What to Do After a Data Breach

A breach notice is unsettling, but it’s not a catastrophe if you move methodically. Here’s the checklist, in order.

Data breaches are so common now that most people will get a “your information may have been exposed” notice eventually. A breach doesn’t mean you’ll be defrauded — but it does mean it’s time to take a few specific, protective steps.

Work this list in order and you’ll close most of the risk.

Don’t panic — assess what was exposed

Start by reading the notice carefully to learn what data was involved. A leaked email address is a minor nuisance; an exposed Social Security number, financial account, or login credentials is more serious and calls for stronger steps. Match your response to the sensitivity of what leaked.

Change passwords and turn on 2-factor authentication

If login credentials were exposed — or you reused that password anywhere — change it everywhere, starting with email and financial accounts, and make each one unique (a password manager helps). Then turn on two-factor authentication wherever it’s offered; it blocks most account takeovers even if a password leaks.

Place a fraud alert or credit freeze

If sensitive identifiers were exposed, protect your credit. A credit freeze blocks new accounts from being opened in your name and is free; a fraud alert is a lighter touch. The difference (and how to choose) is in fraud alert vs. freeze vs. lock, and our freeze your credit tool has the bureau links.

Monitor your reports and accounts

For the next several months, watch closely. Check your credit reports for unfamiliar accounts, review bank and card statements line by line, and consider credit monitoring for real-time alerts. The earlier you catch misuse, the easier it is to undo.

Watch for the phishing that follows

Breaches are routinely followed by phishing — scammers use leaked details to send convincing emails, texts, or calls, sometimes posing as the breached company “helping” you. Be skeptical of any unsolicited message asking you to click a link, log in, or share information. Go to companies directly rather than through a message you received.

When to file with the FTC

If you see actual misuse — a fraudulent account, charges, or a stolen tax refund — report it at IdentityTheft.gov, the FTC’s recovery hub, which generates a personalized recovery plan and an official identity-theft report you can use with creditors and bureaus. Even without confirmed misuse, it’s a useful resource after a serious breach.