After a data breach
What to do after a data breach: a calm checklist
The short answer
First, find out what was exposed. The right steps depend on whether it was a password, a card number, or your Social Security number (IRS).
If your Social Security number was exposed, the biggest protection is a free credit freeze at all three credit bureaus (FTC). Then check your free credit reports at AnnualCreditReport.com (IdentityTheft.gov).
Step 1: Find out what was exposed
Read the breach notice carefully. The IRS says it’s important to know what kind of information was taken so you can take the right steps. For example, a stolen credit card number won’t affect your tax account (IRS). Also watch for any free services the company offers, such as credit monitoring (IRS).
Be careful with breach ‘notices’ that arrive by text or email with a link. Check the company’s own website instead. Scammers copy real breach news (FTC).
If your Social Security number was exposed
- Freeze your credit at Equifax, Experian, and TransUnion. It’s free and doesn’t hurt your score (CFPB). Our guide: how to freeze your credit.
- Check your credit reports for accounts you don’t recognize. You can get free weekly reports from all three bureaus at AnnualCreditReport.com (FTC).
- Consider a fraud alert, which tells lenders to verify your identity. Placing it at one bureau is enough (FTC).
- Protect your tax refund with an IRS Identity Protection PIN (IRS).
- If you see signs of identity theft, report it and get a recovery plan at IdentityTheft.gov.
If a password or email was exposed
- Change that password, and change it anywhere else you used the same one (IdentityTheft.gov).
- Use a long, unique password. The FTC suggests at least 12 to 15 characters (FTC).
- Turn on two-factor authentication (FTC).
- You can check whether your email shows up in known breaches at Have I Been Pwned.
If a credit or debit card number was exposed
Call your card company using the number on the back of the card. Ask for a new card number and watch your statements for charges you don’t recognize (IdentityTheft.gov).
If it was tax information
Your tax account is most at risk when a breach includes both your Social Security number and financial data such as wages. If your e-filed return is rejected as a duplicate, or the IRS writes to you about identity theft, the IRS explains how to file Form 14039, the Identity Theft Affidavit (IRS).
Watch for follow-up scams
After big breaches, scammers call, text, and email pretending to be the company, a bank, or a government agency. Don’t share codes or personal details with anyone who contacts you. See verification code scams, fake government calls, and is this a scam?
Common questions
I got a data breach letter. Is it real?
It may be. Check by going to the company’s own website or calling a number you look up yourself, not one in the letter or email. Scammers copy real breach notices (FTC).
Should I accept the free credit monitoring?
It can help you spot problems sooner. The IRS suggests watching for services the company offers, such as credit monitoring (IRS). A credit freeze goes further by blocking new accounts in your name (CFPB).
What’s the single most important step if my SSN leaked?
A free credit freeze at all three bureaus. It stops new credit accounts from being opened in your name (CFPB).
How do I check my credit report for free?
Go to AnnualCreditReport.com. You can get free weekly reports from Equifax, Experian, and TransUnion (FTC).
My email was in a data breach. What should I do?
Change the password for that email and anywhere you reused it, and turn on two-factor authentication (IdentityTheft.gov, FTC).
This page is general information, not legal or financial advice. If money already left your account, call your bank or card company first.