What to do after a data breach exposes your information

Published October 22, 2026

After a data breach, find out exactly what was exposed and act on that: change the password if it was a login, replace the card if it was a card number, and freeze your credit if it was your Social Security number. Then turn on two-step verification, accept any free monitoring offered, and watch for scam calls or emails that mention the breach.

These steps follow the Federal Trade Commission's guidance at IdentityTheft.gov. Most “after a data breach” guides are written for the company that was breached; this one is for the person whose data was taken.

Step 1: find out what was exposed

Read the notice carefully: by law it should say what kind of information was involved. If you got it by email, don't click its links; go to the company's website yourself. To see older breaches, check your email address free at Have I Been Pwned.

Step 2: act on what was exposed

What was exposed	What to do
Social Security number	Freeze your credit, check your credit reports, get an IRS Identity Protection PIN, accept the free monitoring offered
Password or login	Change it now, and anywhere you reused it; turn on two-step verification
Credit or debit card	Call the bank to cancel and replace the card; check recent charges
Bank account number	Ask the bank to close it and open a new one; watch for unauthorized transfers
Driver's license	Contact your state DMV; watch for accounts or traffic tickets in your name
Email address only	Expect phishing that mentions the breach; don't click links about it
Health information	Read every insurer “explanation of benefits” for care you didn't receive
Children's information	Freeze your child's credit at each bureau (free under 16)

If your Social Security number was exposed

Freeze your credit at Equifax, Experian and TransUnion, and ideally Innovis, ChexSystems and NCTUE too. It's free and blocks new accounts. Step by step: how to freeze your credit at all six bureaus.
Check your credit reports free at AnnualCreditReport.com, every week if you like.
Protect your tax refund: request an IRS Identity Protection PIN, and file early.
Accept the free monitoring the company offers. It's a bonus on top of the freeze, not a replacement.

If a password was exposed

Change it at that company right away, then everywhere you used the same or a similar password; start with email and banking. Turn on two-step verification with an authenticator app. A password manager makes unique passwords painless.

Watch for the follow-up scam

Breaches are followed by scams that use the news: calls “from the company” offering a refund, emails asking you to “confirm your identity”, fake settlement sites. The real company won't ask for your password, full Social Security number or bank login. Hang up and call the number on its official site.

If someone already used your information

Report it at IdentityTheft.gov or by calling 1-877-438-4338 to get a recovery plan. The full walk-through is in identity theft: what to do right now. If you're weighing a paid protection service, see is identity theft protection worth it?

Sources: FTC, Data Breach Resources · IdentityTheft.gov · FTC consumer alert on data breaches · Have I Been Pwned. As of October 2026.

Questions people ask

How do I know if my information was in a data breach?

Companies usually notify you by letter or email. You can also check your email address for free at Have I Been Pwned, which lists breaches where that address appeared. Then follow the steps for the type of data that was exposed.

Should I accept the free credit monitoring offered after a breach?

Usually yes, it costs you nothing. But monitoring only tells you after something happens; a credit freeze stops new accounts before they're opened. Do both.

Is the data breach letter I got real?

Possibly, but scammers send fake ones. Don't call numbers or click links in the letter or email. Find the company's contact details on its official website and confirm there, and never give your full Social Security number to someone who contacts you.

Can I get money from a data breach settlement?

Sometimes. When a breach leads to a class action settlement, a court-approved administrator opens a claims website. Find it through the court or official news coverage of the settlement; ignore sites that ask for a fee or your bank login to file a claim.

More guides

How much do managed IT services cost in Houston? — What Houston providers charge per user in 2026, what each tier includes, hurricane-season must-haves, and our own measurement of Houston business email.
Identity theft: what to do right now — Someone used your name or opened a card in it: the steps in order, from the first call to a clean credit report, with every official link.
How to freeze your credit at all six bureaus — Not just Equifax, Experian and TransUnion: Innovis, ChexSystems and NCTUE too. Free, no effect on your score, with every link and phone number.
Is identity theft protection worth it? — When paying is worth it and when free steps are enough, with Aura and LifeLock 2026 prices and what identity theft insurance really pays.
Aura vs LifeLock: prices, coverage and which to choose — Both compared with prices from their own sites: credit bureaus, stolen-funds limits, data removal, family plans and who each suits.
Ransomware recovery: what to do first and which service to call — The first hour, who to call, free decryptors, whether to pay, and how to pick a recovery service that won't quietly pay the attackers.
How to remove your personal information from the internet — Free opt-outs, California's DROP, Google's removal tool, and DeleteMe vs Incogni with 2026 prices.
California DROP: how to delete your data from every data broker at once — Step by step through California's free DROP: verify residency, build your profile, track each broker, and what DROP can't delete.
SOC 2 certification cost: Type 1 vs Type 2, line by line — What a first SOC 2 really costs in 2026: the CPA audit, readiness, software, pen test and your own team's time, with the ranges that hold up and how to cut them.
Vanta competitors: what buyers actually pay for each one — Drata, Secureframe, Sprinto, Thoropass and Hyperproof against Vanta, with the median prices real buyers paid and who each one fits.
Vanta pricing: what buyers actually pay — Median $20,000 a year across 375 purchases: price by company size, the add-ons and audit that cost extra, and how buyers negotiate it down.
Vanta vs Drata: real prices and which to choose — 611 real purchases compared: median price, ranges by size, frameworks, discounts, and which one fits a first SOC 2 or a scaling company.
Drata alternatives: real prices and who each one fits — Vanta, Secureframe, Sprinto, Thoropass and Hyperproof against Drata, with median prices paid and why companies switch.
Drata pricing: what companies really pay — Median $24,934 a year across 236 purchases: costs by company size, add-ons and audit fees, renewal increases and how to negotiate.
Secureframe vs Vanta: prices, plans and which to choose — Same median price, different strengths: multi-framework costs, CMMC, reviews and free trial, with real buyer data.
KnowBe4 pricing: per-user cost and what buyers really pay — List price per user by seat count turned into yearly cost, what 684 buyers really paid, add-ons, and the renewal increase to watch.
KnowBe4 alternatives: prices compared, including free ones — Huntress, Hoxhunt, Proofpoint, Microsoft's built-in training and free Gophish, with 2026 prices and who each one fits.
Cybersecurity for small business: the 10 controls that matter — The short list that stops most attacks on a small company, what each control costs per user, and the free government guides behind it.
23 NYCRR 500: the NYDFS cybersecurity regulation in plain English — Who Part 500 covers, the limited exemption, MFA and asset inventory since November 2025, the 72-hour notice and the April 15 filing.
CCPA cybersecurity audit requirements: who, what and when — Which businesses need California's annual cybersecurity audit, the 2028–2030 deadlines by revenue, and what the auditor checks.
HIPAA compliance for dental offices: a practical checklist — Risk analysis, safeguards, business associate agreements, patient access and breach notices for a dental practice, with HHS's free tools.
FTC Safeguards Rule checklist, and how the WISP fits in — The ten elements of the rule, the under-5,000-customer exemption, the 30-day breach notice, and IRS Publications 5708 and 4557 for tax preparers.