What to do after a data breach, based on what was leaked

Breach letters and emails are written by lawyers, so the useful part is usually buried. Look for a list of data types. Companies tend to say "may have included" and then name things like names, email addresses, dates of birth, Social Security numbers, account numbers or driver's license numbers. That list decides everything you do next.

If the notice came by email, do not click anything in it. Go to the company's website by typing the address yourself, or search for news coverage of the breach. Real notices often include a phone number and a code for free credit monitoring; scammers copy that format, so confirm the details on the company's own site before you enroll or call.

You can also check what has leaked about you across many breaches at Have I Been Pwned. Enter your email address and it lists the known breaches that included it, along with the types of data each one exposed. It is free and run by a well-known security researcher. Our guide to checking if your password was leaked covers how it works.

Find the rows that match your notice. Most breaches touch two or three of them.

Change the password on the breached site first. Then think honestly about where else you used the same one, or a close variation of it. Attackers take leaked email and password pairs and try them automatically on email providers, banks, shopping sites and streaming services. The breached site is rarely where the damage happens; your reused password on another site is.

1. Change the password on the breached site to something long and unique.
2. Change it everywhere you reused it, starting with your email account and anything financial.
3. Turn on two-factor authentication on those accounts, using an authenticator app or a passkey rather than text messages where you can.
4. Sign out of other sessions if the site offers it. Many put this under security or devices settings.

If you have more than a handful of reused passwords, this is the moment to start using a password manager. The free ones built into Apple devices and Chrome are fine for many people. If you want one that works across every platform, Proton Pass has a free tier and can flag reused passwords for you. Our password manager comparison covers the alternatives fairly, including Bitwarden's free plan.

An exposed SSN is the most serious item on the list because you cannot change it. The fix is to make it useless for opening new credit, and the tool for that is a credit freeze.

A freeze does not stop someone filing a tax return in your name. For that, get an Identity Protection PIN from the IRS. Anyone who can verify their identity can request one through the IRS website, and it is free. The PIN changes each year and you enter it when you file.

For a leaked driver's license or passport, a credit freeze covers the biggest financial risk. Check with your state's motor vehicle agency on whether it will issue a new license number; policies vary by state. For a passport, the State Department handles reports of lost or stolen passports, and a leaked number on its own is usually lower risk than a physical passport going missing.

Then pull your credit reports. You can get free reports from each bureau every week at AnnualCreditReport.com, the only site authorized by federal law for this. Look for accounts, addresses or inquiries you do not recognize. If you find any, move to our guide on what to do if your identity is stolen.

Call the number on the back of the card, or use the issuer's app, and ask for a replacement with a new number. Most issuers do this without fuss after a breach. Remember to update the card on any subscriptions and autopay accounts, or they will fail quietly.

Turn on transaction alerts in your banking app so every charge pings your phone. It costs nothing and you will spot a fraudulent charge the day it happens rather than at the end of the month.

Federal law limits your liability for unauthorized credit card charges, and most issuers advertise zero liability. Debit cards are weaker: how much you can lose depends on how quickly you report the problem. If a debit card number leaked, report it and replace it promptly. For a bank account number, tell your bank, ask whether it recommends a new account, and watch for unfamiliar withdrawals or checks.

Medical identity theft happens when someone uses your insurance details to get care, prescriptions or equipment. It can leave false entries in your medical records and bills in your name, and it is slow to surface.

• Read every explanation of benefits your insurer sends, including the ones that say "this is not a bill". Look for providers, dates and services you do not recognize.
• If you are on Medicare, check your Medicare statements the same way.
• Ask your insurer whether it will issue a new member ID number.
• If something looks wrong, call the insurer's fraud line and ask the provider for your records.

A credit freeze does not help here, so careful reading of those statements is your main defense.

The breach itself is often less dangerous than the wave of scams that follows. Criminals know which company was breached, and sometimes they have your name, email and phone number from the leak. Expect emails, texts and calls that claim to be from the company, your bank or a "breach response team".

• Never give a password, one-time code or full SSN to someone who contacted you.
• Hang up and call back using a number from the company's website or the back of your card.
• Be wary of anyone offering to "remove you from the breach" or recover data for a fee.

Our guide on how to spot phishing emails has the details. Forward phishing texts to 7726 (SPAM) to report them to your carrier, and report scams to the FTC at ReportFraud.ftc.gov.

Class action and settlement notices

Large breaches often lead to class action settlements, and months later you may get a notice inviting you to file a claim. Many are genuine. Some are fake, built to collect your personal details. A real settlement never asks you to pay to file a claim. Find the settlement website through news coverage or the court filing, rather than through a link in the message, and only give the information the claim form needs.

Breached companies often offer a year or two of free credit monitoring. It is worth accepting if you confirm the offer is genuine. Monitoring alerts you when something changes on your credit report, such as a new account or a hard inquiry.

Monitoring tells you after the fact. A freeze stops the account being opened in the first place. If your SSN leaked, do both: freeze first, then enroll in the monitoring as a backup. Enrolling usually means handing over your SSN again, so do it only through the company's official site or the code in a verified letter.

You do not need to buy a paid identity theft protection service after a breach. Whether one is worth it for your situation is a separate question, covered in is identity theft protection worth it.