What To Do First
If you got a notice that a company lost your personal information in a data breach, take a breath, then act. The right first steps depend on what was exposed — a Social Security number, a credit card number, a password, or all three. The Federal Trade Commission’s IdentityTheft.gov walks you through a personalized recovery plan based on exactly what was compromised, and this guide covers the core steps that apply in most cases.
Warning Signs Something Is Already Wrong
Watch for these before you even start the steps below:
- Accounts, charges, or new credit lines you don’t recognize on a statement or credit report
- A bill or collection notice for something you never bought
- A notice that your tax return was already filed when you haven’t filed yet
- Login alerts or password-reset emails you didn’t request
- A sudden drop in your credit score with no explanation
If any of these have already happened, skip ahead to the reporting steps and start there.
Step 1: Confirm What Was Exposed
Read the breach notice carefully. Companies generally tell you what type of information was involved, since the right response depends on it. A stolen password calls for a different response than a stolen Social Security number.
- Login or password exposed: change that password immediately, plus the password on any other account where you reused it.
- Credit or debit card number exposed: contact your bank or card issuer to cancel the card and request a new one.
- Social Security number exposed: this is the highest-risk scenario. Move to Step 2.
- Not sure what was exposed: visit IdentityTheft.gov/databreach for guidance specific to your situation.
Step 2: Decide Between a Credit Freeze and a Fraud Alert
Both are free, and both are meant to stop someone from opening a new account in your name. They work differently.
Credit Freeze
- Blocks lenders from accessing your credit report at all, so new accounts generally can’t be opened
- You must contact all three bureaus: Equifax, Experian, and TransUnion
- Lasts until you lift it yourself
- Free, and does not affect your credit score or your ability to use existing credit cards
Fraud Alert
- Tells lenders to verify your identity, usually by phone, before opening a new account
- You only need to contact one bureau; that bureau must notify the other two
- Lasts one year and is renewable for free; confirmed identity theft victims can get an extended alert that lasts seven years
- Free, and does not affect your credit score
A credit freeze is the stronger protection after a breach involving your Social Security number, since it blocks access outright rather than relying on a lender to call and check. A freeze won’t stop you from using your existing credit cards, and you can lift it temporarily any time you need to apply for new credit.
Step 3: Contact the Three Credit Bureaus
- Equifax: equifax.com or 1-800-685-1111
- Experian: experian.com/help or 1-888-397-3742
- TransUnion: transunion.com/credit-help or 1-888-909-8872
For a freeze, contact all three. For a fraud alert, contacting just one is enough — that bureau is required to notify the other two.
Step 4: Get Your Free Credit Reports and Check Them
Get your credit reports from all three bureaus at AnnualCreditReport.com, the official site for free reports. Go through each report line by line and look for:
- Accounts you didn’t open
- Credit inquiries you didn’t authorize
- An address you don’t recognize
- Balances or activity on accounts you closed long ago
If you spot something wrong, that’s a sign identity theft may already be underway, and you should move to Step 6.
Step 5: Change Passwords and Turn On Extra Login Security
- Change the password on the breached account and on any other account using the same or a similar password
- Use a different, unique password for every important account
- Turn on two-factor authentication wherever it’s offered, so a stolen password alone isn’t enough to get in
If two-factor authentication is new to you, our guide on two-factor authentication options breaks down the SMS, app, and hardware key choices.
Step 6: Report It If You Find Fraud
If you already spot fraudulent activity, or if a company’s breach involved your Social Security number, file a report at IdentityTheft.gov. The site asks you questions about what happened and generates a personal Identity Theft Report and a step-by-step recovery plan, along with pre-filled letters you can send to credit bureaus, businesses, and debt collectors.
Step 7: Take Advantage of Free Monitoring If It’s Offered
Companies responsible for a breach sometimes offer free credit monitoring or identity theft protection to affected customers. If that’s offered to you, it’s generally worth signing up, since it adds a layer of ongoing watching on top of the steps above.
Quick Decision Path
- Was only a password exposed, with no Social Security number involved? Change that password and any reused passwords, and turn on two-factor authentication.
- Was a card number exposed? Call your bank or card issuer to cancel and reissue the card.
- Was your Social Security number exposed? Place a credit freeze with all three bureaus and pull your free credit reports.
- Did you already find an account or charge you don’t recognize? Go straight to IdentityTheft.gov to file a report and get a recovery plan.
- Not sure what was exposed? Re-read the breach notice, or check IdentityTheft.gov/databreach for guidance matched to your situation.
Since a data breach often means your name, address, or other details are now floating around beyond just this one company, it’s worth checking whether that information has already been collected and resold by data brokers. Our guide on removing your information from people-search sites covers how to find and request removal from those listings.
If Your Social Security Number Was Involved
A compromised Social Security number carries extra risk because it’s used to verify identity across so many systems — credit, tax filing, employment, and benefits. If your Social Security number was part of a breach, our guide on recognizing and verifying Social Security-related contact explains how scammers often follow up on breach news by impersonating the Social Security Administration itself.
Who Should Be Extra Careful
Anyone notified of a breach should take these steps, but a few situations raise the stakes further: breaches involving a Social Security number rather than just a password, breaches at a financial institution or healthcare provider, and breaches affecting a child’s information, since a child’s clean credit history makes it harder to spot fraud for years. Older adults are also frequently targeted afterward by scammers posing as bank or government representatives following up on a breach.
Evidence Limits
This article summarizes general guidance from the Federal Trade Commission’s IdentityTheft.gov and consumer.ftc.gov resources. It does not evaluate any specific company’s breach, cannot guarantee any outcome, and is not a substitute for the personalized recovery plan available at IdentityTheft.gov. Steps and contact details for credit bureaus can change; verify current information directly with each bureau or with the FTC before acting.
Frequently Asked Questions
Should I freeze my credit or place a fraud alert?
A credit freeze offers stronger protection because it blocks access to your credit report entirely, while a fraud alert only requires a lender to verify your identity first. If your Social Security number was exposed, a freeze is generally the more protective option. Both are free.
Will a credit freeze hurt my credit score?
No. A credit freeze doesn’t affect your credit score, and it doesn’t stop you from using existing credit cards, renting an apartment, or applying for a job. It only blocks new lenders from pulling your report until you lift the freeze.
How do I know if I’ve become a victim of identity theft, not just had my data exposed?
A breach means your information was exposed; identity theft means someone has actually used it. Check your credit reports and account statements for unfamiliar accounts, charges, or credit inquiries. If you find any, that’s identity theft, and you should file a report at IdentityTheft.gov right away.
Do I have to pay for credit monitoring after a breach?
Not necessarily. If the company responsible for the breach offers free credit monitoring or identity theft protection, take it. You can also monitor your own credit for free by pulling your reports from AnnualCreditReport.com and watching your account statements.
Educational Disclaimer
This article is for general educational purposes only and is not legal, financial, or cybersecurity advice. It does not evaluate any specific company, breach, or product. If you believe your personal information has been compromised, visit IdentityTheft.gov for a personalized recovery plan, contact your bank or credit card company directly, or consult a qualified attorney for guidance specific to your situation.
