The letter or email arrives with careful wording: “an unauthorized party may have accessed certain personal information.” For many people, the first reaction is to ignore it, because notices of this kind have become routine. That is understandable, and it is risky. What you should do depends on what was exposed, and the steps are mostly quick.
First, find out what was taken
The notice should say what types of information were involved. Everything else follows from that answer.
| What was exposed | Main risk | First moves |
|---|---|---|
| Email address and password | Account takeover, including on other sites where you reused the password | Change the password everywhere it was used; turn on two-step verification |
| Payment card number | Fraudulent charges | Contact the card issuer; ask for a replacement card |
| Social Security number | Identity theft, new accounts opened in your name | Freeze your credit; consider an IRS Identity Protection PIN |
| Health or insurance details | Medical identity theft, targeted scams | Review statements and explanations of benefits; call the insurer |
| Name, address, phone only | Phishing and impersonation | Be careful with unexpected calls and messages |
If the notice is vague, contact the company through the phone number or website you already know, not one given in the message.
How do you check that the notice is real?
Breach notices are a favorite disguise for scammers. Be suspicious of a message that pressures you to act at once, asks for a password or full Social Security number, or links to a site you cannot verify. Instead of clicking, go to the company’s website by typing the address yourself, and look for an official notice there. State attorneys general in many states also publish breach notifications, and all 50 states have laws requiring some form of notification.
What to change first
- Passwords. Change the password on the affected account, and on any other account where the same one was used. Make each password unique. A password manager makes this practical, because it can generate and store long random ones.
- Add a second step. Turn on multifactor authentication for email, banking and any account that matters. How the options differ is explained in two-factor authentication and passkeys.
- Email first. If your email account is compromised, attackers can reset passwords everywhere else, so secure it before anything else.
- Security questions. If answers to security questions were exposed, change them or, better, use random answers stored in your password manager.
Credit freezes and fraud alerts
If your Social Security number or other identifying details leaked, the most effective protection is a credit freeze. It blocks most lenders from viewing your credit report, which makes it hard for a thief to open new credit in your name. Federal law, since 2018, makes freezes free at the three nationwide credit bureaus, Equifax, Experian and TransUnion. You must contact each one, and you can lift a freeze temporarily when you apply for credit yourself.
A fraud alert is a lighter step. It asks businesses to take extra steps to verify your identity before extending credit. An initial alert lasts one year and is free, and victims of identity theft can request a longer one. A freeze is generally stronger, while an alert is easier to set up and lift.
You can also check your credit reports. Federal law entitles you to free reports from each bureau through AnnualCreditReport.com, the official site, and the bureaus currently offer them weekly. Look for accounts, inquiries or addresses you do not recognize.
If someone already used your information
The Federal Trade Commission runs IdentityTheft.gov, where you can report what happened and get a personalized recovery plan, along with sample letters. Common additional steps include placing an extended fraud alert, disputing fraudulent accounts with the creditor and the bureaus, and filing a police report if a creditor requires one.
Tax-related identity theft has its own fix: the IRS offers an Identity Protection PIN, a six-digit number that prevents someone else from filing a return using your Social Security number. If a fraudulent return has already been filed, the IRS provides a form and instructions for reporting it.
What to watch for in the following months
Criminals sometimes sit on stolen data and use it later, and breach victims are common targets for follow-up scams that reference the incident. A few habits help:
- Review bank and card statements monthly, and turn on transaction alerts.
- Distrust calls or texts that claim to be from your bank and ask for codes. Real institutions do not ask you to read out a one-time passcode.
- Be wary of “free credit monitoring” offers from unknown senders. Legitimate companies usually provide a way to enroll through their official site.
- Use a breach-notification service such as “Have I Been Pwned,” run by a security researcher, to check whether your email address appears in known breaches.
Location and device data, which many people forget, can also be part of breaches. Understanding how GPS and location data work is a good starting point for reviewing which apps really need your location.
What about reused passwords and crypto accounts?
Reuse is the biggest multiplier of damage, since a single leak can unlock many accounts. For people who hold digital assets, a compromised exchange account can be especially costly, and a stolen password could be followed by a withdrawal. That is one reason security guidance in the digital-asset world, covered in exchange custody versus self-custody, emphasizes strong authentication and caution about who controls the keys.
Sources: Federal Trade Commission; Internal Revenue Service; Consumer Financial Protection Bureau; Cybersecurity and Infrastructure Security Agency
