What To Do After a Data Breach: A Step-by-Step Guide

If you just got a data breach notice in the mail, an email, or a text, here is the order that actually protects you: confirm the notice is real, figure out exactly what was exposed, freeze your credit at all three bureaus for free, and take the free monitoring the notice offers. Everything else, watching your accounts, changing passwords, checking for a settlement, comes after those first moves. This guide walks through each step in the order that matters most.

1. Verify the Notice Is Real Before You Click Anything

Fake data breach notices are a well-documented attack on their own. Scammers copy a real company's breach announcement, add a link or phone number they control, and count on the panic of "your data was exposed" to get you to hand over exactly the information a real breach did not expose yet, your Social Security number, your bank login, or your card number "to verify your identity."

Before you do anything else, confirm the notice came from the company it claims to. Do not click the link in the email or text and do not call the phone number printed in the notice. Instead, open a new browser tab and type the company's website address yourself, or call a number you already have, from a billing statement, the back of your card, or a prior receipt. A legitimate breach notice will match what the company posts on its own official site.

Nobody legitimate cold-calls, texts, or emails you asking for your full Social Security number, a bank password, or a card's security code to "confirm" you were affected by a breach. The FTC's guidance on phishing scams covers the exact tells: urgency, a link that does not quite match the real domain, and a request for information a real company would never need from you to send a notice it already mailed you.

2. Work Out Exactly What Was Exposed

Read the notice again and look for the specific data types listed. A breach notice is required to say what categories of information were involved, and the right response is different for each one. Treating a password breach the same way you treat a Social Security number breach means you either overreact and waste time, or underreact and leave a real exposure unaddressed.

Social Security number, driver's license, or other government ID number exposed. This is the highest-severity exposure because it can be used to open new credit in your name for years. Freeze your credit at all three bureaus (step 3, below) and watch for the identity-theft warning signs covered in step 7.

Password or login credentials exposed. Change that password immediately, on the breached site and on every other account where you reused it or a close variation of it. This matters even if the breached account seems unimportant, because attackers test stolen credentials against banks, email, and shopping accounts automatically.

Card or bank account number exposed. Call the number on the back of the physical card, not a number from the notice, and ask for the card to be reissued. Card fraud is the easiest of these to reverse; federal protections and card-network rules mean you are very unlikely to be held liable for charges you report, but you still want a new card number issued promptly.

Email address, phone number, or mailing address only. This is lower severity on its own, but it fuels the next round of phishing, since scammers now know a real email tied to a real breach and can send a more convincing follow-up attack. Treat unexpected messages referencing the breach with extra suspicion for months afterward.

3. Freeze Your Credit at All Three Bureaus. It Is Free by Federal Law.

If your Social Security number was in the exposed data, this is the single highest-value action on this entire list. A credit freeze blocks lenders from pulling your credit file to open a new account, which means an identity thief who has your Social Security number still cannot open a credit card or loan in your name.

Since a federal law that took effect in 2018, credit freezes are free to place and free to lift, at every one of the three nationwide bureaus, Equifax, Experian, and TransUnion, according to the FTC's guidance on credit freezes and fraud alerts. You have to freeze all three separately, since a freeze at one bureau does not cover the others, and a freeze does not affect your credit score or stop you from using existing accounts. For the exact steps at each bureau, see our step-by-step credit freeze guide.

A credit freeze is stronger than a fraud alert, which only asks lenders to verify your identity before opening an account rather than blocking the pull outright. The Consumer Financial Protection Bureau recommends a freeze specifically when a Social Security number has been exposed, precisely the situation a data breach notice describes.

4. Enroll in the Free Monitoring the Breach Notice Offers

Most companies that experience a breach involving sensitive data offer affected people a period of free credit monitoring or identity theft protection, often 12 to 24 months. It is already paid for as part of the company's breach response. There is close to no downside to enrolling, even if you also plan to freeze your credit.

Check the notice for an enrollment code and a deadline. These offers are usually time-limited, so if you set the notice aside "for later," put a reminder on your calendar. Note the date the free monitoring ends, because that date, not the day you got the notice, is when you should reassess whether you want ongoing protection.

5. Change Passwords and Turn On Two-Factor Authentication

If a password was exposed, or you are not sure whether one was, change it, and change it on every other account where you used the same or a similar password. This is the step people skip most often, and it is the reason one breach cascades into several: attackers buy lists of stolen username-and-password pairs and try them automatically against banks, email providers, and retailers, a technique called credential stuffing that only works because so many people reuse passwords.

Turn on two-factor authentication wherever it is offered, starting with your email account, since email is usually the account a thief uses to reset everything else. The FTC explains how two-factor authentication works: even if an attacker has your password from a breach, a second factor, a code from an app or a security key, stops them from logging in with the password alone.

6. Watch Your Accounts and Your Credit Reports

Review your bank and card statements for charges you do not recognize, even small ones, since fraudsters sometimes test a stolen card with a tiny charge before a larger one. Set up transaction alerts through your bank's app if you have not already.

Pull your credit reports through AnnualCreditReport.com, the site the three bureaus are required to provide free reports through by federal law. All three bureaus now let you check your report from each of them once a week at no cost, according to the FTC, so there is no reason to pay a third party for a credit report or a credit score check. Look for accounts you did not open, inquiries you do not recognize, and an address you never lived at.

7. If Something Already Happened, Use IdentityTheft.gov

If you already see a new account you did not open, a collection notice for a debt that is not yours, or a tax return rejected because someone already filed under your Social Security number, go to IdentityTheft.gov, the FTC's free recovery site.

IdentityTheft.gov asks what happened and builds a personalized, step-by-step recovery plan, and it pre-fills the letters, affidavits, and dispute forms you need to send to credit bureaus, the businesses involved, debt collectors, and, if relevant, the IRS. It is free and it is run by the FTC, not a private company. If you would rather report the scam or the breach itself without opening a recovery case, ReportFraud.ftc.gov is the FTC's general fraud-reporting intake.

8. Check Whether a Settlement Exists

Some data breaches eventually produce a class-action settlement, where the company pays into a fund that affected people can file a claim against. Many do not, or the litigation is still ongoing with no claim form open yet, which is common and does not mean nothing is happening.

Search RecordingLaw's data breach settlement tracker for the company that sent your notice to see whether a settlement exists, what stage it is in, and, if a claim window is open, the link to file directly on the official settlement site. Filing is always free and always happens on the official administrator's site, never through a third party that contacts you first. If a settlement exists, treat any realistic payout as modest and pro rata, most claimants receive far less than a headline maximum figure, and never treat a possible future claim as a substitute for freezing your credit today.

9. Know Your State's Breach Notification Rights

Every US state, plus the District of Columbia, has its own data breach notification law requiring a company to tell you when your personal information is exposed, though the details of what counts as personal information, how fast the company must notify you, and what penalties apply vary by state.

California is currently the only state that gives consumers a direct, individual right to sue over certain data breaches, under the California Consumer Privacy Act, when a business's failure to maintain reasonable security procedures leads to specific categories of unencrypted personal information being stolen. In every other state, an individual's realistic path after a breach runs through a class action rather than a solo lawsuit. See our state-by-state data privacy law guide for the notification and rights specific to where you live.

When Paid Monitoring Might Be Worth Considering

The free steps above, a credit freeze and the monitoring the breach notice already includes, are enough protection for most people after most breaches. A paid identity protection service is worth a look mainly in two situations: your free monitoring period from the breach has ended and you want it to continue, or you want broader coverage than the breach notice offers, such as dark-web monitoring for existing account logins or monitoring across more than one credit bureau at once.