Got a data breach notice? What to do next

Concerns & risks

You've been notified that your personal information was exposed in a data breach.

Causes & evidence

The FTC's IdentityTheft.gov has a data breach page with steps based on what information was exposed. If your Social Security number was exposed, it recommends steps such as getting your free credit reports from AnnualCreditReport.com, considering a credit freeze or fraud alert, and accepting free credit monitoring if offered. If passwords were exposed, change them, and change them anywhere else you used the same password. A credit freeze restricts access to your credit report, making it harder for identity thieves to open new accounts in your name, and it's free to place and lift. Monitoring can alert you to activity, but it doesn't stop new accounts from being opened.

Breach notices often come months after the breach itself. Acting promptly still limits further risk. Keep the breach notice and any reference number it gives, since you may need them if fraud appears later. Check your bank and card statements regularly for unfamiliar charges, and be careful with unexpected calls or emails that mention the breach, because scammers often follow news of a breach with fake 'support' messages asking for personal details.

Accepting the monitoring and doing nothing else leaves the door open for new accounts in your name.

What to do

1. Read the notice to see exactly what was exposed.
2. Get your free credit reports from AnnualCreditReport.com.
3. Place a free credit freeze with Equifax, Experian and TransUnion.
4. Change exposed or reused passwords and turn on multi-factor authentication.
5. Accept the free monitoring if offered, as an extra layer.

Common mistakes:

• Relying only on monitoring
• Ignoring the notice
• Calling numbers from unverified follow-up emails

ReportSpeedMan tip: Breach notices are sometimes copied by scammers. Verify the company's notice on its official site before acting on links.

What I would actually do

for an exposed SSN, I'd freeze my credit at all three bureaus that day and accept the free monitoring as a backup.

The trade-off people miss: a freeze means lifting it before applying for credit, a small hassle that's far easier than cleaning up fraud.

Checking that it worked

Your credit is frozen and exposed passwords are changed.

Quick FAQ

Does a freeze hurt my score?
No.

Is monitoring worth it?
It's a useful extra layer.

Do I freeze all three bureaus?
Yes, separately.

Wrap-up: Match your response to what was exposed. For an SSN, a free credit freeze is the strongest single step.

Wiki: Identity Theft Recovery Steps and Credit Scores and Credit Reports.

Got a data breach notice: read the originals

• IdentityTheft.gov: Data breaches
• FTC: Credit freezes and fraud alerts