CyberSandberg Search

Cyber Finance

What to do after a company says your data was breached

Checked

A letter or email says a company lost control of some of your personal information. That's unsettling, but a breach notice is not the same as identity theft. Most of the steps that protect you are free, and you can start the important ones today.

Talk about it at home: jump to the Table Talks

First, make sure the notice is real

Scammers send fake notices too. IdentityTheft.gov, the FTC's (Federal Trade Commission) identity theft site, says scammers often pretend to be from a business you know. If an email or text comes from a company you do business with, it says not to click any links, even if the message might be real. Instead, contact the company through a website you know is trustworthy, or look up its phone number yourself.

Our advice: type the company's web address yourself and look for a breach notice there. You can also check whether your state attorney general's website posts breach notices. If your letter matches what the company or the state posted, treat it as real. Then note what was exposed, what the company is offering, and any sign-up deadline.

Match your steps to what was exposed

IdentityTheft.gov sorts its advice by the type of information involved: IdentityTheft.gov: what to do if your information was part of a data breach. Its steps for the most common types:

For anything else, IdentityTheft.gov suggests asking the organization involved what you can do to keep an identity thief from using it.

Do this now: Circle each exposed item in your notice and write the matching step next to it.

Freeze your credit, or at least place a fraud alert

The FTC says that while a credit freeze is in place, nobody can open a new credit account in your name, including you. It's free to place and lift, doesn't affect your credit score, and lasts until you lift it. Contact all three bureaus: Equifax, Experian, and TransUnion. The FTC says a freeze is even more important if your Social Security number was exposed in a data breach: FTC: credit freezes and fraud alerts.

A fraud alert is a lighter step. The FTC says it tells businesses to check with you before opening new credit in your name, but unlike a freeze, it doesn't stop them from seeing your report. An initial alert is free, lasts one year, and can be renewed, and the one bureau you contact must tell the other two. Our lesson Your credit file is a lock you can close walks through the steps.

Do this now: Freeze at one bureau today, and put the other two on your calendar for this week.

Check your credit reports

The FTC says you can check your report from each bureau once a week for free at AnnualCreditReport.com, the only site authorized to fill orders for the free annual reports you're entitled to by law: FTC: free credit reports. IdentityTheft.gov says to contact the company about any account or debt you don't recognize, and to keep checking periodically.

Watch your accounts and turn on alerts

The CFPB (Consumer Financial Protection Bureau), the federal agency that enforces consumer financial laws, says to make a habit of monitoring your accounts and to look for unfamiliar merchant names, even on small amounts. It notes that fraudulent charges might show up months after your information was stolen: CFPB: watch accounts closely when card data is hacked.

Our advice: turn on transaction alerts in your banking and card apps so you hear about activity as it happens. Our guide Let your bank tap you on the shoulder shows which alerts to pick.

Lock down your logins

IdentityTheft.gov says to change an exposed password, and to change it anywhere else you used it. It also suggests two-factor authentication for extra security. Our advice: turn on multifactor login, which asks for a second proof such as a code or a fingerprint, for your email, your bank, and the account named in the notice. If a site offers passkeys, consider those too. Our page How we score account protections explains how we track which of these protections large investment firms document.

If your Social Security number was exposed, get an IRS PIN

The IRS says an Identity Protection PIN (IP PIN) is a six-digit number that prevents someone else from filing a tax return using your Social Security number. Anyone with a Social Security number or individual taxpayer identification number who can verify their identity can get one, and the fastest way is through your IRS online account. A new IP PIN is issued each year. The IRS says it will never ask for your IP PIN, and calls, emails, or texts asking for it are scams: IRS: get an identity protection PIN.

Take the free monitoring before the deadline

IdentityTheft.gov says to accept free credit monitoring if a company offers it. Monitoring services scan activity on your credit reports and usually alert you to things like a new loan or credit card.

Our advice: find the enrollment deadline in your notice, put it on your calendar, and sign up through the website you confirmed in the first step. Monitoring tells you after something happens, so keep your freeze in place too.

Expect follow-up scams

IdentityTheft.gov says not to respond to unexpected calls, texts, or emails, and not to use the information a message gives you or the number from your caller ID. Our advice: expect scammers to use news of the breach as a reason to contact you. If anyone contacts you about the breach and asks for your Social Security number, a password, or a code, stop, and reach the company yourself.

If someone uses your information

If you find an account, charge, or tax filing you didn't make, report it at IdentityTheft.gov, which gives identity theft victims checklists and sample letters for recovery. The FTC says victims who complete a report there, or file a police report, can get a free extended fraud alert that lasts seven years.

A breach notice is a prompt to act, not a reason to panic. Confirm it, freeze, check, watch, and change what was exposed, and you've covered the main steps.

Teach it this week

Cyber Finance

Data breach letters: what do you do first when a company loses your information?

Big idea: A breach notice is a to-do list, not an emergency. Confirm it's real without using its links, then match each step to what was exposed.

Background for parents and grandparents: IdentityTheft.gov: what to do if your information was part of a data breach.

Table Talks (10 minutes)

  • Start (2 min): Show your family a made-up notice: "Your name, email, and card number may have been exposed. Click here to claim free monitoring." Ask: what would you check before clicking?
  • Try it (5 to 7 min): Kids and grown-ups match "exposed" cards (Social Security number, card number, password, driver's license) to "step" cards (freeze at all three bureaus, replace the card, change the password everywhere it was reused, contact the DMV, get an IRS identity protection PIN).
  • Wrap-up (1 min): Everyone names two ways to check a breach notice is real without using its links or phone numbers.

Talk it over

  1. Have you ever gotten a message saying an account had a problem? What did you do?
  2. Why might a scammer pretend to be a company that was just hacked?
  3. Which app or game account would you most hate to lose?
  4. Who would you ask if a message about an account seemed off?
  5. Screens off, make a paper fridge card together: check it's real, freeze, check reports, watch accounts, change what was exposed.
  6. Tonight's action: everyone with an account picks one reused password to change this week and turns on multifactor login there. Nobody says a password out loud.

Use only made-up notices, never a real letter. Free to use; please keep the source credit.

Education only, not financial, legal or tax advice. Not a registered investment adviser.

Sources

Primary sources

  1. IdentityTheft.gov: what to do if your information was part of a data breach, FTC, "What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach," no publish date shown, date checked: Oct 22, 2026
  2. FTC: credit freezes and fraud alerts, FTC consumer advice, "Credit Freezes and Fraud Alerts," page dated August 2025, date checked: Oct 22, 2026
  3. IRS: get an identity protection PIN, "Get an identity protection PIN," page last reviewed or updated Aug 4, 2026, date checked: Oct 22, 2026

Supporting links

  1. FTC: free credit reports, FTC consumer advice, "Free Credit Reports," page dated June 2026, date checked: Oct 22, 2026
  2. CFPB: watch accounts closely when card data is hacked, page last modified June 17, 2025, date checked: Oct 22, 2026