A breach notice in your inbox does not mean someone has already stolen your identity. It means a company lost control of data tied to you, and the next few hours decide whether that exposure stays harmless or turns into fraud. This guide covers what individuals should do first, how to match your response to the exact data that leaked, and what a business must handle when the breach happens on its own systems.
What to Do in the First 24 Hours After a Data Breach
The first day decides how much damage a leak can cause, so run through these five actions in order and use the sections below for the details.
- Confirm the breach notice is real by visiting the company's site directly.
- Read which data types leaked.
- Change the exposed password everywhere you reused it and turn on two-factor authentication.
- Freeze your credit at all three bureaus if an SSN or ID number leaked.
- Call your bank on the number printed on your card if card or account details leaked.
How Do You Know a Data Breach Notice Is Real?
Scammers copy real breach announcements, so your first move is confirming the message actually came from the company.
Fake breach alerts work because they arrive while people feel anxious. They usually carry a link or phone number the attacker controls and ask you to "verify" your Social Security number, bank login or card details. A real company already knows you were affected and never needs those details from you to send a notice.
Ignore the link and the phone number inside the message. Type the company's web address into your browser yourself, or call a number printed on your card, a past bill or a receipt. If the company posted a security notice on its own site, it should match what you received.
You can also search your email address on Have I Been Pwned. It lists every known breach that included that address and the data types each one leaked, which often reveals older exposures you never heard about.
What Data Was Exposed in the Breach and How Serious Is It?
The type of information exposed sets your priorities, so read the notice for the specific data categories before you act.
Treating every breach the same wastes effort on minor leaks and leaves gaps on serious ones. Use this table to decide how hard and how fast to move.
| Exposed Data | Risk | What to Do First |
|---|---|---|
| Email address only | Low | Expect more phishing; distrust messages that mention the breach |
| Email plus password | Medium to high | Change the password on that site and every site that shares it |
| Name, phone, home address | Medium | Watch for targeted scam calls and texts |
| Card or bank account number | High | Call your bank using the number on your card and request a new card |
| Social Security number or government ID | Critical | Freeze your credit at all three bureaus today |
| Medical or insurance records | High | Review insurer statements for treatments you never received |
Low-risk leaks still matter. Criminals merge records from several breaches into one profile, and an email address plus a home address from different leaks gives them a convincing starting point for fraud.
Which Passwords Should You Change After a Data Breach?
A leaked password becomes dangerous on every other account where you reused it, not just the breached one.
Attackers load stolen email and password pairs into automated tools and try them against banks, email providers and shopping sites within hours. This technique, called credential stuffing, succeeds only because people repeat passwords. Change the breached password first, then change every account that used the same one or a close variation.
Work through your accounts in this order:
- Your primary email account, since anyone who controls it can reset almost everything else
- Banking, card and payment accounts such as PayPal
- The breached service itself
- Social media and shopping accounts that store payment details
- Any remaining account that shared the old password
A password manager such as Bitwarden generates a long, unique password for each site and remembers it for you, so one breach can never unlock your other accounts again.
Next, switch on two-factor authentication everywhere it exists, starting with email. Pick an authenticator app, a passkey or a hardware security key over SMS codes. Criminals who get your phone number from a breach sometimes attempt SIM swaps to hijack text-message codes.
Should You Freeze Your Credit After a Data Breach?
A credit freeze stops lenders from pulling your credit file, so a thief holding your Social Security number cannot open new loans or cards in your name.
US federal law makes freezes free to place and free to lift. Each bureau runs its own file, so you must freeze all three separately:
A freeze does not lower your credit score, and your existing cards and loans keep working. When you apply for new credit later, ask the lender which bureau it uses and lift the freeze only at that one, temporarily. Many people simply leave freezes on permanently.
Credit Freeze vs Fraud Alert: Which One Do You Need?
Both are free, but they protect you differently, and the data that leaked decides which one fits.
A fraud alert asks lenders to confirm your identity before approving new credit but does not block the file. You place it at one bureau, which then notifies the other two, and it lasts one year. It suits situations where you only suspect exposure or when no SSN leaked. A freeze blocks the file outright and requires a separate request at each bureau. Once a breach confirms your SSN leaked, choose the freeze. The FTC guide on credit freezes and fraud alerts compares both in detail.
