Exposure Action Plan: What To Do Based On What Was Leaked

Tick what the notice says was exposed. The steps come back in the order that matters, each linked to the agency that sets the rule.

What was exposed?

Social Security numberOr national insurance / tax identifier Bank or debit account detailsAccount number, routing number, debit card Credit card numberFull or partial, with or without CVV Health or medical recordsDiagnoses, insurance details, patient records Driving licence or passport numberGovernment-issued identifiers PasswordHashed or plaintext Date of birthOften paired with name and address Email address onlyNo credentials, no financial data

How the order was decided

Steps are ordered by two things: how much further damage the exposure enables, and how quickly the remedy stops being available. Debit card liability is at the top of its category because the ceiling rises with every day you wait; an exposed email address is at the bottom because nothing about the response is time-critical.

Every step links to the regulator or agency that states the rule. Nothing here is legal advice, and none of it substitutes for the instructions in the notice you received from the organisation that held your data.

Sources

Card and account liability limits, including the $50 / $500 / unlimited debit thresholds: FTC, Lost or Stolen Credit, ATM, and Debit Cards.
Credit freezes and fraud alerts, and the fact that freezes are free: FTC.
Recovery plans and affidavits: IdentityTheft.gov (FTC).
Tax-filing protection: IRS Identity Protection PIN.
Healthcare exposure: HHS Office for Civil Rights breach portal.