Act, but do not panic. Read the notice to find out exactly what information was exposed, when the incident happened, and what protection the company is offering. Then follow the response that matches the data: change exposed or reused passwords, turn on multifactor authentication, review financial activity, and consider a credit freeze or fraud alert if your Social Security number was involved. The Federal Trade Commission’s starting point for a tailored checklist is IdentityTheft.gov/databreach.
A breach notice does not prove that someone has already stolen your identity. It does mean you should reduce the ways the exposed information can be used and watch for signs of misuse. The steps below reflect U.S. FTC consumer guidance; they are not a complete statement of notification laws or legal rights in every state or country.
As an Amazon Associate I earn from qualifying purchases.
1. Read the notice and verify that it is genuine
Before clicking a link or calling a number in an unexpected message, inspect the notice carefully. A legitimate letter or email should identify the company, describe the incident, and explain which categories of information were involved. Record the important details in a secure note.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Information involved: This might be an email address, password, Social Security number, payment-card number, bank-account details, medical information, or a combination.
- Timing: Note when the company says the exposure occurred and when it discovered it. These dates help you interpret old statements and suspicious contacts.
- Accounts affected: Confirm which customer account, policy, application, or service is included.
- Recommended action: Look for instructions to reset credentials, replace a card, contact a fraud department, or enroll in free monitoring.
- Offer terms: Check how long any monitoring or identity-theft insurance lasts, what data it covers, and how enrollment works.
Phishing messages often imitate breach notices. If the message asks for a password, payment, or urgent download, do not use its links or phone numbers. Instead, type the company’s known web address yourself, use a statement or card you already have, or call a number obtained independently. Ask the company to confirm whether the notice is real and which account is affected.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Match your response to the exposed information
Different data creates different risks. The FTC’s data-breach guidance directs consumers to an individualized checklist rather than treating every incident the same.
Email address or other contact details
Expect an increase in convincing scam emails, texts, and calls. Do not confirm personal details to an unsolicited caller. Tighten spam filters, review account-recovery settings, and use an authenticator app or another multifactor option on important accounts.
Password or security question
Change the password immediately on the affected service and everywhere you reused it, including accounts where you used a similar variation. A password manager can create a different long password for each site. Sign out other sessions if the service provides that control, replace exposed security-question answers, and check that the recovery email address and phone number still belong to you. FTC guidance for hacked email and social accounts is available at this account-security checklist.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Payment-card or bank information
Contact the card issuer or bank through a verified channel. Ask whether the account or card should be blocked, replaced, or monitored. Review posted and pending transactions, enable transaction alerts, and continue checking statements because a credit freeze does not stop fraudulent activity on an existing account.
Social Security number
Obtain and review your credit reports, consider a freeze or fraud alert, and watch for tax-related warning signs. Keep records of the breach notice and every action you take. The FTC’s recovery guide explains documentation and dispute steps in detail at IdentityTheft.gov: A Recovery Guide.
3. Secure exposed accounts immediately
- Start with the affected service. Go to the company’s site or app independently, open account or security settings, and set a new password that has never been used elsewhere.
- Find every reuse. Search your password manager or make a list of sites that used the same or a similar password. Change high-value accounts first: email, banking, cloud storage, shopping, health, and social accounts.
- End unknown sessions. Use options such as “sign out of all devices,” “active sessions,” or “revoke app access.” Remove unfamiliar third-party applications.
- Turn on multifactor authentication. Prefer an authenticator app, passkey, or a security key when the service supports it; text-message codes are still better than no second factor. A hardware key is optional and cannot solve exposure of a Social Security number.
- Check recovery channels. Confirm that backup email addresses, phone numbers, trusted devices, and recovery codes have not been changed. Generate new recovery codes after a reset.
- Watch for follow-up attacks. Attackers may use a real breach detail to impersonate the company. Treat requests for one-time codes, remote access, gift cards, or cryptocurrency as scams.
Changing one password is not enough if the same credential was reused. Prioritize accounts that can reset other passwords, move money, access private files, or expose additional identity information.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Review financial accounts and credit activity
Log in through official apps or bookmarked sites and inspect recent and pending activity. Look for unfamiliar purchases, withdrawals, transfers, new payees, address changes, paperless-statement changes, bills, or credit inquiries. Save screenshots or statements showing suspicious activity.
- Call the bank or card issuer’s fraud department using the number on your card or statement.
- Ask whether the account should be closed, frozen, or reissued and how to dispute unauthorized transactions.
- Change the account password and PIN; do not reuse the exposed credential.
- Enable alerts for purchases, withdrawals, login attempts, and profile changes.
- Continue monitoring even after a replacement card arrives; existing-account misuse can occur separately from new-account fraud.
For suspected identity theft, the FTC’s identity-theft overview and recovery instructions explain how to document the case and contact businesses.
5. Decide between a credit freeze and a fraud alert
If a Social Security number or other information that could be used to open credit was exposed, review your reports and choose a protection that fits your circumstances. The FTC says, “A credit freeze is something you can do anytime, for any reason.”
