Updated September 2026. This guide replaces an older post on data breach alerts. The credit bureau and government services mentioned are for the United States; if you live elsewhere, use your country’s equivalent fraud-reporting and credit reference services.
If a company tells you your data was exposed in a breach, what you should do depends on what was exposed. A leaked password needs a different response from a leaked Social Security number. This guide shows how to check the alert is genuine, what to do first, how to respond to each type of exposed data, and how to protect yourself from the scams that often follow a breach.
Step 1: Make sure the alert is real
Scammers send fake breach warnings to steal passwords and payment details. Before acting on any alert:
- Don’t click links or call numbers in the message. Go to the company’s website by typing the address yourself, or use its official app.
- Look for a notice on the company’s website or reliable news coverage of the breach.
- Check your email address at Have I Been Pwned, a free service that shows which known breaches include your email. You can also sign up to be notified of future breaches.
- Be suspicious of urgency or payment requests. A genuine notice won’t ask for your password, or ask you to pay to “secure” your account.
Step 2: Do these first
- Change the password for the breached account — and for any other account where you used the same or a similar password.
- Secure your main email account with a strong, unique password. Email can reset your other passwords.
- Turn on two-factor authentication for email, banking and the breached account. See our 2FA setup guide.
- Check recent activity in your bank, card and email accounts, including unfamiliar logins and devices.
A password manager makes it practical to give every account its own password, so a future breach can’t unlock others.
Step 3: Respond to what was exposed
| Exposed data | What to do |
|---|---|
| Password | Change it on that site and anywhere you reused it. Turn on 2FA. |
| Email address or phone number | Expect more phishing emails, texts and calls. Don’t trust messages that mention the breach. |
| Credit or debit card number | Contact your card issuer and ask for a replacement card. Watch statements for unfamiliar charges. |
| Bank account details | Tell your bank, and ask about extra protection on the account. |
| Social Security number | Freeze your credit with all three bureaus, check your credit reports, and consider an IRS Identity Protection PIN. |
| Date of birth, address or ID documents | Consider a credit freeze or fraud alert. Contact the issuing agency if an ID document number was exposed. |
| Medical or insurance information | Read statements from your health insurer for treatment or claims you don’t recognise, and report them. |
Credit freezes and fraud alerts
| Credit freeze | Fraud alert | |
|---|---|---|
| What it does | Stops lenders from viewing your credit report, so new accounts can’t be opened in your name | Tells lenders to take extra steps to verify your identity |
| Cost | Free | Free |
| How long | Until you lift it | One year; an extended alert is available to identity theft victims |
| How to set up | Contact each of the three bureaus: Equifax, Experian and TransUnion | Contact one bureau; it notifies the other two |
| Good to know | You can temporarily lift it when you apply for credit | Doesn’t block new accounts on its own |
A credit freeze is the stronger protection and doesn’t affect your credit score. Check your credit reports for free at AnnualCreditReport.com, the official site, and look for accounts or credit checks you don’t recognise.
If someone has already used your information
- Contact the business where the fraud happened — your bank, card issuer or the lender — and ask them to close or freeze the account.
- Report it at IdentityTheft.gov, the US Federal Trade Commission’s site, which creates a personal recovery plan.
- Place a credit freeze or extended fraud alert.
- Keep records: the breach notice, reference numbers, dates of calls and copies of letters.
Watch out for scams after a breach
- Fake follow-up messages that mention the breach and ask you to “confirm” your details.
- Calls pretending to be your bank asking for codes or telling you to move money to a “safe account”. Your bank won’t do that.
- Offers of paid “breach removal” services — nobody can remove your data from criminals.
- Fake settlement or compensation claims. Real settlements exist, but find them through the company’s official notice, not links in unexpected emails.
Our guide to spotting phishing attacks covers the warning signs.
Is free credit monitoring worth accepting?
If the breached company offers free credit or identity monitoring, it can be worth enrolling — but enrol through the company’s official notice or website, and read what you’re signing up for. Monitoring tells you after something happens; a credit freeze helps stop it happening in the first place.
Reduce the damage from future breaches
- Use unique passwords for every account, stored in a password manager.
- Turn on 2FA for important accounts, and use passkeys where offered.
- Keep devices and apps updated — updates fix security holes attackers use.
- Share less. Skip optional fields on sign-up forms and delete accounts you no longer use.
- Keep your credit frozen and lift it only when you need credit.
Frequently asked questions
My email was in a breach. Am I in danger?
An exposed email address alone mainly means more spam and phishing. The bigger risk is if a password was exposed too — change it everywhere you used it.
Should I delete my account with the breached company?
If you no longer use it, deleting it reduces future risk. It won’t undo the data already exposed, so still follow the steps above.
Does a credit freeze hurt my credit score?
No. A freeze doesn’t affect your score, and you can still use your existing cards and accounts.
Can I sue the company?
Sometimes there are class actions or settlements, depending on where you live and what happened. Watch for official settlement notices, and speak to a lawyer if you suffered real losses.
Related guides
- Password managers for beginners
- Two-factor authentication setup guide
- How to spot phishing attacks
- Online banking security for beginners
