Home / Guides / Everyday Privacy

What to Do After a Data Breach

Last reviewed September 21, 2026 · 2 min read

Getting a data-breach notice is stressful, but most of the damage can be prevented with a few steps taken quickly. This checklist is written for readers in the United States.

First: understand what was exposed

Read the notice carefully. It should say what kinds of data were involved, for example email addresses, passwords, Social Security numbers, financial information or health records. The steps you need depend on that. You can also search for your email address on Have I Been Pwned, a free service that tracks known breaches.

If passwords or logins were exposed

1. Change that password immediately, and on any other site where you used it.
2. Use a unique password for each account, ideally through a password manager.
3. Turn on two-factor authentication.
4. Watch for password-reset emails you did not request.

If financial information was exposed

1. Contact your bank or card issuer and ask about replacing the card.
2. Check recent statements and set up alerts for transactions.
3. Report anything you do not recognize right away.

If your Social Security number or other identity data was exposed

1. Freeze your credit. A credit freeze is free by federal law. Ask each of the three credit bureaus (Equifax, Experian and TransUnion) to freeze your file. This blocks most new accounts from being opened in your name.
2. Consider a fraud alert, which is also free and asks lenders to verify your identity.
3. Check your credit reports for free through the official site, AnnualCreditReport.com.
4. Consider an Identity Protection PIN from the IRS to prevent someone filing a tax return in your name.
5. Be careful with offers of free monitoring. A company that suffered a breach may provide it. Read the terms first.

Watch for follow-up scams

After a breach, scammers send emails and texts pretending to be the company, your bank or a government office. Do not click links in unexpected messages. Contact the organization through the number on its official website. See how to spot a phishing email.

If you think your identity has been stolen

Go to IdentityTheft.gov, the official U.S. government site. It creates a personal recovery plan based on what happened to you, and helps you report to the Federal Trade Commission.

Keep records

Save the breach notice, the date and the actions you took. This helps if you have to dispute fraudulent charges or accounts later.

Longer-term habits

• Use unique passwords and two-factor authentication.
• Give your Social Security number only when required.
• Review your accounts and credit reports regularly.
• Delete accounts you no longer use, so there is less data for a company to lose.