not mind, and a breach is a reason to be more careful about unexpected contact, not less.

One specific version deserves naming. If you lost money, expect someone to offer to recover it for a fee. The FTC’s page on refund and recovery scams says plainly never to pay up front for a refund or for help getting one.

The free monitoring the company offers: what it is worth

Take the free offer if it is genuinely free and requires nothing beyond enrollment, but understand what it does. Monitoring watches and alerts. It does not prevent anything, and an alert arrives after something has already happened.

The FTC’s guide for businesses advises companies to consider offering at least a year of free credit monitoring or similar support, particularly when financial information or Social Security numbers were exposed, which is why the offer shows up so consistently. It is a standard response, not an admission or a measure of severity.

Three things to check before enrolling. Whether accepting waives any legal right, which is worth reading for rather than assuming. Whether it renews into a paid subscription when the free period ends. And whether the enrollment page is the real one, reached by typing the address rather than by clicking.

A freeze does something monitoring cannot: it blocks new credit accounts rather than reporting them afterward, and the FTC confirms it is free. What paid services add beyond the free steps is covered in identity theft protection, and what alerts can and cannot see is in credit monitoring. Neither is a substitute for checking your own credit file, which the FTC notes is free weekly from each nationwide bureau at AnnualCreditReport.com, the only site authorized to fill the free reports federal law entitles you to.

What to watch for in the months afterward

Breached data can be used long after the breach, so the watching matters more than the first week of activity. What you are looking for is evidence of use, not evidence of exposure.

• Credit report entries for accounts or inquiries you do not recognize.
• Mail about accounts, loans, or cards you never applied for, including a rejection.
• Bills or collection calls for something you did not buy.
• Small unfamiliar charges on a card or bank statement.
• Login alerts, password reset emails, or multifactor prompts you did not request.
• A tax return rejected as already filed, or a notice about wages from an employer you never had.
• Losing mobile phone service for no reason, which can mean a number was ported away.
• Explanation of benefits statements listing care you did not receive.

Spread the credit checks out rather than doing all three at once, since weekly free reports make it possible to look at one bureau at a time throughout the year.

When exposure turns into something you should report

The moment anything on that list appears, the situation stops being a breach and becomes identity theft, and the process changes. Reporting it creates the record that disputes and removals depend on.

Start at IdentityTheft.gov, the FTC’s free reporting and recovery site, which produces a personal recovery plan and the report used with creditors and bureaus. If a bank, card issuer, credit report, or debt collector is involved and stops responding, a complaint to the Consumer Financial Protection Bureau is the route that most often produces a written answer, usually within fifteen days. The full sequence, including disputing accounts you never opened, is in reporting identity theft.

One honest limit. Nothing here makes a person untouchable, because the data is held by companies and the decisions about protecting it are made there. What these steps do is remove the easiest uses of the exposed data and shorten the time between something happening and someone noticing. That is the part within reach, and it is worth doing.

Data breach FAQ