Got a Data Breach Notice? What to Do Next to Protect Your Money and Identity

If you received a data breach letter, do three things today: freeze your credit, change the passwords that matter and watch your accounts closely. None of these steps costs money, and together they block the most common ways criminals turn leaked data into stolen cash. The rest of this guide explains why each step works and what to do about the details.

What a Data Breach Notice Really Means

A breach letter can feel alarming, and it can also feel routine. After enough of them, many people toss the envelope or archive the email. That is understandable, but it is a mistake. Your information may now be in the hands of people who plan to use it.

Why You Keep Getting These Letters

Data breaches are not rare events. The Identity Theft Resource Center, a U.S. nonprofit, tracked 3,322 data compromises in 2025, a record and up 5% from 3,152 the year before. Over five years, the count has risen by 79%.

The number of people affected was lower in 2025, at about 279 million victim notices compared with more than 1.3 billion in 2024. The ITRC attributes the drop to the absence of mega-breaches that year. In other words, fewer giant incidents, but plenty of smaller ones.

Financial services topped the list with 739 compromises, followed by healthcare with 534. The companies that hold your money and your medical records are the ones most often hit.

What Information Was Taken Matters

Not every breach carries the same risk. A leaked email address is an annoyance. A leaked Social Security number is a long-term problem, because you cannot easily change it.

Read the notice for the exact categories of data involved. They usually fall into a few groups:

• Contact details: name, email address, phone number, home address
• Account credentials: usernames, passwords, security questions
• Financial data: card numbers, bank account numbers
• Government identifiers: Social Security, passport or driver’s license numbers
• Health information: insurance IDs, diagnoses, prescriptions

The more sensitive the category, the more urgent your response.

The Notice Often Leaves Out Details

Many letters say little about how the attack happened. According to the ITRC, 70% of notices in 2025 gave no details about the attack method, up from 45% in 2023. That means you often cannot judge the danger from the letter alone.

The practical answer is to assume the worst for the data types listed. If your name and Social Security number appear in a notice, act as though a criminal already has them.

How Leaked Data Turns Into Losses

Criminals rarely use stolen data right away. Records are bundled, sold and combined with information from other breaches. A name from one leak, an address from another and a phone number from a third can add up to a convincing profile.

Those profiles power several kinds of attack:

Why Acting Early Beats Waiting

Some people hold off, reasoning that nothing bad has happened yet. The trouble is that misuse is often delayed. Stolen records can sit unused for months, then appear in a wave of fraud once a buyer has combined them with other data.

Acting early costs you little and closes doors before anyone tries them. Waiting until you see a strange charge means you are already in recovery mode. A freeze placed today can prevent an account that would otherwise take weeks to untangle.

Your First Week: The Essential Steps

You do not need to be an expert to protect yourself. You need to do a short list of things in a sensible order. Here is the plan for the first week.

Step 1: Confirm the Notice Is Real

Breach notices are a favorite disguise for scammers. A fake letter or email can say that your data was exposed and urge you to click a link or call a number.

Before acting, verify the notice. Do not use any link or phone number in the message. Go to the company’s website by typing its address, or call the number on a card or statement you already hold. Our guide to spotting imposter scams lists the warning signs.

Step 2: Change the Passwords That Were Exposed

If the notice mentions passwords or you used the breached service, change your password for it right away. Then change it anywhere else you used the same one.

Reused passwords are the main reason a small breach becomes a large one. Criminals test leaked logins on other sites automatically. Use a password manager to give every account its own long, random password.

Where possible, go further and move to passkeys. They cannot be reused or typed into a fake page, which makes leaked passwords far less useful. We explain how they work in our article on passkeys and your bank account.

Step 3: Turn On Stronger Sign-In Protection

Add two-factor authentication to your email, your bank and any account that holds money. An authenticator app is stronger than text message codes, which can be intercepted or redirected.

Your email deserves special care. It is the reset point for nearly everything else, so protect it first.

Step 4: Freeze Your Credit

A credit freeze is the most powerful single step against identity theft. According to the Federal Trade Commission, a freeze means that “nobody can open a new credit account in your name, including you.” It does not affect your credit score, and it is free.

To place one, contact each of the three credit bureaus: Equifax, Experian and TransUnion. A freeze lasts until you lift it, and you can lift it temporarily when you apply for credit yourself.

Step 5: Consider a Fraud Alert

A fraud alert is a lighter measure. An initial alert lasts one year and requires lenders to verify your identity before granting new credit. You contact one bureau, and it notifies the other two.

If you are a confirmed identity theft victim with an FTC or police report, you can request an extended alert, which lasts seven years. You can place a fraud alert even if you already have a freeze.

Freeze vs. Fraud Alert at a Glance

Monitoring and Spotting Trouble Early

Prevention shuts the main doors. Monitoring catches what gets through. The breach itself may be old news, but misuse can surface months or years later.

Watch Your Accounts

Review your bank and card statements at least weekly for the next several months. Turn on transaction alerts so you see every payment as it happens.

Pay attention to small charges. Criminals often test a stolen card with a tiny purchase before attempting larger ones. A strange one-dollar charge deserves a call to your bank.

