Data Breaches: What to Do
Your information has almost certainly been exposed in at least one data breach, from an employer, health system, store or app. A breach notice doesn’t mean you’ll be a victim, but it’s time to take a few protective steps.
- Everyone
First, figure out what was exposed
| Exposed | What to do |
|---|---|
| Password | Change it, and anywhere else you used the same one. Turn on two-factor authentication. |
| Credit or debit card | Watch statements; ask the bank for a new card if you see anything odd. |
| Bank account number | Watch the account; talk to your bank about extra protection. |
| Social Security number | Freeze your credit; consider an IRS Identity Protection PIN. |
| Health information | Review insurance statements for care you didn’t get. |
| Email and phone | Expect more phishing and scam calls. |
Steps that help after any breach
- Use unique passwords for every account, ideally in a password manager. See Password Managers
- Turn on two-factor authentication. See Two-Factor Authentication
- Freeze your credit at all three bureaus; it’s free. See Credit Freeze
- Check your credit reports for free at AnnualCreditReport.com
- Sign up for any free credit monitoring the company offers
- Review bank and card statements regularly
Watch for breach-themed scams. Criminals send fake breach notices, “refund” offers and calls pretending to be the company. Go directly to the company’s website or call the number on your statement; don’t use links or numbers from unexpected messages. See Phishing Emails.
If your identity is misused
Go to IdentityTheft.gov to report it and get a personal recovery plan. See Identity Theft.
Standards & references
Last updated: