What to do after a data breach notice

A company told you your information was in a breach. That letter means they lost control of data about you. It does not mean a thief has already spent your money or opened a loan. Those are later problems, if they happen.

The useful response depends on what leaked. A password, a card number, and a government ID are three different jobs. The US Federal Trade Commission points people at IdentityTheft.gov/databreach for that split. Their short version is in the consumer alert Have you been affected by a data breach?.

The credit-file tools below are a United States system. The password and card steps are worth doing wherever you live. The playbook with the checklist is You received a data breach notice.

Confirm the notice, then ignore the follow-up call

Read the message for the list of data. Name, email, password, card, national ID, medical record. You need that list.

Then open the company without the link. Type the address, or use the app. Breach news is public, so fake texts show up the same week, often “from” the company or a government office. The FTC says not to click links in unexpected email or texts, and not to use the phone number the caller gives you. Caller ID can be faked. If you want the company, use a site you already trust or a number from a statement you already have.

Do not pay anyone, do not install remote-access software, and do not read a one-time code to a caller who brought up the breach. You contact them. They do not get to interview you.

Match the work to the data

Password or account login. Sign in and change that password. If you used it anywhere else, change those too. The FTC says an exposed password is how someone gets into shopping, mail, and social accounts, or sends mail as you. Turn on a second factor where the site has one. If you cannot sign in, ask the company, from their real site, how to recover or close the account. If the inbox that receives the reset was part of the breach, secure that mailbox first. Use Personal email account hacked.

Card number. Call the bank or the card issuer. Use the number on the card or on a statement, which is what IdentityTheft.gov tells you to do, so you are not calling a number the breach email invented. Ask for a new card number. Read the transactions. Update automatic payments so the new card still pays the bills you want. A charge you did not make is Scammed or fraudulent bank charge, and in the US the liability rules differ for credit cards and debit cards. That guide is separate from the breach notice.

Bank account number. Call that bank on a number you already had. Ask what they can watch or replace. Do not give codes to someone who called you.

US Social Security number. Check your credit reports, then freeze them. AnnualCreditReport.com is the official place for the reports. A freeze is free, you place it at Equifax, Experian, and TransUnion separately, and it lasts until you lift it. While it is on, new credit that needs the report does not get opened, including credit you want, until you lift the freeze. The Consumer Financial Protection Bureau explains the right in What is a credit freeze?. A paid “credit lock” is not stronger. The CFPB says so.

A fraud alert is the lighter option. You place it with one bureau, they tell the other two, it is free, and it lasts a year. Businesses then have to verify you before issuing new credit. IdentityTheft.gov describes both. If a Social Security number leaked, the freeze is the one that actually blocks new credit. Take free monitoring if the company offers it. The FTC has told people to accept that offer. Monitoring tells you something happened. It does not stop the account.

Outside the United States, Equifax, Experian, and TransUnion are not your system. Change the passwords and call the banks named in the notice. If your country has a credit-reference agency or a consumer office for this, use that office’s own site. We are not going to invent the local form.

Name and email only. Change the password if this login reused one you care about. Expect phishing that uses your name and the breach as the story. The data is enough to sound convincing. It is not enough, on its own, to open a mortgage.

When it stops being “just a notice”

If a lender you never used writes to you, a debt collector calls about a bill that is not yours, or your report shows an account you did not open, move to Someone is using your identity. In the US that path runs through IdentityTheft.gov, which builds a report you can show the companies. The breach notice is evidence. It is not that report.

Keep the notice and the date you received it. If a fake account appears months later, that date belongs in the story you tell the lender.

A small version of done

The breached password is new and not reused. Email has a second factor. Cards named in the notice have new numbers, and the next statement is one you recognise. If a US Social Security number leaked, freezes are on at all three bureaus, or you lifted one on purpose because you are applying for credit today.

Set a reminder to read statements for the next couple of cycles. Breaches are often quiet for weeks. The next thing to open is the playbook’s prepare list, so the following notice costs you a password change and not a weekend: You received a data breach notice.

Related playbooks

• You received a data breach notice. A company wrote to say your personal information was exposed. Nothing else has gone wrong yet, and you need to cut off the ways it can.
• Someone is using your identity. Accounts, loans, tax filings, or bills are appearing in your name, and you did not open them.
• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.