What to Do After a Data Breach: Steps to Protect Yourself
Got a letter or email saying your information was exposed in a data breach? Here's how to work out what's at risk, the steps to take straight away, which free protections are worth using, how to spot the scams that follow breaches, and what to do if your information is misused.
By Pond.com editors Updated 3 min read
Quick answer
- Find out exactly what was exposed; a leaked password needs different action from a leaked Social Security number.
- Change any exposed password, and the same password anywhere else you use it, then turn on two-step verification.
- If your Social Security number was exposed, freeze your credit at all three bureaus; it's free.
- Watch for scam emails, texts and calls that use the breach as bait.
- Accept free credit monitoring if it's offered, but it alerts you after the fact; a freeze prevents new accounts.
Data breaches are so common that many Americans get several breach notices a year. Most don't lead to identity theft, but some do, and a few simple steps make it far less likely.
This article is general information, not legal advice.
Step 1: Find out what was exposed
Read the notice carefully, or check the company's official website. What you need to do depends on what was taken:
| Exposed | What to do |
|---|---|
| Email address | Watch for phishing emails |
| Password | Change it everywhere you used it; turn on two-step verification |
| Card number | Watch statements; ask your bank for a new card |
| Bank account number | Tell your bank; watch for unfamiliar withdrawals |
| Social Security number | Freeze your credit; get an IRS IP PIN; check your credit reports |
| Medical or insurance details | Read your insurer's statements for care you didn't receive |
Step 2: Lock down your accounts
- Change the exposed password and any account where you reused it. A password manager makes unique passwords easy.
- Turn on two-step verification, preferably with an authenticator app rather than text messages, for email, banking and shopping.
- Secure your email first, since it's the key to resetting every other account.
Step 3: Protect your credit
If your Social Security number or other ID was exposed:
- Freeze your credit at Equifax, Experian and TransUnion. It's free, doesn't affect your score and stops new accounts being opened in your name. You can lift it when you apply for credit.
- Check your credit reports, free every week from AnnualCreditReport.com. See how to check your credit report for free.
- Get an IRS Identity Protection PIN to block tax return fraud.
- Use free monitoring if the company offers it, as an extra alert.
Step 4: Watch for follow-up scams
Breaches are often followed by scam messages that mention the breach to seem real, offering "refunds," "security checks" or asking you to "verify your account."
- Don't click links in unexpected emails or texts.
- Hang up on calls asking for codes, passwords or payment, and call the company back using its official number.
- Remember: your bank will never ask for your full password or a one-time code.
If your information is misused
- Report it at IdentityTheft.gov, the Federal Trade Commission's site, which creates a recovery plan and an identity theft report.
- Contact the companies where fraud happened, and close or freeze the accounts.
- Dispute fraudulent items on your credit reports with each bureau.
- Keep records of calls, letters and costs, in case you join a settlement or need to prove losses.
Common questions
Real notices exist, but scammers also send fake ones. Don't click links or call numbers in a message you weren't expecting. Instead, find the company's contact details on its official website, or check your state attorney general's list of reported breaches.
You can, and it costs nothing to file a claim. Payments are usually small unless you can show actual losses or time spent dealing with the breach. Only use the official settlement website named in court notices.
Anyone with a Social Security number or ITIN can request one through their IRS online account. The six-digit PIN changes every year and must be on your tax return, which stops someone else from filing a return in your name.