What to do after a data breach: the complete US guide

You open your email and find a message that begins with "We are writing to inform you of a data security incident." Or a letter arrives with an official-looking logo and a paragraph about your Social Security number. Your stomach drops.

That reaction is normal, and it helps to slow down. A breach notice means your information was exposed. It does not mean someone has stolen your identity. Most of what you need to do depends on one question: which pieces of your information were exposed?

This guide walks through it in order. You will learn what a data breach is, what the notification letter means, what to do for each type of data, how to freeze your credit, and how to spot the scams that tend to follow a breach. It uses guidance from the Federal Trade Commission (FTC), IdentityTheft.gov, the Consumer Financial Protection Bureau (CFPB), and a state attorney general. It is general information, not legal or financial advice for your situation.

What a data breach is

A data breach is an incident where information that should have stayed private ends up somewhere it should not be. Have I Been Pwned, the breach-tracking service, describes it as an incident where "data is inadvertently exposed in a vulnerable system." It says this usually happens because of weak access controls or security weaknesses in software.

The FTC's guide for businesses gives concrete examples. Hackers might take personal information from a corporate server. An insider might steal customer information. Information might be exposed by mistake on a company's website. In each case, the people whose information sat in that system are affected, even though they did nothing wrong.

Three points are worth keeping in mind.

First, you are rarely the one who made the mistake. Breaches happen at the companies, clinics, schools, and agencies that hold your data. You gave your information to an organization you trusted, and that organization lost control of it.

Second, "exposed" is a spectrum. A breach might involve only your email address and name. It might involve a password, a card number, or a Social Security number. The steps below depend heavily on which of these was involved.

Third, a breach is a fact about the past. Have I Been Pwned says that changing your password does not remove a breach from its records, and treats the exposure as "an immutable historic fact." You cannot undo it. What you can do is make the exposed information less useful to anyone who has it.

What a data breach notification means

When a company learns that personal information was exposed, it may have to tell the people affected. The FTC's business guidance says that all states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted laws requiring notice of security breaches involving personal information. It adds that other laws or regulations may apply depending on the type of information involved.

California is a useful example because its attorney general publishes the notices. According to the California Attorney General's office, California law requires a business or a state or local agency to notify California residents whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person. The office also says an organization that sends a notice to more than 500 California residents must provide a sample copy of it to the Attorney General. The office posts those notices in a searchable list. Because each state has its own law, check your own state attorney general's website if you want the details that apply to you.

The California page makes one more point that surprises people. The organization that sent you a notice may not be the one that suffered the breach. The office gives the example of a bank reporting a merchant's card breach. If the letter comes from a company you do not recognize, that is one possible reason.

Reading the notice

A good notice tells you what happened, what information was involved, and what you can do. Look for these things:

• The type of information exposed. This is the most important line. It decides which steps below apply to you.
• The date or date range of the incident. Older incidents mean there has been more time for misuse, but they do not make the steps less useful.
• Whether the company is offering free credit monitoring or similar help, and how to sign up.
• A phone number or web address for questions.

If the notice is vague about what was exposed, contact the company using a phone number or web address you already know is real, not one in a text message or email you did not expect.

Is the notice real?

Scammers know that people receive breach notices, and some send fake ones. IdentityTheft.gov advises that if you get an email or text from an agency or company you do business with, you should not click links in it, even if you think it might be real. Contact the organization through a website you know is trustworthy, or look up its phone number yourself. Do not use the details in the message or the number on caller ID.

For a letter on paper, the same idea applies. If it asks you to confirm your Social Security number or pay a fee to "unlock" protection, treat it as suspicious and contact the organization through a number or website you already know is real.

First steps in the first day

Do these things before you worry about the details.

1. Read the notice and write down what type of information was involved.
2. Find out whether the company is offering free credit monitoring. IdentityTheft.gov says to accept it if a company offers it.
3. Change the password for any account named in the notice, and for any other account that uses the same password.
4. Look at your recent card and bank transactions for anything you do not recognize.
5. Get your free credit reports and look for accounts you did not open.

Free credit reports come only from AnnualCreditReport.com, according to the FTC, so be wary of look-alike sites.

What to do for each type of exposed data

IdentityTheft.gov, the federal government's one-stop resource for identity theft victims, organizes its advice by what was lost. It starts with the same two questions. Did someone use your information, for example to open an account, make a purchase, apply for a loan, get a job, file taxes, or get government benefits? If yes, you report identity theft there. If no, or if you do not know, you follow the protective steps for the type of information involved.

Here is what that guidance says for the most common types, in plain language.

Passwords and account logins

IdentityTheft.gov says to log in to the account and change your password. If possible, change your username too. Make the new password long, and consider two-factor authentication, which asks for two or more credentials to log in.

