What to Do After a Data Breach: A Privacy-First Action Plan

Verify before responding

A breach notice can be genuine and still become an opportunity for scammers to imitate the company. Visit the organization’s known website or app, or call a number from a statement or card. Confirm whether an incident occurred, what types of information were involved, and whether the company offers recovery assistance. Do not reply with a password, verification code or identity document.

Secure the accounts connected to the incident

Change the password for the affected account and any other account where you reused it. Use a unique password and enable multifactor authentication if available. Review active sessions, recovery options and third-party access. If your email account is affected, protect it early because it may receive password resets for other services.

Choose a response based on the data

For a payment card, contact the issuer through its official app or phone number and follow its dispute guidance. If Social Security or other identity information was exposed, use IdentityTheft.gov to create a recovery plan and consider a credit freeze at each nationwide bureau. A freeze restricts access to a credit file; it does not remove data from websites or prevent every type of fraud.

Keep the notice and follow up

Save the official notice and any case reference in a secure location. Use monitoring or recovery help only after checking the offer and provider. Watch for unusual account activity and follow the institution’s official reporting process. Do not pay an unexpected caller who claims to fix the breach.

A data breach response and an online privacy cleanup address different problems. Once urgent account risks are handled, use account deletion and broker opt-out processes separately if they fit your situation.

Step-by-step plan

1. Verify the notice using a known channel

   Visit the company’s official website or app by typing its address yourself, or call a number from a statement or card. Check whether the company confirms the incident and which information was involved.

   Privacy caution

   Do not reply to an unexpected breach email with passwords, verification codes, or identity documents. Scammers may imitate real breach notices.

2. Secure affected accounts first

   Change the password for the affected account and any other account where you reused it. Use a unique password, enable multifactor authentication where available, review active sessions, and remove unfamiliar connected apps or recovery methods.

3. Match the next step to the data exposed

   For payment-card details, contact the card issuer through its official channel. For Social Security or other identity data, use IdentityTheft.gov for a tailored recovery plan and consider a free credit freeze at each nationwide credit bureau. For an exposed email address, expect more phishing and secure the email account used for password resets.

   Privacy caution

   A credit freeze restricts access to a credit file; it does not remove personal information from websites or data brokers.

4. Use the help the breached organization offers

   Read the official notice for the data involved, support contacts, and any free monitoring or recovery help. Keep the notice and your case number, but store them in a secure place and avoid forwarding sensitive documents unnecessarily.

5. Watch for misuse and follow up

   Review relevant bank, card, email, and account activity. Keep a short record of the steps taken and when to check again. If you see unauthorized activity, contact the institution directly and follow its official dispute process.

6. Reduce other exposure separately

   A breach response does not automatically remove people-search listings or search results. Once urgent account risks are addressed, use the removal guide and account-deletion directory for those separate requests.

Frequently asked questions