A data breach notification letter tells you that a company lost control of your personal information. The letter is not the emergency. What a criminal can do with the exposed data is. This guide walks you through the exact steps to take in the first week after the letter arrives, matched to the type of data that was exposed, with the official sources for each step.
Most of these steps are free and take less than an hour in total. Work through them in order and skip the ones that do not apply to the data listed in your letter.
Step 1: Confirm the letter is real
Scammers copy breach letters to steal the very data you are trying to protect. Do not call a phone number, scan a QR code or visit a link in the letter until you confirm it. Instead, find the company’s contact details on its official website or on a statement you already have, and ask whether it sent the notice.
You can also search public breach lists. The California Attorney General, the Maine Attorney General and the Washington Attorney General post notices that companies file with them. Health breaches affecting 500 or more people appear on the HHS breach portal and in our HIPAA Breach Tracker.
What success looks like: you found the same notice on the company’s own site or on a state or federal list, or the company confirmed it by phone at a number you looked up yourself.
Step 2: List exactly what was exposed
Breach letters usually name the types of data involved. Write them down, along with the date of the breach, any enrollment code and the deadline to sign up for services. Your next steps depend on that list:
- Social Security number: highest risk. Do Steps 3, 4, 5 and 6.
- Bank or card numbers: do Step 7.
- Email address and password: do Step 8.
- Medical or health insurance data: do Step 9.
- Name, address, phone or email only: expect more targeted phishing and do Step 10.
What success looks like: you have a short written list of exposed data types and every deadline in the letter.
Step 3: Freeze your credit at all 3 bureaus
A freeze stops anyone from opening new credit in your name. It is free, does not affect your credit score and lasts until you lift it. Place it separately at Equifax, Experian and TransUnion. Our guide on how to freeze your credit after a data breach has the verified links, phone numbers and lift steps for each bureau, plus the specialty bureaus.
What success looks like: you have 3 freeze confirmations, 1 from each bureau.
Step 4: Accept free credit monitoring if offered
If the letter offers free monitoring, enroll before the deadline. The FTC’s IdentityTheft.gov recommends accepting it. Monitoring alerts you after something happens, so it works alongside a freeze, not instead of one.
Only some states require companies to offer monitoring, and usually only when Social Security numbers are exposed. Connecticut requires 24 months, Massachusetts requires at least 18 months and Delaware requires 1 year. In other states, an offer is voluntary.
What success looks like: you receive an enrollment confirmation email before the deadline in the letter.
Step 5: Lock down your Social Security number
- Get an IRS Identity Protection PIN. The IP PIN is a 6-digit number that stops anyone else from filing a federal tax return with your SSN. Anyone who can verify their identity can enroll through an IRS online account.
- Create your my Social Security account at ssa.gov/myaccount before a criminal does, and review the earnings on your Statement for jobs that are not yours.
- Turn on E-Verify Self Lock at e-verify.gov. It flags your SSN if someone tries to use it to get a job at an employer that uses E-Verify. You can unlock it any time a new employer needs to verify you.
What success looks like: your IP PIN shows in the Profile tab of your IRS online account, and your Self Lock shows as active in myE-Verify.
Step 6: Check your credit reports every week
Free weekly credit reports from all 3 bureaus became permanent in 2023. Get them at AnnualCreditReport.com or by calling 1-877-322-8228. Look for accounts, hard inquiries and addresses you do not recognize.
What success looks like: every account and inquiry on all 3 reports belongs to you.
Step 7: Replace exposed bank and card numbers
Call the number on the back of your card or on your bank statement. Ask for a new card number or account number, and turn on transaction alerts in the bank’s app. Review the last 3 months of statements for charges you did not make.
What success looks like: the bank confirms new numbers are on the way and alerts are active.
Step 8: Change exposed passwords and turn on MFA
Change the password on the breached account first, then on every other account that used the same password. Use a unique password for each account. Our free password generator can help. Turn on multi-factor authentication wherever the site offers it, and prefer an authenticator app or passkey over text messages.
What success looks like: no 2 accounts share a password, and your email account has MFA turned on.
Step 9: Watch your medical records
Medical identity theft shows up as care you never received. Read every explanation of benefits from your insurer. Under HIPAA, you can request an accounting of disclosures from a provider or health plan covering up to 6 years, as set out in 45 CFR 164.528. The first request in any 12-month period is free, and the covered entity must act within 60 days.
The accounting has limits. It excludes disclosures for treatment, payment and health care operations, so it will not list every routine use of your records. It is still useful for spotting disclosures you did not expect.
What success looks like: every claim on your insurance statements matches care you received.
Step 10: Expect follow-up phishing
Breached contact details are often reused in scams that mention the breach by name. The FTC says to contact a company using a phone number or website you know is real, not the details in a message. Report phishing to the FTC at ReportFraud.ftc.gov, and report internet crime to the FBI’s IC3.
What success looks like: you ignore unexpected contacts about the breach and start every call or login from a source you trust.
If someone already used your information
Report it at IdentityTheft.gov. You get an identity theft report and a personal recovery plan, and the report lets you place a 7-year extended fraud alert. If someone used your SSN for taxes or work, contact the IRS at 1-800-908-4490.
Common mistakes
- Calling the number in an unverified letter. Confirm the letter first.
- Treating monitoring as protection. Monitoring reports fraud after it happens. A freeze prevents new accounts.
- Freezing only 1 bureau. Lenders choose which bureau to check.
- Missing the enrollment deadline. Free monitoring offers expire.
- Changing only the breached password. Any reused copy is still exposed.
- Waiting for fraud before acting. Every step above works best before a criminal uses your data.
Related reading
- What Is Data Extortion? A Complete Guide to Modern Cyber Extortion
- How to Check If an Infostealer Stole Your Passwords and What to Do
- Frontline Education Confirms Data Breach Exposing SSNs and Student IDs From K-12 School Districts
- Denver Health Plan Vendor SquareML Left Access Key Public for 417 Days, Putting 238,083 Members at Risk
- Astrana Health Confirms Data Breach After Attackers Spoof Corporate Phone Number
Last verified: November 1, 2026