The site explains what a thief might do with a login: sign in and make purchases, pretend to be you on social media, send spam from your account, or reach your personal or financial information.

Some practical points follow from the official guidance:

• If you cannot log in, contact the company and ask how to recover or shut down the account. IdentityTheft.gov points to ftc.gov/hackedaccount for help with hacked email and social media accounts, and to IdentityTheft.gov/Top-Company-Contacts for contact information at several companies.
• If you use the same password anywhere else, change that one too, as IdentityTheft.gov advises.
• If the account is a financial site, or if a card number is stored there, check for charges you do not recognize and for account changes such as a new address.

Have I Been Pwned adds a related warning. It says a password found in its Pwned Passwords list "should no longer be used," because its exposure raises the risk that someone will use it to log in. Retire any password that appears there, even on accounts you think are unimportant.

Social Security number

This is the one that worries people most, and for good reason. IdentityTheft.gov says an identity thief could try to use your Social Security number to open accounts, take out a loan, file taxes, or get a job.

The site recommends the credit steps covered later in this guide (check, freeze, monitor), plus a few steps specific to your number:

• Check whether someone is using your number for work. You can review your Social Security work history by creating an account at socialsecurity.gov/myaccount. If you find errors, contact your local Social Security Administration office.
• Consider setting up an E-Verify account so you can lock your Social Security number at e-verify.gov/mye-verify. IdentityTheft.gov explains that E-Verify is run by the Department of Homeland Security and the Social Security Administration. When someone tries to use a locked number to get a job, employers that use E-Verify must get more information from the person.
• Try to file your taxes early, before a scammer can. IdentityTheft.gov describes tax identity theft as someone using your number to get a tax refund or a job, and says to respond right away to letters from the IRS.

Many people ask whether they can just get a new number. IdentityTheft.gov says that in most instances you cannot get a new Social Security number without evidence that someone else is misusing yours. It also notes that a new number likely would not solve every problem, because agencies and other entities still have records linking you to the old one. The Social Security Administration explains the limited circumstances at SSA.gov.

Debit and credit card numbers

For a card number, the main step is to cancel the card. IdentityTheft.gov says to contact your bank or card company, cancel the card, and request a new one. Use a phone number or web address you know is real, such as the number on the back of your card or on your statements.

After that:

• Review your transactions regularly to make sure no one misused the card. If you find fraudulent charges, call the fraud department and get them removed.
• If you have automatic payments set up, update them with the new card number.
• If you have not already, follow the credit steps below.

IdentityTheft.gov also lists the credit steps for card numbers, so they are worth doing when you can.

Bank and investment account information

An account number can be used to try to pull money out. IdentityTheft.gov says to contact your bank or investment company, tell them what happened, close the account, and open a new one. Again, use a number or web address you know is real, such as the number on your statements.

Then review your transactions regularly. If you find fraudulent charges or withdrawals, call the fraud department and get them removed. Update any automatic payments that were tied to the old account. If you have not yet checked, frozen, and monitored your credit, do that too.

Changing an account number is inconvenient. It is also the most direct way to make the exposed number useless.

Health insurance and medical information

IdentityTheft.gov lists "Medicare, Medicaid, or medical insurance information" as its own category with its own steps. This article does not repeat the detailed steps for that category. Open that section on IdentityTheft.gov for the current checklist.

What you can do in the meantime is general. Read the notice to see which details were exposed. Read the explanation-of-benefits statements your insurer sends, and look for services you did not receive. If something looks wrong, contact your insurer using the number on your card or its official website. If it looks like someone used your information, report it at IdentityTheft.gov.

Driver's license, passport, and other information

IdentityTheft.gov also has separate categories for driver's license information, passport information, children's personal information, and other personal information. If one of these appears in your notice, open that category on the site and follow the checklist there. The credit steps in the next section are a sensible starting point in every case.

Check, freeze, and monitor your credit

IdentityTheft.gov puts this at the top of its list as "Step 1." It applies to nearly every type of exposure, and it is where most of the protection comes from.

Check your credit reports

Get your free credit reports from AnnualCreditReport.com. The FTC says only AnnualCreditReport.com is authorized to fill orders for the free annual reports. You can also call 1-877-322-8228 or mail a request form, but the FTC says not to contact the three bureaus individually for this. Online orders give immediate access.

The FTC also says the three nationwide bureaus have permanently extended a program that lets you check each report once a week for free at AnnualCreditReport.com. IdentityTheft.gov repeats that you can check your reports online every week for free. After a breach, it is reasonable to look more often than once a year. The CFPB notes that requesting your own reports will not hurt your credit score.

