You Got a Data Breach Notice. Here Is What to Do Next

A letter or email arrives from a company you do business with, or perhaps one you barely remember. It says your information "may have been involved in a security incident." It is easy to feel either panicked or numb, since these notices have become so common.

Neither reaction helps much. The useful response is specific: figure out what was exposed and take the steps that match. Most of them take minutes, and several protect you from future breaches too.

Step 1: Make sure the notice is real

Scammers send fake breach notices because people are primed to act on them. Before doing anything the notice suggests:

• Do not click links or call phone numbers in an unexpected breach email.
• Go to the company's website by typing the address yourself and look for an announcement or a support page about the incident.
• If you received a letter, compare the phone number or website with the company's official contact information.

A real notice usually explains what happened, roughly when, what kinds of information were involved and what the company is offering, such as free credit monitoring.

Step 2: Match your actions to what was exposed

Read the notice closely. The type of data exposed decides what matters most.

• Password or password hash: change the password for that account right away, and anywhere else you used the same or a similar password. Turn on two-factor authentication. A password manager makes unique passwords easy from now on.
• Email address: expect more phishing that sounds well-informed, possibly mentioning the company that was breached. Our guide to spotting a phishing email will help.
• Phone number: watch for scam texts and calls, and ask your mobile carrier about adding a PIN or account lock to make SIM swaps harder. See our guide to text message scams.
• Payment card number: call your card issuer, ask whether to replace the card, and review statements for charges you do not recognize.
• Bank account number: tell your bank and watch for unusual withdrawals or new payees.
• Social Security number, date of birth or government ID: these can be used to open new accounts in your name. Freeze your credit (Step 3) and consider the tax step below.
• Health or insurance information: read the explanation of benefits statements from your insurer and report any services you did not receive.

Step 3: Freeze your credit if identity data was exposed

In the United States, a credit freeze stops lenders from pulling your credit report to open a new account, which blocks most new-account fraud. Freezing is free at each of the three nationwide credit bureaus: Equifax, Experian and TransUnion. You need to place a freeze with each one separately.

A few things to know:

• A freeze does not affect your credit score or your existing accounts.
• You can lift it temporarily when you apply for a loan, credit card or apartment, then put it back.
• Keep your login details or PIN for each bureau in a safe place, such as your password manager.
• A fraud alert is different. It asks lenders to take extra steps to verify your identity. Placing a fraud alert with one bureau means it notifies the other two. A freeze is the stronger option.

Parents can also freeze credit for minor children, who are attractive targets precisely because nobody checks their credit for years.

Step 4: Check your credit reports

You can get free credit reports from each bureau through AnnualCreditReport.com, the official site for free reports. Look for accounts, addresses or inquiries you do not recognize. Checking every few months is a reasonable habit even without a breach.

Step 5: Protect your tax return

If your Social Security number was exposed, criminals might try to file a tax return in your name to collect a refund. The IRS offers an Identity Protection PIN, a number that must be included on returns filed with your Social Security number. Signing up through the IRS website adds a strong layer of protection.

Step 6: Decide about the offered monitoring

Many companies offer free credit monitoring after a breach. It can be useful as an extra set of eyes, alerting you to new accounts or inquiries. Read the terms before enrolling, and remember that monitoring tells you after something happens, while a freeze prevents much of it.

If you see signs of identity theft

If someone has already opened accounts or used your information, the Federal Trade Commission's IdentityTheft.gov site walks you through reporting and creates a personalized recovery plan. Keep notes of every call, including dates and names.

Watch for follow-up scams

After a well-publicized breach, scammers impersonate the breached company, a "settlement administrator" or a security firm offering to help. Real companies will not ask for your full password or one-time codes. When in doubt, contact the company through its official website.

Frequently asked questions

Does freezing my credit hurt my credit score?

No. A freeze only restricts who can view your report to open new credit. It does not affect your score, your existing accounts or your ability to use your cards.

Should I sign up for the free credit monitoring offered after a breach?

It can help as an early warning, so many people accept it. Read the terms first, and treat monitoring as a supplement to a credit freeze, not a replacement.

How can I tell if a breach notice is fake?

Real notices can be confirmed through the company's official website or a phone number you find yourself. Be suspicious of notices that pressure you to click a link, call an unfamiliar number or share passwords or codes.