A city government hack response checklist tells residents to change passwords on every account tied to the breach, place a credit freeze with all three bureaus, and watch for new accounts opened in their name. These three steps form the core of what consumer-protection regulators and breached cities themselves have told affected residents to do after a municipal data breach. The checklist matters because city breaches increasingly expose Social Security numbers and bank details, not just names and addresses. Recent attacks on Columbus, Hoboken, and Sandstone show what a resident actually receives after notification — and what that response leaves for the resident to do alone.
Table of Contents
- Change Passwords First, Then Everywhere Else You Reused Them
- Freezing Credit at All Three Bureaus
- Pulling a Credit Report When a Social Security Number Is Exposed
- What Cities Have Actually Offered Residents After a Breach
- The Gap a Monitoring Offer Doesn't Close
- Frequently Asked Questions
Change Passwords First, Then Everywhere Else You Reused Them
The first action on any breach notice is a password change on the account the city actually runs — a resident portal, a utility billing login, a parking-ticket site. The Federal Trade Commission's breach-response checklist at IdentityTheft.gov directs recipients to log in to the affected account and change its password immediately, then change that same password anywhere else it was reused, before moving to other recovery steps, according to the FTC's data-breach guidance. This order matters because reused passwords are what let a single breach cascade into others.
If a resident used the same password for a city water-bill account and a personal email or banking login, an attacker who obtains the city's database can try that password elsewhere immediately. Changing it only on the breached account leaves every other reuse exposed. A city notice rarely tells residents which passwords to change, because the city doesn't know what else a resident reused that password on. The responsibility sits with the resident: treat any password used on the breached service as compromised everywhere it appears.
Freezing Credit at All Three Bureaus
A credit freeze blocks new creditors from accessing a credit report, which stops most attempts to open new loans, credit cards, or utility accounts in a resident's name. Since September 21, 2018, federal law has required Equifax, Experian, and TransUnion to let consumers place and lift freezes, and fraud alerts, at no charge, with freezes requested online or by phone taking effect within one business day, under the FTC's 2018 free-freeze announcement.
The freeze has to be requested separately at each of the three bureaus — placing one with Equifax does nothing at Experian or TransUnion. A fraud alert works differently: placing it with just one bureau requires that bureau to notify the other two. But a freeze only blocks *new* accounts; it does nothing to stop charges on cards or bank accounts a resident already holds, so existing accounts still need separate monitoring, according to the same FTC guidance.
- Equifax, Experian, and TransUnion each require their own freeze request
- A one-bureau fraud alert triggers notification to the other two automatically
- Freezes stop new-account fraud; they don't protect accounts already open
- Online or phone requests take effect within one business day
Pulling a Credit Report When a Social Security Number Is Exposed
When a breach includes a Social Security number, the FTC recommends pulling a free credit report from annualcreditreport.com and scanning it for accounts, credit inquiries, or addresses the resident doesn't recognize, according to the FTC's IdentityTheft.gov guidance. This step runs alongside a freeze or fraud alert, not instead of one — a freeze prevents future damage, while a report review catches anything that may have already happened.
Residents should look specifically for accounts they never opened, inquiries from lenders they never contacted, and any address change they didn't request. Any of those can signal that a Social Security number from the breach has already been used, even before a city's monitoring service would catch it.
What Cities Have Actually Offered Residents After a Breach
Several recent municipal breaches show the pattern of what a city typically provides, and why it stops short of full protection. A July 2024 ransomware attack on Columbus, Ohio, claimed by the Rhysida group, exposed names, Social Security numbers, and bank account information for roughly 500,000 residents and non-residents, according to BleepingComputer's reporting on the city's notice. Columbus responded by paying for two years of free Experian identity-protection and credit-monitoring coverage, including $1 million in identity-theft insurance, for everyone affected — a package the mayor said would cost the city millions of dollars, according to Cities Today's coverage of the announcement.
Hoboken, New Jersey, followed a similar path after a ransomware attack on November 26–27, 2024, claimed by the ThreeAM group. On December 9, 2024, the city announced a dedicated call center along with free credit monitoring and identity-protection enrollment for any resident who wanted it, according to the City of Hoboken's official notice. Sandstone, Minnesota, took the same approach after an April 8, 2026 ransomware attack stole names, addresses, dates of birth, Social Security numbers, and bank routing numbers belonging to both employees and residents, arranging free identity monitoring for both groups, according to teiss's reporting on the breach notice.
The Gap a Monitoring Offer Doesn't Close
Free monitoring from a breached city only watches for new activity from the date it starts forward. It does not look backward at whatever happened between the breach and the enrollment date, which the FTC flags as a real limitation of these offers, according to its guidance on breach recovery.
A resident who waits for the monitoring letter before acting leaves that window uncovered. That's why the freeze, the password changes, and the credit-report review belong on a resident's own timeline, not the city's. A monitoring enrollment is a useful backstop once it starts, but it was never built to replace the freeze a resident places independently, and it does nothing about a password reused somewhere a bank account depends on.
Frequently Asked Questions
Does a city's free credit monitoring protect existing bank accounts?
No. Monitoring tracks new activity going forward; it doesn't flag charges on accounts a resident already holds, which still require independent review.
Is a fraud alert enough instead of a credit freeze?
A fraud alert placed with one bureau notifies the other two, but it doesn't block new accounts the way a freeze does; the two serve different purposes and can be used together.
How fast does a credit freeze take effect?
An online or phone request takes effect within one business day at each of the three bureaus, under the 2018 federal free-freeze law.
You Might Also Like
- Cybersecurity — MOVEit Breach Response Checklist: Passwords, Accounts, and Credit
- Ransomware Negotiation Response Checklist: Passwords, Accounts, and Credit
- Pentagon Data Breach: What Government Employees Should Do Next