When you read a report, look for accounts, addresses, or debts you do not recognize. If you see an account or debt you do not recognize, IdentityTheft.gov says to contact the company and ask about it. If someone used your information to open an account or make a purchase, report it at IdentityTheft.gov and learn how to dispute the information on your credit report. The FTC says to contact both the credit bureau and the business that supplied the wrong information.

One warning from the FTC: AnnualCreditReport.com and the bureaus will not email you asking for your Social Security number or account details. Do not reply to or click links in unsolicited messages that claim otherwise.

Freeze your credit

A credit freeze is one of the most direct steps on this list. IdentityTheft.gov explains that a freeze keeps people from getting into your report, and while a freeze is in place, nobody can open a new credit account. It is free to place the freeze, and free to lift it temporarily if you need to apply for new credit.

The details, from the FTC and the CFPB:

• It is free. The CFPB says security freezes are free at Equifax, Experian, and TransUnion, and notes that credit locks often carry a fee and are no more effective than freezes.
• It lasts until you lift it, according to the FTC.
• You have to contact all three bureaus. The FTC says to place it with Equifax, Experian, and TransUnion. The CFPB says you contact each company separately.
• Timing, per the CFPB: a freeze requested by phone or secure electronic request must be placed within one business day, and a mailed request within three business days. You should get written confirmation within five business days, including how to remove it.
• Lifting it is free. The CFPB says a phone or electronic request must be honored within one hour and a mailed request within three business days. You can also lift it for a period you choose. The FTC adds that if a lender checks your credit, you can lift the freeze at only the bureau that lender uses.
• It does not affect your credit scores, according to the CFPB.

The bureau pages listed by the FTC and IdentityTheft.gov are Equifax at equifax.com/personal/credit-report-services, Experian at experian.com/help, and TransUnion at transunion.com/credit-help.

A freeze has limits, and the CFPB spells them out. Existing creditors, certain government entities such as child support agencies, and companies you hired to monitor your file can still access your report. The free freeze rule does not cover requests for employment, tenant screening, or insurance purposes.

Consider a fraud alert

A fraud alert is a lighter tool. The FTC says it makes businesses verify your identity before opening new credit in your name, but they can still view your credit report. It is free, and you contact only one bureau, which must notify the other two. The FTC lists three kinds:

• An initial fraud alert lasts one year and can be renewed. Anyone who is or suspects they may be affected by identity theft can place one.
• An extended fraud alert lasts seven years. It is available to identity theft victims who filed an FTC identity theft report or a police report.
• An active duty alert lasts one year, renewable for the length of a deployment, and is available only to active duty servicemembers.

If you are not sure which to pick, the FTC's description suggests a simple way to think about it. A freeze blocks access. An alert adds a verification step. The CFPB also says a fraud alert is a separate tool from a freeze.

Monitor going forward

IdentityTheft.gov says to accept free credit monitoring if a company offers it. Monitoring services scan activity that appears on your credit reports and, depending on the service, alert you to events such as a credit check, a new loan or card, or a late payment report. The FTC's business guide also advises companies to consider offering at least a year of free credit monitoring when financial information or Social Security numbers were exposed.

Monitoring tells you something happened. It does not stop it. Pair it with a freeze if you want a barrier rather than an alarm.

Keep watching your accounts

After the first week, the work becomes routine. You are watching for activity you did not start.

• Review card and bank statements regularly. Both the card and bank sections of IdentityTheft.gov say to review transactions regularly. Check the small charges as well as the large ones.
• Keep checking your credit reports periodically at AnnualCreditReport.com. IdentityTheft.gov says to keep doing this to watch for anything you do not recognize.
• Read every letter from the IRS, a lender, or an insurer that you did not expect. Respond to IRS letters right away.
• Watch your email for password reset requests you did not make. They can mean someone is trying to get into an account.

If you subscribe to breach alerts, make sure you use the right ones. Have I Been Pwned lets you subscribe to notifications that go only to the email address being monitored, so you hear if that address shows up in a future breach. It also warns that not finding your email in its data does not mean you are safe, quoting the line "Absence of evidence is not evidence of absence."

Report identity theft if it happens

If you find that someone used your information, report it at IdentityTheft.gov. The site describes itself as the federal government's one-stop resource for identity theft victims, with checklists and sample letters to guide you through recovery.

Things that count as use, according to the site, include opening an account, making a purchase, applying for a loan, getting a job, filing taxes, or getting government benefits with your information.

