Everything here is general guidance, not professional advice. We research carefully and can still be wrong or out of date, so treat it as suggestions to check rather than instructions to follow, and accept that you act on it at your own risk. Full terms.

Disaster Lab
PlaybooksYou received a data breach notice
Dataserious20 minutes to prepare

You received a data breach notice

A company wrote to say your personal information was exposed. Nothing else has gone wrong yet, and you need to cut off the ways it can.

01DetectConfirm the signal
02ContainStop more damage
03RecoverRestore control
04VerifyProve it works

What do you need right now?

Your preparation

0 of 0 safeguards ready
0%
Continue the prevention checklist

What this means

A breach notice means a company lost control of information it held about you. It does not, by itself, mean someone has already opened a loan in your name or spent your money. Those are the next incidents, if they happen: Someone is using your identity and Scammed or fraudulent bank charge.

The useful move is to match your response to what actually leaked. A password is a different problem from a card number, and a card number is a different problem from a government ID number. The US Federal Trade Commission sends people to IdentityTheft.gov/databreach for that split. The credit-file tools on that site are American. The password and card steps are worth doing wherever you live.

Treat the notice itself as hostile until you have confirmed it. After a real breach, fake texts and calls show up pretending to be the company or the government. The FTC says not to click links in an unexpected message, and not to trust caller ID. Open the company from a site you already know, or call the number on a statement you already have.

Warning signs

  • A letter, email, or in-app message names a breach and lists categories of data, such as name, email, password, card, or national ID.
  • The same company appears in news you did not go looking for, with the same dates.
  • You then get a wave of password resets, or a call claiming they will “secure your refund” if you pay or install software.

If accounts are already open that you did not open, leave this page and use the identity-theft playbook. The notice is no longer the whole incident.

Recover now

First 15 minutes

  1. Read the notice for the data types, not the apology. You need the list: password, card, bank account, government ID, medical record, or “contact details only.”
  2. Go to the company without using the link in the email. Type the address or use the app. Confirm the notice is real before you change a pile of passwords on a phish.
  3. Do not pay, install a remote-access tool, or read a one-time code to anyone who contacts you about the breach. The FTC’s guidance on breach follow-up scams is the same as for other impostors: they contact you, so you do not give them anything. You contact the company.

Today

Work down the rows that match your notice. Skip the rows that do not.

What leaked What to do
Password or login Change it on that site. If you reused it, change those accounts too. Turn on a second factor where the site offers one. The FTC says an exposed password is how someone gets into shopping, mail, and social accounts.
Card number Call the bank or card issuer on the number on the card or the statement. Ask for a new number. Update any automatic payments. Then read new transactions.
Bank account Call that bank on a number you already had. Ask what they can watch or replace. Do not give codes to an inbound caller.
US Social Security number or similar national ID In the US, check your reports at AnnualCreditReport.com, then place a free credit freeze at Equifax, Experian, and TransUnion. A freeze lasts until you lift it and blocks new credit that needs the report. Details and the difference from a fraud alert are in Someone is using your identity.
Email address only, plus a name Change the password if this site’s login reused one you care about. Watch for phishing that uses your name and the breach as the hook.
  1. If the company offers free credit monitoring, the FTC has said to take it. Monitoring tells you about new activity. It does not stop a new account the way a US credit freeze does. Use both when the leaked data is a US Social Security number.
  2. If you cannot sign in to change the password, contact the company from its real site and ask how to recover or close the account. If the inbox that receives resets was part of the breach, secure that mailbox first: Personal email account hacked.
  3. In the US, if someone then uses the data, report that misuse at IdentityTheft.gov. The notice alone is not that report.

Verify recovery

  • The password on the breached site is new, and it is not reused.
  • A second factor is on for the email account and for any bank that was named in the notice.
  • Cards named in the notice have been replaced, and the next statement shows no charges you cannot explain.
  • In the US, if a Social Security number leaked, freezes are on at all three bureaus, or you have a written reason you lifted one.

After recovery

Keep the notice and the date you received it. If a fake account appears later, that date is part of the story you tell the lender. Set a reminder to read your statements for the next couple of cycles. A breach is often quiet for weeks.

Prepare now

Logins

  • Your email password is unique, and the account has a second factor. That inbox is the reset switch for the companies in the notice.
  • A password manager holds the other logins, so the next breach does not reuse this password.
  • Banking apps do not share a password with email or shopping.

If you are in the United States

  • Credit freezes are already on at Equifax, Experian, and TransUnion, before a notice arrives. The FTC says you do not have to wait for a breach. Anyone can freeze, for free, at any time.
  • You have created the logins for those three freeze pages while nothing is on fire.

Practice

  • You can find AnnualCreditReport.com without searching the web, or you know the paper path your country uses to see your accounts.
  • The customer-service number on your main card is saved outside the card, so a lost wallet and a breach notice are not the same afternoon.

Common mistakes

  • Clicking the link in the notice to “secure your account.” Confirm the breach on the company’s own site. The message may be the real one. The link is still the risky part.
  • Changing only the breached password when you reused it. The FTC’s point is the other accounts with the same secret.
  • Buying identity monitoring and skipping the freeze, when a US Social Security number leaked. Monitoring reports damage. A freeze blocks new credit.
  • Ignoring a notice because the company said the risk was low. Change the password anyway if a password leaked. Their risk rating is not your inbox.
  • Giving a code to a caller who already knows about the breach. They know because the breach, or the news about it, is public.

Sources

Last reviewed October 31, 2026Guidance changes. Confirm provider-specific actions in the linked official sources.