5 Steps to Take After a Data Breach, in the Right Order
What to do after a data breach in 5 steps: read the notice, check credit, freeze it, add a fraud alert, then act by exposed item, per the FTC.
Last checked
A data breach notice does not always mean someone has already used your information. It means your information was exposed, and what you do next decides how much risk that exposure creates. This guide follows the order the Federal Trade Commission (FTC) uses for breach recovery: find out what was exposed, check your credit, freeze it, and then take the steps that fit the type of information involved. The five steps below are written for a reader who has just received a notice and wants a clear sequence instead of a list of unrelated tips.
Summary
- Read the notice first and write down exactly which items were exposed.
- Order your free credit reports and look for accounts you do not recognize.
- A credit freeze and a fraud alert both make it harder for a thief to open new accounts in your name.
- A credit freeze is free to place and free to lift. A fraud alert is also free.
- If the company that sent the notice offers free credit monitoring or identity theft insurance, the FTC says to take the offer.
- If you find misuse, report it at IdentityTheft.gov to get a recovery plan.
| Exposed item | Typical first move | Why it matters |
|---|---|---|
| Social Security number | Check credit reports, then freeze credit | Makes new accounts in your name harder to open |
| Password or login | Change it, and change it anywhere it was reused | Stops one leaked password from opening other accounts |
| Debit or credit card number | Contact the card company for a replacement | Ends charges on the exposed number |
| Bank account number | Contact the bank about the account | Limits access to that account |
| Any other item | Contact the organization that sent the notice | Ask what misuse it can prevent |
The table shows the shape of the plan. Credit steps come first for anything that can open new accounts, and item-specific steps come second. A password change alone does not protect a credit file, and a credit freeze alone does not lock a reused password. Both layers matter, so keep them separate in your notes.
Step 1: Read the notice and list what was exposed
Do not delete the notice, and do not treat every notice as equally urgent. The notice should say what was accessed, and that list becomes your working list for the rest of this guide.
If the notice names a password, plan a password change. If it names a card number, plan a card replacement. If it names a Social Security number, plan the longer credit watch described below. If the notice is unclear, contact the company that sent it and ask which items were involved. That question is worth asking before you start changing accounts, because it prevents wasted changes and missed ones.
Step 2: Check your credit reports
For an exposed Social Security number, the FTC advises ordering your free credit reports and checking for accounts you do not recognize. AnnualCreditReport.com is the site the FTC points readers to for those reports. See the official site for how often free reports are available.
Look for accounts you did not open, debts you do not recognize, and inquiries you did not authorize. If you find something, contact the company involved and report the misuse at IdentityTheft.gov, where a recovery plan can be created. Keep notes on what you found, when you found it, and whom you contacted.
Step 3: Freeze your credit, and consider a fraud alert
A credit freeze is the strongest credit step in this sequence. According to the FTC, there is no cost to place or lift a freeze. While a freeze is in place, nobody can open a new credit account in your name, including you. You place it by contacting each of the three credit bureaus: Equifax, Experian, and TransUnion.
A fraud alert is a lighter companion step. It is free, and an initial alert lasts one year and can be renewed. You contact one of the three bureaus, and that bureau must notify the other two. With an alert in place, businesses are told to verify your identity before opening new credit in your name. Unlike a freeze, an alert does not stop businesses from seeing your credit report, so the two are not interchangeable.
If you expect to apply for credit soon, plan the timing. A freeze has to be lifted before a lender can check your credit, and the FTC suggests lifting it only at the bureau the lender will use.
Step 4: Accept monitoring, and keep checking
If the organization that sent the notice offers free credit monitoring or identity theft insurance, the FTC advises accepting the offer. Monitoring does not prevent identity theft by itself. It shortens the time between misuse and discovery, which is why it sits alongside the freeze rather than replacing it.
Keep the offer details with the notice, and note any enrollment deadline. See the official site or the notice itself for the terms and length of the offer, because they differ by company.
Step 5: Act on the type of information exposed
This is where the sequence branches. The FTC breach page at IdentityTheft.gov sorts its advice by the type of information that was exposed, so return to your list from Step 1 and work through it one item at a time.
For a password or login, change the password, turn on two-factor authentication where it is offered, and change the same password anywhere else you used it. If you cannot log in, contact the company directly.
For a card number, contact your card company and ask for a replacement. Review your statements in the weeks that follow, and update any automatic payments tied to the old number.
For a bank account number, contact the bank, explain what was exposed, and ask what protections it can add. Review transactions regularly after that.
For anything else, such as a government ID or an insurance number, contact the organization that issued it and ask what can prevent misuse. See the official site of the issuing agency for its current replacement steps.
Choosing order
- Read the notice and write down exactly what was exposed, before changing anything.
- Check your credit reports, freeze your credit, and add a fraud alert if you want that extra check.
- Work through the item-specific steps for each exposed type, starting with passwords and cards, then accounts and documents.
Before you finish
- Keep the breach notice, your notes, and any confirmation letters in one place.
- Write down the date of each change: report check, freeze, alert, password change, card replacement.
- If someone has already used your information, report it at IdentityTheft.gov.
- If a company offers free monitoring, decide on the offer before the enrollment window in the notice closes.
This article is for general information, not financial advice.