If you receive notice that a U.S. government agency or employer lost or exposed your personal information, first confirm the notice through an official channel, then check exactly which data was involved. Use the Federal Trade Commission’s IdentityTheft.gov data-breach recovery page for next steps. A breach does not by itself mean someone has used your information; the right response depends on what was exposed and whether you see signs of misuse.
What should I do if my employer’s data was stolen—or the government lost my personal information?
- Verify the notice safely. Visit the organization’s official website or use a contact method you already know to confirm the incident. Do not rely on links or phone numbers in an unsolicited email, text, or call; look up contact details independently before sharing information.
- Find out what information was involved. Read the notice for the data types, the incident details, and any free services offered. If the notice is unclear, ask the organization using contact information from its official site. The FTC advises tailoring your response to the information exposed.
- Follow the FTC’s breach-specific guidance. Visit IdentityTheft.gov/databreach and follow the recommendations for the exposed information. If the organization offers free credit monitoring or identity theft insurance, the FTC says to take advantage of it.
- Watch for unfamiliar activity. Review credit reports and account statements relevant to the exposed data. Keep the notice and records of suspicious activity. If you find misuse, use the recovery plan at IdentityTheft.gov.
What to do based on the information exposed
If your Social Security number was exposed
Get free credit reports and look for accounts or inquiries you do not recognize. Consider placing a credit freeze or fraud alert. A freeze can make it harder for someone to open new credit using your information, but it does not prevent unauthorized charges on existing bank, credit-card, or insurance accounts.
As an Amazon Associate I earn from qualifying purchases.
If bank, payment-card, or other financial account details were exposed
Contact the bank, card issuer, or other institution that maintains the account, using its official channel. Check transactions and statements for activity you do not recognize and follow the institution’s instructions for securing the account.
Free tools Windows power users keep installed
One-click scans. No signup required.
If health insurance information was exposed
Review explanations of benefits and billing for unfamiliar services or claims. Contact your insurer or provider through an official channel if something does not look right. Health-data breach duties can depend on the type of information and organization involved; the FTC outlines its Health Breach Notification Rule at Complying with FTC’s Health Breach Notification Rule.
#1 Best Overall
If the notice lists other personal information
Use the notice and the FTC’s data-specific recommendations to decide what to secure and monitor. Do not assume that every breach involved a Social Security number or requires the same response.
Credit freeze or fraud alert: which should you choose?
| Option | What it does | How to start | Important limit |
|---|---|---|---|
| Credit freeze | Restricts access to your credit report for new-credit decisions, making it harder to open new accounts using stolen information. | Contact each of Equifax, Experian, and TransUnion. A freeze is free and remains until you ask for it to be lifted or removed. | Does not stop fraudulent charges on existing bank, card, or insurance accounts; continue checking those statements. |
| Fraud alert | Signals creditors to take steps to verify your identity before granting new credit. | Contact one of the three nationwide credit bureaus; it must notify the other two. The FTC says an initial alert lasts one year. | Does not replace monitoring existing accounts. |
Under FTC guidance, a bureau must place an online or telephone freeze request within one business day and lift it within one hour. A request by mail must be placed or lifted within three business days. These are bureau processing timeframes, not a guarantee that an identity-theft problem will be resolved in that time. See the FTC’s Understanding Your Credit and Credit Freezes and Fraud Alerts.
If you see signs that someone is using your information
Report the identity theft at IdentityTheft.gov and follow the personalized recovery plan. Keep the breach notice and copies or notes of suspicious transactions, accounts, claims, or communications. For general identity-theft guidance, see the FTC’s What To Know About Identity Theft.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What breach notices do—and do not—tell you
A notice should help identify what happened and what information may have been affected, but the response and any legal requirements depend on the organization, information, jurisdiction, and incident facts. The FTC’s Data Breach Response: A Guide for Business is general guidance for organizations, not a ruling on an individual incident or a complete statement of your rights and deadlines. If you need to understand a specific legal obligation or deadline, consult the relevant agency or a qualified adviser in your jurisdiction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
