Photo: Jakub Żerdzicki / Unsplash (Unsplash License). Illustrative image of someone using a phone; it does not show a real breach notification or compromised account.
PERSONAL FINANCE & DIGITAL SAFETY | U.S. consumer guide
Got a data-breach notice? The most useful first move is not to buy an identity-protection subscription. Find out which information was exposed, then choose the protection that actually addresses that risk.
A notice that your information may have been exposed is not proof that someone used it. But a stolen password, payment-card number and Social Security number create different problems. The steps below follow guidance from the U.S. Federal Trade Commission (FTC) and its IdentityTheft.gov recovery service.
First: match the response to the information exposed
| What the notice says | What to do now |
|---|---|
| Email address or password | Change the affected password through the official app or site. Replace it anywhere else you reused it; turn on multifactor authentication. |
| Social Security number or identifying details | Consider a free credit freeze at all three nationwide credit bureaus. Review credit reports for unfamiliar accounts. |
| Debit or credit card details | Contact the card issuer using the number on your card or its official app; review transactions and ask whether a replacement card is needed. |
| An account was opened or charges appeared without permission | Contact the affected company, then report identity theft at IdentityTheft.gov for a tailored recovery plan. |
Important: A credit freeze helps protect against new-account fraud; it does not stop someone from misusing an existing credit card or bank account. Keep watching those statements even if your credit is frozen.
Credit freeze vs. fraud alert: what changes?
These are different, free tools. A credit freeze limits access to your credit report, making it harder for a thief to open new credit. A fraud alert tells lenders to take extra steps to verify your identity before granting new credit.
| Question | Credit freeze | Initial fraud alert |
|---|---|---|
| How many bureaus must I contact? | All three: Equifax, Experian and TransUnion | One bureau; it must notify the other two |
| How long does it last? | Until you lift or remove it | One year; renewable |
| Cost | Free to place and lift | Free |
| What if I apply for credit? | Temporarily lift the freeze for the necessary credit check | The lender may contact you to verify identity |
| Does it stop fraud on existing accounts? | No | No |
The FTC says a freeze does not lower your credit score. It also does not prevent you from using existing cards. If you expect to apply for a loan or new card soon, plan for a temporary lift rather than skipping protection entirely.
A practical checklist you can follow today
- Verify the message independently. Do not trust the phone number or sign-in link inside a surprise email or text. Open the company’s app or type its known website yourself, and look for its official breach notice.
- Read exactly what was affected. Was it only a name and email address, or did the company identify passwords, payment information or Social Security numbers? Note the date of the notice and save a copy.
- Secure exposed logins. Change the password on the real service, replace reused passwords elsewhere and enable multifactor authentication. Review account recovery information and recent sign-ins where available.
- Freeze credit if the exposure warrants it. Use the three bureau links listed below. Each freeze is free. Keep your account recovery details in a safe place so you can lift it later.
- Check reports and statements. U.S. consumers can access free weekly credit reports through AnnualCreditReport.com. Look for unfamiliar accounts or inquiries, and separately review bank and card activity.
- Escalate actual misuse. If you find an account or charge you did not authorize, contact the business immediately and use IdentityTheft.gov to create a report and personalized recovery steps.
Where to place a credit freeze — official starting points
For a fraud alert, the FTC says you can contact one of those bureaus. For a credit freeze, contact each bureau. If a link or screen looks unfamiliar, start from the FTC’s credit-bureau contact directory rather than a link in an unsolicited message.
What about free credit monitoring offered after a breach?
If the affected company offers legitimate free monitoring, it can be useful for spotting changes to your credit report. But monitoring and prevention are not the same thing: monitoring may alert you after a new account or inquiry appears, while a freeze is intended to make certain new-account attempts harder. Check which bureaus are covered, how long the offer lasts and whether a paid renewal is optional. Do not assume monitoring replaces a freeze.
If identity theft has already happened
Start with the business where the fraud occurred: ask its fraud department to close or freeze the affected account and document your report. Then visit IdentityTheft.gov. The FTC service can generate an Identity Theft Report and a personalized recovery plan, including steps to dispute fraudulent accounts. Keep copies of the notice, account statements and correspondence.
If you do not create an account on IdentityTheft.gov, the site advises printing or saving your report and recovery plan before leaving, because you may not be able to retrieve them later.
Three easy mistakes to avoid
- Paying for a “mandatory” freeze. Placing and lifting a freeze at the three nationwide bureaus is free.
- Assuming a freeze fixes every kind of fraud. It does not reverse existing fraudulent charges, protect every type of account or replace password changes.
- Following a suspicious “breach support” link. A real incident can attract impersonators. Use independently verified company and government websites.
Bottom line
Treat the breach notice as a decision tree, not a reason to panic: identify the exposed data, secure any affected logins, freeze credit when identifying information is at risk, and report actual misuse. The most effective next step depends on what was exposed—not on the scariest headline.
Source check: Guidance reviewed October 15, 2026. This is a general U.S. consumer guide, not a report of a newly discovered breach. Exact remedies may vary with the incident and the consumer’s situation.