What to Do If Your Card or Bank Account Number Leaked
Card and bank exposures move fastest, so contact your bank the same day you learn about the leak.
Call the number printed on the back of your physical card and ask the bank to cancel and reissue it. Then switch on transaction alerts in your banking app so every charge pings your phone. Fraudsters often test a stolen card with a tiny purchase before attempting a larger one, and alerts catch those test charges early.
Reporting speed directly affects your losses in the US:
- Credit cards: Federal law caps your liability for unauthorized charges at $50.
- Debit cards: Your liability stays at $50 if you report within two business days of noticing the problem, can reach $500 after that, and can become unlimited for unauthorized transfers you fail to report within 60 days of the statement that shows them.
That gap between credit and debit protection is one more reason to report problems immediately rather than waiting for a monthly statement.
Is Free Credit Monitoring After a Data Breach Enough?
Most companies that lose sensitive data pay for 12 to 24 months of free credit monitoring, and you should enroll even if you also freeze your credit.
The offer usually comes with an enrollment code and a deadline, and it rarely activates on its own. Sign up as soon as you receive it and add the coverage end date to your calendar.
Keep the limits in mind. Free breach monitoring typically watches one or three credit files and alerts you only after something appears. A stolen Social Security number stays useful to criminals for years, long after the free period ends. When coverage expires, decide whether you want a paid identity protection service with dark web scanning or whether a permanent credit freeze plus your own checks covers you well enough.
How Often Should You Check Your Credit Reports After a Data Breach?
Monitoring catches the fraud that slips past your other defenses, and stolen data often sits unused for months before criminals act on it.
Pull your reports from AnnualCreditReport.com, the only federally authorized source of free reports. All three bureaus now let you check weekly at no cost, so you never need to pay a third party for a report. Look for:
- Accounts you never opened
- Hard inquiries you did not authorize
- Addresses or employers you never had
Check monthly for the first six months after a serious breach, then quarterly for at least two years. If your SSN leaked, treat vigilance as permanent. If medical data leaked, read every Explanation of Benefits statement from your insurer for services you never received. If your SSN leaked, the IRS Get Transcript tool shows whether someone filed a return in your name.
What to Do If Identity Theft Already Happened
If you spot a strange account, a debt collector chasing money you never borrowed, or a rejected tax return, start a formal recovery case right away.
IdentityTheft.gov, run by the Federal Trade Commission, asks what happened and builds a personal recovery plan. It also prefills the dispute letters and identity theft affidavit you send to credit bureaus, banks and collectors. The service is free.
To report a scam or phishing attempt without opening a full recovery case, use ReportFraud.ftc.gov. Filing a report even before fraud occurs creates a paper trail that helps later disputes.
Scams to Expect After a Data Breach
Breach data fuels the next wave of attacks, which usually arrive as targeted messages rather than direct break-ins.
Expect these tactics in the weeks after a breach:
- Fake "security alert" emails that name the breached company and ask you to log in through a link
- Phone calls from a "fraud department" asking you to read back a one-time code
- Extortion emails that quote an old leaked password to make a threat look real
- Offers of free credit monitoring that ask for your card number
None of these deserve a reply. Real companies never request passwords, one-time codes or full SSNs through unsolicited contact. Hang up, then call back on a number you found yourself.
How to Protect Yourself From the Next Data Breach
You cannot erase leaked data from criminal marketplaces, but you can reduce how much new data future breaches can expose.
A few habits make the biggest difference:
- Delete dormant accounts. Old shopping and forum accounts still hold your details and still get breached.
- Split your contact details. Use a secondary email and a virtual phone number for signups and newsletters, and keep your main email for banking and work.
- Trim data broker listings. People-search sites publish your address, age and relatives, which criminals combine with breach data. Opt out of the major brokers or use a removal service.
- Set breach alerts. Have I Been Pwned can email you whenever your address shows up in a new breach.
- Keep devices updated. Patches close the known flaws that attackers exploit to steal credentials in the first place.
What Should a Business Do After a Data Breach?
