What to Do After a Data Breach: A Step-by-Step Guide

A letter shows up in your mailbox or an email lands in your inbox. Your information was exposed in a data breach. Your first instinct might be to panic, or worse, to ignore it and hope nothing happens.

American reading a data breach notification letter at home while checking bank account on a laptop

Neither reaction serves you well. Data breaches happened to a record 3,322 organizations in 2025 alone, and most Americans who get a notice will get more than one in the same year, per the Identity Theft Resource Center 2025.

The good news is that there is a clear, proven sequence of steps that dramatically cuts your risk of becoming an identity theft victim. None of these steps cost money, and most take less than 20 minutes each.

This guide walks through exactly what to do, in order, based on FTC and CFPB consumer protection guidance.

ℹ Quick Summary
More than 1 million Americans reported identity theft to the FTC last year, per the Federal Trade Commission 2025.The Identity Theft Resource Center tracked a record 3,322 data compromises in 2025, a 79% jump over five years, per the Identity Theft Resource Center 2025.About 80% of survey respondents received at least one data breach notice in the past 12 months, and 88% reported a negative consequence like increased phishing or attempted account takeover, per the Identity Theft Resource Center 2026.New-account fraud losses reached $7 billion in 2025, up 13% year over year, with 5.4 million victims, per Javelin Strategy and Research 2026.Credit freezes have been free at all three bureaus by federal law since 2018, per the Consumer Financial Protection Bureau 2026.

📘 What This Guide Covers
The exact order of steps to take right after a breach notice
How to tell if the breach exposed your Social Security number, card, or just an email
When to use a fraud alert versus a full credit freeze
How to check if your accounts were actually compromised
What to do if you find fraudulent activity
How long you should keep monitoring after a breach
Common mistakes that leave people exposed after a breach

What to Do in the First 24 Hours
Match Your Response to What Was Exposed
Fraud Alert vs Credit Freeze: Which Do You Need?
How to Check for Fraudulent Activity
What to Do If You Find Fraud
Real-World Example
Common Mistakes to Avoid
Frequently Asked Questions

1. What to Do in the First 24 Hours

Read the notice carefully to identify exactly what information was exposed, change the password on the affected account plus anywhere you reused it, and check IdentityTheft.gov for a personalized recovery plan based on what was compromised, per the Federal Trade Commission 2026.

The notice itself is your most important clue. Companies are required to tell you what type of information was involved, whether that is your name and email, a card number, or your full Social Security number. What you do next depends heavily on that detail.

Start with your passwords. If the breach involved a login, change it immediately, and change it anywhere else you used the same password. Password reuse is one of the most common ways a single breach turns into multiple account takeovers.

Then visit IdentityTheft.gov, the FTC’s official recovery site. Based on what was exposed, it builds a personalized checklist rather than a generic one, which saves time compared to guessing at next steps.

2. Match Your Response to What Was Exposed

Your next steps depend on the type of data exposed: a Social Security number calls for a credit freeze, a card number calls for a card cancellation, and a password calls for a reset plus two-factor authentication, per the Federal Trade Commission 2026.

Not every breach carries the same level of risk. A breach that exposed only your email address is far less dangerous than one that exposed your Social Security number, so it helps to triage before you act.

Exposed Information	Immediate Step	Where to Do It
Social Security number	Place a free credit freeze at all three bureaus	Equifax, Experian, TransUnion
Credit or debit card number	Cancel the card and request a new one	Your bank or card issuer
Login and password	Change the password and enable two-factor authentication	The affected account and anywhere you reused it
Bank account number	Alert your bank and monitor transactions	Your bank’s fraud department
Medical or insurance ID	Request an explanation of benefits review	Your insurer

3. Fraud Alert vs Credit Freeze: Which Do You Need?

A fraud alert requires lenders to verify your identity before approving new credit but still lets them view your file, while a credit freeze blocks new lenders from viewing your file at all, and both are free at all three bureaus, per the Consumer Financial Protection Bureau 2026.

An initial fraud alert lasts one year and can be renewed at no cost. It is a lighter-touch option because it does not block lenders from seeing your file, it just requires them to confirm your identity first.

A credit freeze is the stronger option. Since federal law guarantees free freezes at all three bureaus, most security experts recommend a freeze over a fraud alert whenever your Social Security number was part of the breach.

💡 Pro Tip
You only need to request a freeze or alert at one bureau if you choose a fraud alert. Federal law requires that bureau to notify the other two. A credit freeze, by contrast, must be requested separately at all three, per the Consumer Financial Protection Bureau 2026.