A few practical points:

• Report the misuse to the business involved, using contact details you know are real. For card or bank fraud, ask for the fraud department.
• Dispute wrong information with both the credit bureau and the business that supplied it, as the FTC advises.
• If you want an extended fraud alert, the FTC says you need an FTC identity theft report or a police report. Filing at IdentityTheft.gov is where you start.
• If you experienced a fraud, scam, or bad business practice that is not identity theft, you can tell the FTC at ReportFraud.ftc.gov.

Keep a simple record of what you did and when: dates, who you spoke to, and any reference numbers. You will be glad to have it if the problem takes several calls to fix.

Watch for phishing after a breach

Breaches do not only expose data. They also give scammers something believable to say. After a breach, a message that mentions the company, a recent purchase, or your account number can look real.

The FTC lists the usual signs of a phishing message:

• It is unexpected and appears to come from a company you know, often claiming a problem with your account or asking you to confirm personal or financial information.
• It has a generic greeting, an invoice you do not recognize, or a link to update payment details.
• It offers a government refund or free coupon.

If you suspect phishing, the FTC suggests asking yourself whether you have an account with that company or know the sender. If not, report the message and delete it. If you do have an account, contact the company using a phone number or website you know is real, not the information in the message.

If you already responded, the FTC says that when your Social Security, credit card, or bank account number may be exposed, you should go to IdentityTheft.gov for steps based on what was lost. If you clicked a link or opened an attachment, update your security software, then run a scan and remove anything it flags.

To report phishing, the FTC gives three routes:

• Forward phishing email to reportphishing@apwg.org.
• Forward phishing texts to SPAM (7726).
• Report any phishing attempt to the FTC at ReportFraud.ftc.gov.

The FTC also recommends keeping security software and your phone set to update automatically, using multi-factor authentication so a stolen password alone is not enough, and backing up your data.

Mistakes to avoid

Some responses to a breach make things worse. These are the common ones.

• Clicking the link in a "breach alert" you did not expect. Go to the company's site by typing the address yourself, or call a number you looked up.
• Paying for protection you may not need. A freeze is free, according to the FTC and the CFPB. Credit locks often carry a fee and, per the CFPB, are no more effective than freezes.
• Reusing the new password. If you change a password and then use it on five other sites, you have rebuilt the problem.
• Freezing at one bureau only. The FTC says a freeze must be placed at all three. A fraud alert is different: you contact one and it notifies the other two.
• Forgetting to lift a freeze before applying for credit. Plan ahead. A freeze can be lifted for a chosen period and does not affect your score.
• Giving your Social Security number to someone who contacted you first. The FTC advises contacting organizations through channels you know to be real.
• Ignoring the notice. Even a letter that says "we have no evidence of misuse" is a reason to do the basics.
• Assuming the job is finished after one week. Exposure lasts. Check your reports and statements over the following months.

Who to contact for what

It is easy to lose time contacting the wrong place. This is a short map based on the sources above.

• The company that sent the notice: questions about what was exposed, and free monitoring offers.
• Your bank or card company: a compromised card or account. Use the number on your card or statement.
• Equifax, Experian, and TransUnion: freezes, fraud alerts, and disputes about your credit report.
• AnnualCreditReport.com: your free credit reports.
• IdentityTheft.gov: reporting identity theft and getting a recovery plan. Also the place for the checklist for each type of exposed data.
• ReportFraud.ftc.gov: reporting a fraud, scam, or bad business practice, including phishing.
• Your state attorney general: information about your state's breach law. California's office, for example, publishes a searchable list of breach notices.
• The Social Security Administration: checking your work history if your Social Security number was exposed.
• The IRS: letters about your tax return. Respond right away.

Checking what is already out there

A breach notice only covers one incident at one organization. Your information may have been part of other incidents you were never told about, or may be listed elsewhere on the public web.

A free scan can help you see the picture. It looks at public web results, checks known breaches through Have I Been Pwned and LeakCheck, shows passwords masked, and checks a registry of people-search sites. It does not need an account. A report with few results does not mean nothing is exposed, so keep the habits above even if the scan finds little.

A short checklist to keep

If you want a version to print, use this one.

1. Note what type of information the notice says was exposed.
2. Accept free credit monitoring if it is offered.
3. Change exposed passwords, plus any account where you reused them. Turn on two-factor authentication.
4. Replace exposed cards. Close and replace exposed bank accounts.
5. Get your free reports at AnnualCreditReport.com and read them line by line.
6. Freeze your credit at Equifax, Experian, and TransUnion, or place a fraud alert.
7. Review statements and credit reports on a regular schedule.
8. Report misuse at IdentityTheft.gov. Report scams at ReportFraud.ftc.gov.
9. Treat unexpected messages as suspect and contact organizations through channels you know are real.

None of these steps can promise that your information will not be misused. If you keep a few routines going, you are more likely to notice a problem sooner and have a clearer path to fix it.