Breach notices arrive by the million and most of them feel identical. The useful question is not how alarming the letter sounds but what kind of data was taken, because that determines what you actually have to do. This checklist runs in priority order and takes about an hour if you work through it properly.
Step 1: Read what was exposed, specifically
Breach notices are required to tell you the categories of data involved. The wording matters:
- Email address only: expect more phishing, but no account takeover risk by itself.
- Password or password hash: this is the urgent one, because of password reuse. If that password is used anywhere else, those accounts are exposed too.
- Full name, address, date of birth: identity-theft risk, but usually not immediate financial risk on its own.
- Social Security number, tax ID or government ID number: treat as high risk. Credit freezes and monitoring become worth doing.
- Card or bank account numbers: contact the financial institution directly using the number on your card or statement — never a number from the notice.
- Medical or disability information: health-data risk, and in some jurisdictions additional protections apply.
If the notice is vague about what was taken, that is itself worth noting. You cannot assess risk without it.
Step 2: Change the exposed password everywhere it is reused
One breach of a low-stakes service becomes a key to everything else if the same password is used elsewhere, because attackers try leaked credentials against other sites automatically. Start with email, because email is the recovery route for almost every other account, then banking and payment accounts, then anything holding payment details.
Use a password manager and let it generate long, unique passwords. Reusing one strong password across ten sites is weaker than ten different ones you never memorise.
Step 3: Turn on two-factor authentication, starting with email
Two-factor authentication makes a stolen password much less useful. Prefer an authenticator app or a hardware security key over SMS codes, because SMS can be intercepted through SIM-swap attacks. If a service offers passkeys, use them.
Email first, always. If someone controls your inbox they can reset almost everything else, so the recovery chain has to start there.
Step 4: Freeze your credit, or at least set a fraud alert
A credit freeze prevents new accounts being opened in your name. It is free to place and free to lift temporarily when you actually want to apply for credit. In the United States you place a freeze with each of the three major bureaus separately.
A fraud alert is a lighter measure: it lasts a year, is free, and requires lenders to verify your identity before opening an account. A freeze is stronger; an alert is faster to set up.
Step 5: Check your credit reports and your account statements
Pull your reports and look for accounts, inquiries or addresses you do not recognise. Then check bank and card statements line by line for small unfamiliar charges — fraud often starts small to test whether anyone is watching.
Step 6: Take the free monitoring if it is offered — and verify the site
Organisations usually offer 12 to 24 months of identity monitoring after a breach. Take it; it costs you nothing. Enrollment deadlines matter and are often a year or more out, but do not assume you have unlimited time.
Critical detail: enroll by typing the provider’s web address yourself or using a link you have verified, not by clicking a link in an unexpected email. Breach follow-ups are one of the most reliable phishing pretexts there is, precisely because people are expecting correspondence about the breach. Government guidance is consistent on this — do not click links in unexpected messages, and look up the number yourself rather than using one supplied to you.
Step 7: Expect the follow-up scam, and know its shape
The most common post-breach fraud is not sophisticated hacking — it is someone calling or texting, claiming to be from the breached company, the credit bureaus or a government agency, and asking you to “verify” information. Legitimate organisations do not call to ask for your password, your full Social Security number or a one-time code.
Practical rule: end the call, then contact the organisation through a channel you looked up independently.
What is not worth doing
Do not pay for a premium identity-theft service before using the free one you were offered. Do not close accounts unnecessarily — a closed credit card can shorten your credit history. And do not assume a breach notice means your identity has already been stolen; it means the data is out there, which is a risk to manage, not a loss to absorb.
Sources
- IdentityTheft.gov (US Federal Trade Commission), “What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach”: https://www.identitytheft.gov/Info-Lost-or-Stolen
- US Federal Trade Commission, “What To Do After a Data Breach”: https://consumer.ftc.gov/media/79862
- Australian Cyber Security Centre, “Personal cyber security: Next steps guide”: https://www.cyber.gov.au/protect-yourself/resources-protect-yourself/personal-security-guides/personal-cyber-security-next-steps
- Have I Been Pwned (breach lookup service): https://haveibeenpwned.com/
- California Department of Education / ETS breach notification (a current worked example of a notice and its identity-protection offer): https://www.cde.ca.gov/nr/in/ets-notification.asp
