What to Do in Case of a Data Breach

Discovering that your personal information was exposed in a data breach can be alarming. Whether the breach involved passwords, financial records, or sensitive personal identifiers, taking fast, structured action dramatically reduces your risk of identity theft and financial loss.

What to Do First

1. Confirm the breach and identify exposed data: Read official notifications from the organization involved. Determine exactly what was compromised, such as passwords, credit card numbers, Social Security numbers, or contact details.
2. Change exposed passwords immediately: Update passwords for any compromised accounts. If you reused the affected password on other websites, change those immediately as well. Create long, unique passwords or use a password manager.
3. Enable multi-factor authentication (MFA): Turn on MFA across all critical online accounts, especially primary email, banking, and password managers. Use authenticator apps or hardware security keys instead of SMS text messages where possible.
4. Freeze your credit reports: Contact major credit bureaus to place a security freeze on your credit reports. A credit freeze prevents lenders from accessing your file, blocking identity thieves from opening new accounts in your name.
5. Place a fraud alert: If you prefer not to freeze your credit, place a temporary fraud alert on your credit file. This requires businesses to verify your identity before issuing new credit.

What NOT to Do

• Do not click on links in unexpected breach notifications: Scammers often launch phishing campaigns following public breach announcements. Access account portals directly through official websites or apps rather than email links.
• Do not reuse passwords across multiple sites: A single leaked password can give attackers access to multiple services if credentials are shared.
• Do not ignore minor unauthorized charges: Cybercriminals often test stolen payment cards with tiny transactions before attempting larger thefts.
• Do not share personal verification codes: Never give two-factor authentication codes or one-time passcodes to anyone over the phone or via messaging.

What to Monitor

Ongoing vigilance is critical after a breach, as stolen data may be traded or used months after the initial incident.

• Bank and payment statements: Review transaction logs frequently for unfamiliar charges.
• Credit reports: Request free credit reports periodically to check for unauthorized inquiries or new lines of credit.
• Email account activity: Monitor sign-in logs and forwarding rules in your email account to ensure unauthorized parties have not gained access.
• Tax and government notices: Watch for unexpected correspondence regarding unfamiliar filings or benefits claims.

When to Seek Professional Help

If you discover active identity theft, such as unauthorized bank transfers, fraudulent tax returns, or new credit accounts opened in your name, report it immediately to relevant national identity theft resources and your local law enforcement agency. File an official police report to document the crime for financial institutions.

Take immediate control of your account settings today, freeze your credit files, and remain cautious of follow-up phishing attempts.