After a data breach—an incident that exposes personal information without authorization—first identify the exposed data and secure affected accounts. Change exposed passwords, enable multifactor authentication, and monitor financial and credit activity for misuse. The response should match the information exposed. The Federal Trade Commission directs consumers to IdentityTheft.gov's data-breach guidance for steps tailored to passwords, Social Security numbers, and bank information.
Table of Contents
- Identify What the Breach Exposed
- Secure Passwords and Important Accounts
- Look for Signs of Actual Misuse
- Choose Between a Freeze, Fraud Alert, and Monitoring
- Act When You Find Fraud
Identify What the Breach Exposed
Read the breach notice and separate confirmed exposure from possible exposure. A stolen password creates a different risk from an exposed Social Security number or bank account number.
Use the exposed data to set priorities: Treat the notice as a starting point, not proof that fraud has occurred. Monitoring accounts and credit reports can reveal whether someone has already used the information.
- Password: Secure the breached account and every account using the same or a similar password.
- Bank information: Review statements for unfamiliar charges or withdrawals.
- Social Security number or other identity data: Check credit reports and consider restricting access to new credit.
- Several data types: Take each applicable step rather than relying on one protective measure.
Secure Passwords and Important Accounts
Change an exposed password immediately. The FTC advises changing it on the breached account and anywhere the same or a similar password appears because criminals can reuse stolen credentials on other services, according to its consumer breach guidance. Next, enable multifactor authentication on important accounts.
Multifactor authentication requires another credential in addition to the password, which can stop access even when the password is known, as explained by CISA's MFA guidance. Changing only the breached account leaves reused passwords exposed elsewhere. Work through every duplicate or closely related password instead of assuming a small variation is safe.
Look for Signs of Actual Misuse
Review bills, bank statements, and credit reports for activity you do not recognize. Warning signs include unfamiliar charges, withdrawals, newly opened accounts, or debts that are not yours. Consumers can obtain a free credit report from each nationwide credit bureau every week, according to the Consumer Financial Protection Bureau.
This gives you a no-cost way to look for new-credit fraud without assuming paid monitoring is necessary. Checking a credit report does not replace reviewing existing financial accounts. A thief may misuse an established account without opening a new line of credit.
Choose Between a Freeze, Fraud Alert, and Monitoring
A credit freeze generally blocks creditors from accessing your credit file for new applications. Placing one is free, but you must contact Equifax, Experian, and TransUnion separately, according to the CFPB's credit-freeze explanation. A freeze does not prevent takeover of an existing account. You may also need to lift it temporarily before applying for new credit, so continue securing and monitoring accounts directly.
If you suspect fraud, you can instead place a free initial fraud alert through one nationwide credit bureau. That bureau must notify the other two; the alert lasts one year and tells creditors to verify your identity before granting new credit. Credit monitoring serves a different purpose: It alerts you to changes, often after personal information has already been misused. A monitoring offer included with a breach notice should not replace a freeze, direct account security, or credit-report review.
Act When You Find Fraud
If you discover actual misuse, contact the affected financial institution's fraud department. Ask it to close compromised accounts and follow its process for disputing the activity.
Then file at IdentityTheft.gov. The filing provides an FTC Identity Theft Report and a recovery plan, giving you concrete documentation and steps for addressing the accounts or debts involved.