Recommended Free Tools
Did you get a notice that says your personal information was exposed in a data breach? Start by identifying exactly what was exposed, then follow the response for that data type. Change compromised passwords, protect an exposed Social Security number with credit-file checks and possibly a freeze, replace exposed payment cards, and treat unexpected follow-up messages as potential phishing. In the United States, the Federal Trade Commission (FTC) directs consumers to IdentityTheft.gov/databreach for a plan matched to the information involved.
Start with the breach notice, not a panic purchase
Read the notice from the organization carefully and record three things:
As an Amazon Associate I earn from qualifying purchases.
- Which categories were exposed: a password or username, Social Security number, payment-card number, bank details, medical information, answers to security questions, or other personal data.
- Whether the organization says misuse has already been detected or only that exposure was possible.
- What the organization is offering, such as free credit monitoring, identity-theft insurance, a dedicated help line, or account-recovery instructions.
Use contact details in the notice only after checking that they are genuine. If you need to call, find the organization’s phone number on a statement, card, or website you already know is real rather than relying on an unexpected message. Free services offered because of the breach are worth using; you do not automatically need a paid monitoring plan, special hardware, or every protection product advertised to you.
The FTC’s consumer guidance puts the first step plainly: “First, take a deep breath. Then, visit identitytheft.gov/databreach.” Follow the tailored questions there before choosing additional action.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Match your response to the information exposed
A breach does not create one uniform task list. The immediate risk and the useful remedy depend on the data category.
| Exposed information | First actions | What to keep watching |
|---|---|---|
| Username, password, or security-question answers | Change the password on the affected account and every account where you reused it. Replace exposed security-question answers and turn on multifactor authentication (MFA). | Login alerts, password-reset messages, new devices, and account changes. |
| Social Security number | Review free credit reports for unfamiliar accounts or charges. Consider a credit freeze with Equifax, Experian, and TransUnion, and enroll in any free monitoring offered by the breached organization. | New credit inquiries, accounts, collection notices, bills, and tax or benefits correspondence you did not initiate. |
| Payment-card number | Contact the card issuer and ask whether it should issue a new card number. Review transactions and report unauthorized charges promptly. | Pending and posted transactions, digital-wallet activity, and replacement-card mail or messages. |
| Other personal or medical information | Use the breach-specific plan at IdentityTheft.gov/databreach and follow the organization’s instructions for the affected service. | Unfamiliar bills, account activity, benefit or insurance notices, and targeted scams using the exposed details. |
Secure accounts when credentials were exposed
Change the affected password first
Sign in through the service’s known website or app, not a link in the breach notice or a later email. Set a new, unique password. If the exposed password was reused anywhere else, change each of those accounts too; attackers routinely try leaked credentials on unrelated services.
Replace security-question answers
If answers to security questions were included, update them anywhere they are used. Do not simply choose a different question whose answer is publicly discoverable. Where a service allows it, use a long, unique answer that is stored in your password manager rather than a fact someone could learn from social media.
Turn on multifactor authentication
Enable MFA in the account’s security settings. An authenticator app, text message, or another method may be available. The FTC also lists a physical security key as one possible second factor for accounts that support it; buying one is optional, not a required breach response. Save the service’s recovery codes somewhere secure so you are not locked out if you lose your second-factor device.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check sessions and recovery details
After changing the password, review signed-in devices, active sessions, recovery email addresses, phone numbers, forwarding rules, and connected applications. Sign out of sessions you do not recognize and remove unfamiliar connections. Confirm that account alerts go to contact information you control.
Protect an exposed Social Security number
Review your credit reports
Order and review your free credit reports for accounts, inquiries, or charges you do not recognize. Look for new loans, credit cards, collections, and address changes. Keep a record of the creditor, date, and evidence for anything suspicious. Use the recovery guidance in the FTC’s IdentityTheft.gov recovery guide if you find signs of misuse.
