Data Breach: What to Do When Your Personal Info Is Exposed

A breach notice lands in your inbox, or a news story names a company you shop with. Knowing what to do after a data breach comes down to one question: what exactly was exposed? A leaked email address calls for a password change. A leaked Social Security number calls for a credit freeze and a tax PIN. The checklist below sorts the steps by the kind of data involved, so you spend your effort where it actually protects you.

Signs your breached data is already being misused

Most people whose details show up in a breach never see any fraud. Still, watch for these warning signs in the weeks and months after a notice:

• Password reset emails or login codes you did not request
• A notice that your email, phone number or password was changed on an account
• Bills, statements or collection calls for accounts you never opened
• Hard inquiries on your credit report from lenders you do not recognize
• A letter from the IRS saying a return was already filed with your Social Security number
• Small "test" charges on a card, often a dollar or two, before a larger purchase
• Calls, texts or emails that quote your real account details and push you to act fast

That last one matters more than people expect. Breached data makes scam messages more convincing because the sender already knows your name, address or the last digits of your card. If a message uses the breach itself as the hook ("verify your account after the recent incident"), treat it as suspect and go to the company's site or app directly. Our guide on how to spot a scam email covers the patterns to look for.

Your data breach checklist, step by step

Work through these in order. The first three take about fifteen minutes, and the rest depend on what the breach notice says was taken.

1. Read the notice closely. Find the list of exposed data types: email, password, phone, address, date of birth, card number, bank account, Social Security number, driver's license or medical information. Also note whether the company offers free credit monitoring and the deadline to enroll.
2. Confirm the notice is real. Do not click links in an unexpected breach email. Go to the company's website by typing the address yourself, or search for news coverage of the breach.
3. Change the exposed password, and every reused copy of it. If the same password protects your email, bank or other shopping accounts, change those too. A password manager makes unique passwords for every site realistic.
4. Turn on multifactor authentication. The Cybersecurity and Infrastructure Security Agency suggests checking the security settings of your most used accounts for options named "Two Factor Authentication" or "Multifactor Authentication." CISA notes that phishing resistant methods such as FIDO/WebAuthn (the standard behind security keys and passkeys) are the strongest, but any MFA beats none. Start with email, since whoever controls your inbox can reset almost everything else.
5. Call your card issuer if a card number leaked. Ask for a replacement card with a new number. For a bank account number, ask the bank whether it recommends a new account and set up transaction alerts.
6. Freeze your credit if your Social Security number leaked. According to the FTC, placing and lifting a freeze is free, and it lasts until you lift it. You need to contact all three bureaus: Equifax, Experian and TransUnion. Our walkthrough on how to freeze your credit has the details for each one.
7. Consider a fraud alert as well. An initial fraud alert is also free and lasts one year, and you only need to contact one bureau, which has to tell the other two. A freeze blocks new credit outright, while an alert asks lenders to verify your identity first.
8. Get an IRS Identity Protection PIN. This six digit number stops anyone else from filing a federal return with your Social Security number. The IRS says anyone with an SSN or ITIN who can verify their identity is eligible, and the fastest way to get one is through your IRS online account. A new PIN is issued every calendar year.
9. Check your credit reports. The FTC says the three bureaus have permanently extended free weekly reports at AnnualCreditReport.com, the only site authorized to fill those orders. You can also call 1-877-322-8228. Look for accounts, addresses or inquiries you do not recognize.
10. Enroll in the free monitoring if offered. It will not prevent fraud, but it can alert you sooner. Mark the enrollment deadline from the notice on your calendar.

Which steps matter for which data

If only your email address and an encrypted or hashed password leaked, steps 3 and 4 cover you. If your phone number leaked, expect more scam texts and calls, and ask your carrier about adding a PIN to your account. If your Social Security number or date of birth leaked, do steps 6 through 9; that combination is what criminals need to open accounts in your name. For a driver's license number, contact your state's motor vehicle agency to ask about replacing it.

What to do if someone has already used your information

If you spot a red flag that turns out to be real, move from prevention to recovery.

• Report it at IdentityTheft.gov. The FTC site builds a personal recovery plan and creates an official identity theft report. That report also lets you request an extended fraud alert, which the FTC says lasts seven years and takes you off prescreened credit offer lists for five years. Our full guide on identity theft and what to do walks through the recovery plan.
• Report scam calls, texts and emails at ReportFraud.ftc.gov. If a breach led to a phishing attempt, this is the place to report it. See how to report a scam for other agencies that accept reports.
• Contact the IRS if a fake return was filed. The IRS identity theft pages explain how to respond to a notice. Keep in mind the agency says it will never ask for your IP PIN by phone, email or text, so any such request is a scam.
• Report Social Security misuse to the SSA. The Social Security Administration takes fraud reports through its online fraud reporting form. Creating a my Social Security account also lets you review your earnings record for jobs you never held.
• Dispute fraudulent accounts with each company and each bureau. Ask the company to close the account in writing, then dispute the entry on your credit report.

Keep a short record

Save the breach notice, write down the date you froze your credit at each bureau, and store your freeze PINs or login details somewhere safe. If fraud shows up a year from now, that paper trail makes disputes much faster. For more security guides like this one, browse our tech section.

One last check before you close the notice: make sure you changed the password on your email account itself. It is the key that resets every other account you own, and it is the step people most often skip.