If a company just told you your personal information was exposed, here is what to do after receiving a data breach letter: confirm the notice is real, freeze your credit with all three bureaus, watch your accounts, and take a few extra steps if your Social Security number, medical information, or a child’s data was involved. The letter itself matters less than the next two weeks of your attention.
Confirm the Letter Is Real Before You Do Anything
Scammers send fake breach notices because real breaches generate real fear. Before you click, call, or type anything, verify the notice independently.
Look up the organization’s official website and phone number on your own rather than using any contact details printed in the letter. Search the company’s name together with “data breach” and see whether news outlets are reporting the same incident. A legitimate breach letter will not ask you to click a link to “verify your identity,” download software, or send your Social Security number or bank details in a reply. Alarming language demanding immediate action, misspelled company names, and suspicious sender addresses all point to a scam.
Real notices tend to read as plain, formulaic documents. They describe what happened, list the categories of data involved, offer specific protective services with an activation code, and give a contact point. Once you have confirmed the breach is genuine, move on to the protective steps.
Freeze Your Credit With All Three Bureaus
A credit freeze is the single most effective step you can take. It blocks lenders from pulling your credit report, which stops criminals from opening new accounts in your name. Freezes are free to place and free to lift under federal law, and they do not affect your credit score.1Federal Trade Commission. Credit Freezes and Fraud Alerts
You have to contact each of the three major credit bureaus separately: Equifax, Experian, and TransUnion. Each one gives you a PIN or password that lets you temporarily lift the freeze whenever you want to apply for credit yourself. Store those credentials somewhere you will actually find them later.
If a full freeze feels too restrictive, a fraud alert is a lighter alternative. An initial fraud alert lasts one year and requires lenders to take reasonable steps to verify your identity before extending credit. If you have already experienced identity theft and filed a report, you can request an extended fraud alert that lasts seven years.2Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts Unlike a freeze, you only need to contact one bureau to place a fraud alert; that bureau is required to notify the other two. Both options are free.1Federal Trade Commission. Credit Freezes and Fraud Alerts
In practice, a freeze is almost always the better choice. Most people do not apply for new credit often enough for the occasional lift to be a real burden, and a freeze is a hard block rather than a suggestion that lenders double-check identity.
Monitor Your Credit Reports and Accounts
The three major bureaus have permanently extended free weekly credit reports through AnnualCreditReport.com.3Federal Trade Commission. Free Credit Reports Pull a report from one bureau right away and stagger the others over the next few weeks. Scan for accounts you did not open, inquiries you did not authorize, and addresses you do not recognize.
Review your bank and credit card statements line by line for charges you do not recognize. Turn on transaction alerts through your bank’s app so every purchase pings your phone. If the breached organization is offering free credit monitoring, take it. There is no downside, and it is one more layer of surveillance you do not have to run yourself.
Change passwords for any account that could be affected, especially if the breach involved login credentials. Use a unique password for each account, turn on multi-factor authentication wherever it is offered, and if you reused the compromised password anywhere else, change those accounts too.
If Your Social Security Number Was Exposed
A leaked SSN opens the door to tax identity theft: someone files a fraudulent return in your name and claims your refund. You may not find out until you try to file and the IRS rejects your return as a duplicate.
The strongest preventive step is an IRS Identity Protection PIN. It is a six-digit number the IRS requires on your return, which makes it nearly impossible for anyone else to file as you. Anyone with an SSN or Individual Taxpayer Identification Number can enroll. The fastest route is through your IRS Online Account. If you cannot verify your identity online and your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), you can apply using Form 15227. Otherwise, you can visit a Taxpayer Assistance Center in person with government-issued identification.4Internal Revenue Service. Get an Identity Protection PIN
If you actually see signs of tax identity theft — an e-filed return rejected as a duplicate, a notice about income you did not earn, or a tax transcript you never requested — you may need to file Form 14039, the Identity Theft Affidavit. Only file it if the IRS has not already sent you a letter with instructions. Certain IRS letters, such as 5071C or 4883C, come with their own verification process that replaces the affidavit.5Internal Revenue Service. When to File an Identity Theft Affidavit
If Your Medical Information Was Exposed
Healthcare breaches carry a specific risk: medical identity theft. Someone using your insurance information can receive treatment, fill prescriptions, or submit fraudulent claims in your name. The financial damage is one problem. The bigger one is that a stranger’s medical history, including allergies, blood type, and conditions, can get mixed into your records and affect the care you receive later.
Start with your Explanation of Benefits statements from your health insurer. These list every visit, service, and prescription billed to your plan. Look for services you never received and providers you have never seen.6Federal Trade Commission. What To Know About Medical Identity Theft
If you find anything unfamiliar, contact the provider and your insurer, explain the situation, and ask for copies of the medical records tied to those charges. Review them for errors. Report incorrect entries in writing, including a copy of the record showing the wrong information and an explanation of why it is wrong. Send disputes by certified mail so you have proof of delivery. The provider must respond within 30 days and notify other providers who may have received the same inaccurate information.6Federal Trade Commission. What To Know About Medical Identity Theft
If a Child’s Information Was Exposed
Children’s Social Security numbers are especially valuable to identity thieves because the fraud can go undetected for years. No one checks a seven-year-old’s credit. The most important step is freezing their credit file with all three bureaus.
Federal law allows parents and legal guardians to place a free security freeze on a minor’s credit report.7Consumer Financial Protection Bureau. Free Credit Freezes Are Here For children, the process is handled by mail rather than online. You will typically need proof of your own identity, proof that you are the child’s parent or guardian (such as a birth certificate or court order), and documentation of the child’s identity (their birth certificate and Social Security card). Each bureau has its own form, so check their websites.
You can also request an IRS Identity Protection PIN for a dependent to prevent fraudulent returns using their SSN.4Internal Revenue Service. Get an Identity Protection PIN For children under 18, you will need to use Form 15227 or the in-person method rather than an online account.
If Someone Has Already Used Your Information
Exposure and misuse are different problems. If you discover that fraudulent accounts, charges, or filings have actually appeared, report it to the Federal Trade Commission at IdentityTheft.gov. The site asks you a series of questions and generates a personalized recovery plan with step-by-step instructions, pre-filled letters, and forms to send to creditors, debt collectors, and credit bureaus.8Federal Trade Commission. How to Recover from Identity Theft
File a police report as well if the theft involves accounts opened in your name or charges you did not make. Some creditors and agencies will not investigate or reverse fraudulent activity without one. Keep copies of every report, letter, and dispute you file. Recovery often takes months, and documentation is what separates a resolved dispute from one that drags on.
Notification Timing and Your Legal Options
How quickly a company has to tell you depends on what kind of organization it is. Healthcare entities covered by HIPAA must notify affected individuals within 60 calendar days of discovering the breach.9eCFR. 45 CFR 164.404 – Notification to Individuals At the state level, roughly 20 states set numeric deadlines ranging from 30 to 60 days, while the rest require notification “without unreasonable delay.” If your letter arrived months after the incident, that delay may itself violate your state’s law.
Your options for suing are more limited than many people expect. There is no comprehensive federal law giving individuals a broad right to sue companies over data breaches. A growing number of states allow consumers to pursue statutory damages when a company’s negligence caused the breach, but whether you have a viable claim depends on your state, the type of data exposed, and whether you suffered actual harm. If a breach caused significant financial damage or identity theft that took real time and money to resolve, talking to an attorney who handles data privacy cases is worth the call.