What to Do If Your Data Was Exposed in a Breach: A Step-by-Step Checklist

The email or letter usually arrives weeks after the fact: “We are writing to inform you of a security incident that may have involved your personal information.” It’s unsettling, and it’s often vague about what you should actually do.

Data breach notices are now a routine part of life. All 50 states have laws requiring organizations to notify people when certain personal information is exposed, so you’ll hear about more of them. The good news is that the most effective protective steps are free and take less than an hour.

This checklist walks through what to do first, then what to do based on the specific information that was exposed, and how to keep watch over the following months.

First, confirm the breach is real

Scammers send fake breach notices to trick people into “verifying” their information. Before you act on any link:

• Don’t click links or call numbers in the notice until you’ve confirmed it’s genuine. Go to the company’s website by typing the address yourself, or check for news coverage of the breach.
• Look for specifics. A real notice usually names the date range, the types of data involved and any free services offered, such as credit monitoring with an enrollment code.
• Never give your password or full Social Security number to someone who contacts you about a breach.

Step 1: Figure out what was exposed

Your next steps depend on the type of data. Read the notice carefully and note each item. This table shows the priority actions for each.

Steps 2 to 5: Protect your accounts, credit and finances

Step 2: Lock down your accounts

Do this the same day if a password, email address or security question was involved.

1. Change the password for the breached account. Make it long and unique.
2. Change any reused passwords. If you used the same password elsewhere, criminals will try it there. This is how a breach at one site becomes a takeover at your email or bank. A password manager makes unique passwords for every site realistic.
3. Turn on multi-factor authentication for email, banking, shopping and social media. An authenticator app or passkeys are stronger than text codes.
4. Secure your email first. Your email account can reset every other password, so protect it before anything else.
5. Sign out of all sessions and review connected devices and apps in your key accounts.
6. Update security questions if answers were exposed. You can use random answers stored in your password manager.

Key takeaway: For most breaches, the 2 most effective steps are free: unique passwords with MFA, and a credit freeze at all 3 bureaus. Do both today and you’ve closed the most common doors.

Step 3: Freeze your credit

A credit freeze stops lenders from pulling your credit report, which makes it very hard for someone to open a new account in your name. Under federal law, freezes are free to place and lift.

• Contact all 3 bureaus separately: Equifax, Experian and TransUnion. A freeze at one doesn’t apply to the others.
• Do it online for the fastest result, and save the PIN or account login each bureau gives you.
• Lift it temporarily when you apply for a loan, credit card or apartment. You can usually do this online in minutes.
• A freeze doesn’t affect your credit score or your existing accounts.

You can also place a fraud alert, which tells lenders to verify your identity before opening credit. According to the FTC, an initial fraud alert lasts 1 year, and you only need to contact one bureau, which must notify the other two. An extended fraud alert lasts 7 years and requires an identity theft report.

For extra protection, you can also request security freezes with specialty reporting agencies such as ChexSystems, which banks use when you open checking accounts.

Step 4: Protect your Social Security number at the IRS and SSA

If your Social Security number was exposed, criminals may try to file a tax return in your name and collect your refund.

• Get an IRS Identity Protection PIN. The IRS offers an IP PIN to anyone with a Social Security number or ITIN who can verify their identity. It’s a 6-digit number that must be on your tax return, and it changes every calendar year. Request it through your IRS online account.
• Create a my Social Security account at ssa.gov before someone else does, and review your earnings record for jobs you didn’t work.
• File your taxes early if you can.

Step 5: Deal with exposed financial details

• Credit or debit card: Call the number on the back of your card. Ask for a replacement with a new number, and review recent transactions. Debit card fraud takes money directly from your account, so act quickly.
• Bank account: Ask your bank whether to close the account or add extra monitoring, and set up transaction alerts.
• Set up alerts on every financial account so you get a text or email for each transaction above a low amount.

Step 6: Accept free monitoring, then keep watch

If the breached company offers free credit monitoring or identity protection, the FTC suggests taking it. Note the enrollment deadline in the notice, because these offers expire.

Then build your own monitoring habits:

1. Check your credit reports. You can get free reports from each bureau every week at AnnualCreditReport.com, the official site. The bureaus made weekly access permanent in 2023.
2. Review bank and card statements monthly for small charges you don’t recognize. Thieves often test a card with a small amount first.
3. Read insurance explanation of benefits statements for care you didn’t receive.
4. Watch for unexpected mail, such as credit card approvals, collection letters or tax notices.
5. Expect more phishing. Breached data is often used to make scam emails and calls sound convincing. Blocking spam calls and texts helps reduce the noise.

If you spot fraud, report it

• Report identity theft at IdentityTheft.gov, the FTC’s site. It creates a personal recovery plan and an official identity theft report you can use with creditors.
• Contact the company where the fraud happened and ask for the account to be closed and the debt removed.
• Dispute fraudulent items with each credit bureau.
• File a police report if a creditor requires one.
• Report tax identity theft to the IRS if your e-filed return is rejected because someone already filed with your number.

Where to start in the next hour

If you just got a breach notice, do these in order:

1. Confirm the notice is genuine without using its links.
2. Change the breached password and any reused copies.
3. Turn on MFA for your email and bank.
4. Freeze your credit at Equifax, Experian and TransUnion.
5. If your Social Security number was involved, request an IRS IP PIN.
6. Enroll in any free monitoring offered.
7. Put a monthly reminder on your calendar to check statements and credit reports.

For a broader plan to prevent identity theft before the next breach, read how to protect yourself from identity theft. If you suspect your phone is part of the problem, see how to tell if your phone is hacked. Curious what companies must disclose? Our guide to US state data privacy laws covers your rights by state.

The bottom line

A breach notice doesn’t mean you’ll become a victim of identity theft, but it does mean your information is in more hands than you’d like. Unique passwords, MFA and a credit freeze handle most of the risk, and they’re free. Add an IRS IP PIN if your Social Security number was exposed, keep an eye on your accounts, and report problems early.

Sources

• FTC: What To Know About Credit Freezes and Fraud Alerts — free freezes, fraud alert lengths, children’s freezes
• IdentityTheft.gov: Data breach guidance — FTC step-by-step guidance by type of exposed data and identity theft reporting
• FTC: Data Breaches: What to know, What to do — accepting free monitoring and checking credit reports
• FTC Consumer Advice: Credit reports are free every week — permanent free weekly reports at AnnualCreditReport.com
• IRS: Get an Identity Protection PIN — eligibility and annual validity of the IP PIN