Consider a credit freeze
A credit freeze restricts access to the credit report lenders generally use when deciding whether to open new credit. It is free, available to anyone, does not change your credit score, and remains in place until you lift it. You must request it separately from Equifax, Experian, and TransUnion. When you want to apply for credit, temporarily lift the freeze or remove it, then restore it afterward if you still want the restriction.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →A freeze does not stop someone from using an existing card or bank account, so continue checking those accounts. It also does not replace password changes or other steps for credentials exposed in the same incident.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Understand a fraud alert
A fraud alert is different: it asks lenders to verify your identity before granting new credit. It does not block access to your credit file in the way a freeze does. The FTC explains both measures and their mechanics at Credit Freezes and Fraud Alerts. Choose the measure that fits how much inconvenience you can accept when applying for credit and how strongly you want to restrict new-account decisions.
| Protection | What it does | Cost and duration | Your task before applying for credit |
|---|---|---|---|
| Credit freeze | Restricts access to your credit report for new-credit decisions. | Free; stays until you lift it. | Temporarily lift or remove it with the relevant bureau before a lender checks your file. |
| Fraud alert | Asks lenders to verify your identity before granting new credit. | Duration depends on the alert type described by the FTC. | Tell the lender an alert is present and complete its identity-verification process. |
Use free breach-related monitoring
If the organization offers free credit monitoring or identity-theft monitoring, enroll through a verified route and note the enrollment deadline, coverage period, and what information the service actually watches. Monitoring can notify you about activity; it does not itself prevent a fraudulent application or replace reviewing your reports. Paid services often renew at a recurring fee, so check the renewal price and cancellation terms before accepting a paid upgrade.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Respond when payment-card data was exposed
Call the bank or card issuer using the number on the back of your card or a statement. Ask whether it recommends replacing the card number. The FTC’s breach guidance specifically advises asking the issuer about a new number after card data exposure.
Continue checking pending and completed transactions, even after a replacement card arrives. Report unauthorized charges through the issuer’s established dispute process and keep confirmation numbers, dates, and copies of messages. A card replacement addresses that card number; it does not secure an email account or other credentials exposed in the same breach.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Expect phishing after the announcement
Breach news gives scammers a believable reason to contact you. A message may claim to provide monitoring enrollment, demand an urgent password reset, or ask for a Social Security number, payment, or one-time code. Do not click links or open attachments in unexpected texts and emails. Instead, type the organization’s known web address yourself or call a verified number.
Be especially cautious of anyone asking you to move money, install remote-access software, read back an MFA code, or “verify” your full credentials. The FTC discusses phishing and breach-related scams in its consumer guidance at Have you been affected by a data breach? Read on.
If you find actual identity theft
Exposure alone is not proof that someone has used your identity. If you discover an account you did not open, an unauthorized charge, or another concrete misuse, report it at IdentityTheft.gov. The FTC provides an individualized recovery plan based on what happened. Follow the plan’s instructions for contacting businesses, disputing accounts, documenting the incident, and securing remaining accounts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep a dated incident file containing the breach notice, account statements, credit-report entries, call logs, dispute letters, and case numbers. This record helps you track deadlines and demonstrate which transactions or accounts are not yours.
A practical timeline
Today
- Read the notice and list every exposed data category and offered free service.
- Open IdentityTheft.gov/databreach and follow the plan for those categories.
- Change exposed or reused passwords, update security-question answers, and enable MFA.
- Call the card issuer if payment-card data was involved.
Within the next few days
- Order and inspect free credit reports if a Social Security number was exposed.
- Place a freeze with all three nationwide credit bureaus if that protection suits your situation.
- Enroll in any legitimate free monitoring supplied by the breached organization.
- Review bank, card, email, social, shopping, and other high-value accounts for unfamiliar activity.
Ongoing
- Check statements, credit activity, and account alerts regularly.
- Ignore unexpected follow-up links and verify contacts independently.
- Report confirmed identity theft through IdentityTheft.gov and maintain your incident file.
What you do not need to do automatically
- You do not need to buy paid identity monitoring merely because a notice arrived, especially if the organization offers a free service.
- You do not need a security key unless an affected account supports it and you want that additional MFA option.
- You do not need to freeze credit for every type of exposure; a freeze is most directly relevant to new-credit risk, particularly after Social Security number exposure.
- You should not assume a freeze protects existing bank or card accounts; those still require transaction monitoring.
U.S. scope and limits
This guidance is based on U.S. FTC consumer resources. Credit-bureau procedures, notification rules, and legal remedies differ in other countries. The right response also changes if misuse has already occurred, if the notice covers medical or employment data, or if several data categories were exposed. In those cases, use the tailored FTC recovery plan and the organization’s verified instructions rather than applying a one-size-fits-all product or checklist.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