When your organization suffers the breach, containment and evidence come before any public statement.
Contain the Attack Without Destroying Evidence
Disconnect compromised servers and endpoints from the network to block further data theft and lateral movement, but avoid powering them off or wiping them. Capture disk images, memory dumps and firewall, endpoint and authentication logs first. Investigators, insurers, regulators and law enforcement all rely on that evidence, and a premature rebuild erases it.
Rule Out Infostealer Malware Before Resetting Passwords
Many breaches start with credentials harvested by infostealer malware on an employee laptop. If that device stays infected, any new password typed on it goes straight back to the attacker. Use this order:
- Scan the affected devices and reimage any that show infection.
- Revoke active sessions, API keys and access tokens.
- Reset passwords from clean machines only.
- Enforce MFA on every account that supports it.
Bring In Counsel, Forensics and Your Insurer Together
Engage breach counsel and a digital forensics firm at the same time rather than one after the other. Notify your cyber insurance carrier within the first day, since most policies set strict reporting windows and require approval before you hire outside firms. Late notice can shrink or void your coverage. For criminal activity, report to the FBI Internet Crime Complaint Center.
Meet Every Notification Deadline That Applies
Your obligations depend on your industry and on where affected people live, not where your company sits. Common deadlines include:
| Rule | Who It Covers | Deadline |
|---|---|---|
| GDPR Article 33 | Organizations handling EU residents' personal data | 72 hours to the supervisory authority after becoming aware |
| HIPAA Breach Notification Rule | US healthcare covered entities and business associates | Up to 60 days to notify affected individuals |
| FTC Safeguards Rule | US non-bank financial firms, breaches of 500+ consumers | 30 days to notify the FTC |
| SEC cybersecurity disclosure rule | US public companies | Form 8-K within 4 business days of a materiality decision |
| US state breach laws | Any business holding residents' data | Varies by state, some as short as 30 days |
A clear notification letter states what happened and when, which data types leaked, what you did in response, what recipients should do, and how to reach you. Specific wording earns more trust than vague phrases like "a limited incident." Offer free credit monitoring when SSNs, financial accounts or medical records leaked.
Fix the Root Cause and Test the Plan
Patch the vulnerability the attacker used, then check every similar system for the same flaw. Restore only from backups taken before the earliest sign of compromise, and test restored systems in isolation before reconnecting them. Within two weeks, run a lessons-learned review, update your incident response plan and contact lists, and schedule a tabletop exercise within 90 days to prove the updated plan works.
Frequently Asked Questions
What is the first thing I should do after a data breach notice?
Confirm the notice is real by visiting the company's website directly instead of clicking its link. Then read which data types leaked, because that decides whether you change passwords, call your bank or freeze your credit.
Does a credit freeze hurt my credit score?
No. A freeze has no effect on your score, and your current cards and loans keep working. It only blocks new lenders from pulling your file until you lift it.
Should I close an account that was part of a breach?
Usually not. Closing a credit account can shorten your credit history and reduce available credit. Change the password, enable two-factor authentication and monitor the account instead. Close it only if fraud appears or the company keeps failing to protect your data.
Can I remove my leaked data from the dark web?
No. Once criminals copy and resell data, no one can pull it back. Your goal is to make the data useless by rotating passwords, adding two-factor authentication and freezing your credit.
How long should I watch my accounts after a breach?
Plan on at least 12 to 24 months for most breaches. If your Social Security number leaked, keep your credit frozen and keep checking reports indefinitely, since criminals can use an SSN years later.
Can I sue a company that leaked my data?
Sometimes. California's privacy law lets consumers sue for statutory damages when poor security leads to certain unencrypted data being stolen, and a few other states allow similar claims. For most people, a class action settlement is the more realistic route, and you should file claims only on the official settlement administrator's site.
Related Guides
- Charter Communications Data Breach: ShinyHunters Claims 42 Million Records Stolen
- 7-Eleven Data Breach 2026: ShinyHunters Steal Personal Data of 185,000 People
- Ingram Micro Ransomware Attack Exposes Data of 42,000 People
- Eiliko Robot Hack: Millions of Private Chats Exposed, Is It Safe and What Owners Should Do Now