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Protection | What it does | Where to request it | Cost and duration | Effect on applying for credit |
|---|---|---|---|---|
| Credit freeze | Restricts access to your credit report, making it harder to open a new account in your name. It does not stop charges or withdrawals on existing accounts. | Contact Equifax, Experian, and TransUnion separately. | Free; remains until you lift it. | You must temporarily lift it when a legitimate lender needs access. |
| Initial fraud alert | Asks businesses to verify your identity before opening new credit. It does not block report access. | Contact any one of the three nationwide bureaus; that bureau must notify the other two. | Free; lasts one year. | Usually easier than a freeze, but lenders decide how to verify you. |
A freeze offers the stronger restriction on new-credit access but requires three separate requests. An alert is simpler to place and may be more convenient if you expect to apply for credit soon. You can use both. When you apply for a loan, apartment, job-related screening, or utility service, ask which bureau will be checked and lift the freeze only for the necessary period.
Get reports from all three bureaus and look for unfamiliar accounts, hard inquiries, addresses, employers, or collection notices. A freeze does not affect your credit score. The FTC explains the mechanics and trade-offs in its credit-freeze guidance and its freeze-versus-alert comparison.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems6. Watch for tax identity theft after an SSN exposure
An exposed Social Security number can be misused for employment or tax filing even when your credit reports look normal. Be alert for an unexpected IRS letter, a notice that more than one tax return was filed, or a tax transcript you did not request. Keep the breach notice with your tax records and respond to genuine government correspondence through an official channel. Do not send an SSN or identity documents to someone who contacts you unexpectedly.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
7. Use the company’s free services carefully
Accept free credit monitoring or identity-theft assistance offered because of the breach when it is relevant to the exposed data. Before enrolling, confirm:
- the enrollment deadline and the exact length of coverage;
- which credit bureaus, accounts, dark-web indicators, or identity fields are monitored;
- how alerts arrive and whether you must activate them;
- what recovery specialists actually do if an alert appears;
- insurance limits, deductibles, exclusions, and documentation requirements; and
- whether the service automatically converts to a paid plan after the free period.
Monitoring can alert you to some changes, but it cannot remove exposed data from the internet, prevent every fraudulent transaction, or replace a password reset, bank contact, credit freeze, or fraud report. If you are considering a paid service, ask what it monitors, how long it operates, what recovery help is included, which losses are excluded, and the recurring price. Do not provide more information than enrollment requires.
8. What to do if you find actual misuse
Move from prevention to recovery as soon as you see an unauthorized account, charge, withdrawal, password reset, or government notice.
Recommended Free Tools
- Contain the account. Contact the affected company’s fraud department. Ask it to close or freeze the account, block transactions, preserve records, and explain its identity-verification process.
- Change credentials and PINs. Reset the compromised account and any reused password. Secure the email account that receives recovery messages.
- Dispute fraudulent activity. Follow the bank, card issuer, lender, or service provider’s written dispute procedure and keep copies of forms, dates, names, and case numbers.
- Review all credit reports again. Identify every unauthorized inquiry or account and ask each business what documentation it needs to investigate.
- Report the theft. File a report at IdentityTheft.gov to receive an individualized recovery plan and guidance on letters, disputes, and supporting records.
- Escalate when necessary. If a company will not correct an account or a government document appears fraudulent, ask for a supervisor and consult an appropriate consumer-protection or legal service in your jurisdiction.
Keep a dated incident log. Record the original notice, screenshots, statements, police or FTC report numbers, correspondence, and postage. Organized records prevent you from repeating the same explanation and help establish when you disputed an account.
9. A practical response timeline
Today
- Verify the notice through an independently known channel.
- Identify the exposed data and affected accounts.
- Change exposed and reused passwords, sign out other sessions, and enable multifactor authentication.
- Call a bank or card issuer if payment information was involved.
Within the next few days
- Review statements, pending transactions, and credit reports.
- Place freezes with all three bureaus or an initial fraud alert with one, if appropriate.
- Enroll in relevant free monitoring before its deadline and save the terms.
- Check recovery email addresses, phone numbers, PINs, and connected applications.
During the monitoring period
- Open every alert and verify it through the underlying account, not an email link.
- Continue checking bank and card statements because monitoring and freezes cover different risks.
- Watch for tax notices, collection letters, password-reset messages, and new-account inquiries.
- Keep your incident log and update it whenever a company gives you a case number or correction.
10. Common mistakes to avoid
- Assuming a breach equals identity theft: Exposure creates risk; it is not proof of misuse. Take protective steps and look for evidence.
- Changing only the breached site’s password: Reused credentials can unlock unrelated accounts.
- Relying on monitoring alone: Alerts may arrive after damage, and they do not secure existing bank or card accounts.
- Freezing one bureau only: A freeze must be placed separately with Equifax, Experian, and TransUnion.
- Ignoring pending transactions: Fraud can appear before a charge posts.
- Calling a number in a suspicious message: Verify contact information independently.
- Forgetting the free-service end date: Put a reminder on your calendar and decide whether to continue before any paid renewal.
The FTC summarizes the first move plainly: “First, take a deep breath. Then, visit identitytheft.gov/databreach.” From there, let the type of information exposed determine your next action, document what you do, and escalate promptly if you find real misuse.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