Set Alerts That Fit Your Routine

Alerts only help if you read them. Choose notifications you will actually see, such as push messages from your bank app for every transaction above a small amount.

Add a login alert on your email account too. A message that says someone signed in from a new device is often the earliest sign that a leaked password is being tried.

Check Your Credit Reports

In the United States, you can request your credit reports from each bureau through the official site AnnualCreditReport.com. Look for accounts you do not recognize, unfamiliar addresses and inquiries you did not authorize.

Checking reports stays useful even with a freeze in place. A freeze blocks new accounts, but it will not reveal fraud on an existing one.

Learn the Signs of Identity Theft

Some signals show up outside your accounts. Watch for:

1. Bills or collection calls for debts you never took on
2. Denied applications despite a good credit history
3. Tax notices saying a return was already filed in your name
4. Medical statements for treatment you did not receive
5. Mail that stops arriving, which can mean someone changed your address

Any one of these is worth investigating immediately.

Beware of Follow-Up Scams

After a breach, criminals know you are anxious. They may call posing as your bank, offering to “secure” your account. They may send an email promising free identity protection.

Never share a one-time code, and never move money to a “safe account.” Hang up and call the number on your card. Voice cloning makes phone impersonation more convincing, a trend we covered in our article on deepfake scams and AI voice cloning.

If Your Information Is Already Being Misused

Sometimes the damage is already visible. A fraudulent account appears, or a payment you did not make leaves your bank. The goal now is to contain the harm and document everything.

Act Quickly on the Accounts Involved

Contact the bank or lender where the fraud occurred. Use the fraud department’s number from the official website or a statement. Ask them to close or freeze the affected account and to open a fraud case.

Keep a log of every call, with the date, the name of the person and a reference number. This record can matter if a dispute drags on.

Report Identity Theft to the Authorities

In the United States, the Federal Trade Commission runs IdentityTheft.gov, where you can report what happened and receive a recovery plan. The report also supports an extended fraud alert and disputes with creditors.

You may also file a police report, especially if the fraud is large or involves a stolen identity used for crimes. Some lenders ask for one.

Dispute Errors With Credit Bureaus

Write to each bureau about fraudulent accounts or inquiries, and include a copy of your identity theft report. Bureaus are required to investigate and correct inaccurate information. Keep copies of everything you send, and follow up if you do not hear back.

Use Free Monitoring With Care

Companies hit by breaches often offer free credit monitoring for a year or two. It is worth accepting, because it costs nothing and adds a layer of alerts.

Read the terms, though. Some offers come with marketing and an automatic paid renewal. Monitoring tells you when something happens, but it does not prevent it. A freeze remains the stronger protection.

How to Shrink Your Exposure for Next Time

You cannot stop companies from being breached. You can limit what they hold about you and how much damage a leak can do.

Share Less, Delete More

Give companies the minimum they need. Skip optional fields, and avoid sharing your Social Security number unless it is required. Delete accounts you no longer use, because a dormant account still stores your data.

Data brokers add to the problem by selling profiles built from many sources. Our article on data brokers and your financial privacy explains how to request removal.

Use Unique Emails and Card Controls

Using a separate email address for financial accounts keeps your main inbox from becoming a master key. Many banks also let you create virtual card numbers for online shopping, so a leaked number can be shut off without replacing your real card.

Build a Simple Yearly Routine

Once a year, run a short check. Review your credit reports, update your recovery information, clear old accounts and confirm that your credit freezes are still in place. A small routine beats a panicked response.

Frequently Asked Questions About Data Breaches

Do I need to do anything if my breach notice only mentions my email address?

Usually your risk is lower, but you should still change that password and any matching ones. Expect more phishing messages. A freeze is not required for an email-only leak, but it is a cheap safeguard.

Does a credit freeze hurt my credit score?

No. The FTC states that a freeze does not affect your credit score. It only blocks new accounts from being opened. You can lift it temporarily whenever you apply for credit.

Is free credit monitoring from the breached company enough?

It helps, but it is not enough alone. Monitoring alerts you after something changes, while a freeze prevents new accounts from being opened. Use both if you can.

Can I sue the company that lost my data?

Sometimes. Breach-related class actions are common, and you may receive a settlement notice. Laws and outcomes vary widely, so check the notice for deadlines and consider speaking to a lawyer for your situation.

How long should I stay alert after a breach?

Longer than most people expect. Stolen data can circulate for years. Keep your freeze in place and review your reports at least once a year.

Should I change my Social Security number?

Almost never. The government grants a new number only in rare, severe cases. A credit freeze and regular monitoring are the practical alternatives.

What if I did not receive a notice but suspect a breach?

Check a reputable breach lookup service for your email address, and review recent account activity. If you find a match, follow the same steps as if you had received the letter.

Conclusion: Turn a Scary Letter Into a Short To-Do List

A data breach notice is not a verdict. It is a prompt to close a few doors that criminals might use. Confirm the notice is genuine, change your passwords, turn on strong sign-in protection and freeze your credit.

After that, keep watching. Check your statements, review your credit reports and treat unexpected calls and messages with caution. A few steady habits will take most of the value out of whatever leaked.

This article is for general information only and is not financial or legal advice. Rules on credit freezes, fraud alerts and consumer remedies vary by country and state, so check your local guidance.