4. How to Check for Fraudulent Activity

Pull your free credit reports from all three bureaus at annualcreditreport.com and review them line by line for accounts or inquiries you do not recognize, since new-account fraud is the fastest-growing category of identity theft, per Javelin Strategy and Research 2026.

New-account fraud, where someone opens a fresh account in your name rather than misusing an existing one, drove the bulk of the growth in identity theft losses last year, and roughly 91% of credit card identity theft reports involve a brand-new account rather than a stolen card, per Experian 2025. That makes reviewing your credit report for unfamiliar accounts one of the highest-value checks you can do.

While you are at it, set a calendar reminder to check again in 90 days. Breach-related fraud does not always show up immediately, and a delayed check can miss a new account opened weeks after the initial exposure.

⚠ Watch Out
Do not confuse a paid credit monitoring subscription with an actual credit freeze. Monitoring alerts you after something happens. It does not stop a new account from being opened in the first place.

5. What to Do If You Find Fraud

File a report at IdentityTheft.gov to generate an official Identity Theft Report and a personalized recovery plan, then contact each affected company directly using the sample dispute letters the FTC provides, per the Federal Trade Commission 2026.

File a report at IdentityTheft.gov to get your Identity Theft Report and recovery plan.
Contact each company where fraud occurred and ask them to close the fraudulent account.
Request an extended fraud alert, which lasts seven years once you have an Identity Theft Report.
Dispute any fraudulent items directly with Equifax, Experian, and TransUnion.
Keep copies of every letter, email, and confirmation number for your records.

6. Real-World Example

Priya, a 34-year-old accountant in Austin, Texas, received a breach notice from a retailer that exposed her card number. She canceled the card within an hour of reading the notice, and no fraudulent charges ever appeared. Total time spent: about 15 minutes. Tyler, a 52-year-old contractor in Boise, Idaho, received a similar notice but set it aside for three weeks during a busy work stretch. By the time he checked his credit report, a new credit card account had already been opened in his name. He spent several months disputing the account and filing paperwork to get it removed.
These examples are illustrative. Actual results depend on individual circumstances.

7. Common Mistakes to Avoid

Setting the notice aside instead of acting within the first few days
Reusing the same password across other accounts after a login breach
Assuming a credit monitoring subscription is the same as a credit freeze
Only checking one bureau’s report instead of all three
Forgetting to check again 60 to 90 days later, when delayed fraud often appears

8. Frequently Asked Questions

Do I have to pay for credit monitoring after a breach?

Not necessarily. Companies responsible for a breach often offer free monitoring for a period of time, and a credit freeze itself is always free by federal law regardless of whether you accept a monitoring offer.

How do I know if I was actually affected by a breach?

The company responsible is required to notify you directly if your information was involved. You can also check whether an account’s email appears in known breaches through reputable breach-checking tools.

Should I close the affected account entirely?

Usually not required. For a card breach, canceling the card and getting a new number is typically enough. For a login breach, a password reset plus two-factor authentication is usually sufficient.

How long should I keep watching my credit after a breach?

Most experts suggest monitoring for at least a year, since stolen data is sometimes sold and used months after the original breach rather than immediately.

What is the difference between identity theft and a data breach?

A data breach is the exposure of your information. Identity theft is what happens if someone actually uses that information to commit fraud. A breach does not automatically mean you become a victim of identity theft.

⭐ Key Takeaway
A data breach notice is not a reason to panic, but it is a reason to act within the first few days. Read the notice to see exactly what was exposed, change any affected passwords, and place a free fraud alert or credit freeze depending on the severity. Check your credit reports now and again in 90 days, since delayed fraud is common. None of these protective steps cost money, and taking them quickly dramatically lowers your odds of becoming one of the millions of Americans who report identity theft each year.

Conclusion

Data breaches are no longer rare events. With a record number of compromises tracked in 2025 and new-account fraud losses climbing to $7 billion, per Javelin Strategy and Research 2026, the odds that you will receive at least one breach notice this year are high.

The steps in this guide take less than an hour total but close most of the paths an identity thief could use. If you have not yet frozen your credit as a baseline protection, start with our guide on Cred it Freeze vs Credit Lock, and if you want a deeper walkthrough of recovering from actual fraud, see How to Recover Financially After Identity Theft.

The single biggest factor in whether a breach turns into real financial harm is how quickly you respond. Act in the first few days, not the first few weeks.

📲 Share This Guide
Just got a breach notice yourself, or know someone who did? Send them this guide before they set it aside.

What to Do After a Data Breach: A Step-by-Step Guide for Americans 2026

Table of Contents