Identity Protection Guide
What to Do After a Data Breach: 10 Steps to Protect Yourself
Finding out that your personal information was exposed can feel scary—but panic will not protect your identity. A clear, fast response can.
Affiliate disclosure: As an Amazon Associate I earn from qualifying purchases. This does not increase your price. We may receive a commission if you buy through an eligible link on this page.
You open an email and see the words nobody wants to read: “We recently discovered unauthorized access to our systems.” Your name, password, Social Security number, account information, or other personal data may have been exposed.
Before you assume the worst, remember this: a data breach does not automatically mean someone has stolen your identity. It does mean your risk may be higher, and the type of information exposed determines what you should do next.
Your Quick Data-Breach Checklist
- Confirm that the notice is legitimate.
- Identify exactly what information was exposed.
- Change affected and reused passwords.
- Turn on multifactor authentication.
- Freeze your credit when sensitive identity data was exposed.
- Consider placing a fraud alert.
- Review all three credit reports.
- Secure bank, card, tax, and mobile accounts.
- Use monitoring and respond quickly to alerts.
- Report and document identity theft if it occurs.
Confirm the Breach Notice Is Real
A real-looking email can still be a phishing attempt. Instead of using links or phone numbers inside the message, independently visit the company’s official website. Look for a security announcement or use a trusted number from your statement, card, or account.
Do not provide your Social Security number, password, or verification code to someone who contacts you unexpectedly. A legitimate company should be able to explain what happened without asking you to surrender sensitive credentials.
Find Out What Information Was Exposed
Your response should match the data involved. A leaked email address calls for different action than an exposed Social Security number. Read the notice carefully and save a copy.
| Information exposed | Priority response |
|---|---|
| Password or login | Change it immediately everywhere it was reused and enable multifactor authentication. |
| Credit or debit card | Contact the issuer, replace the card if advised, and monitor transactions. |
| Bank account number | Call the bank’s fraud department and ask whether the account should be restricted or replaced. |
| Social Security number | Freeze your credit, inspect your reports, and watch for tax, employment, and benefits fraud. |
| Driver’s license | Contact your state motor-vehicle agency and follow its replacement or fraud-reporting process. |
| Health information | Review insurance explanations of benefits and question unfamiliar providers, services, or claims. |
Change Your Passwords—Starting With Your Email
Your email account is often the key to resetting other accounts, so secure it first. Create a long, unique password that you do not use anywhere else. Then update the password for the breached service and every account where you reused it.
A password manager can generate and store unique passwords. Also review your email settings for unfamiliar forwarding addresses, recovery emails, devices, or sign-in activity.
Turn On Multifactor Authentication
Multifactor authentication adds another verification step after your password. When available, an authenticator app or security key generally provides stronger protection than a text message. Never share a one-time code with someone who calls, emails, or texts you.
Start with your email, financial accounts, mobile carrier, shopping accounts, and social media. This step can stop a stolen password from becoming a successful account takeover.
Freeze Your Credit With All Three Bureaus
If your Social Security number or other sensitive identity information was exposed, a credit freeze can make it harder for a thief to open a new credit account in your name. Freezing one report does not freeze the others—you must contact Equifax, Experian, and TransUnion separately.
A freeze is free, does not hurt your credit score, and can be lifted when you legitimately apply for credit. Keep your login information and confirmation details somewhere secure. The FTC explains credit freezes and fraud alerts and links to each bureau.
Decide Whether You Need a Fraud Alert
A fraud alert tells businesses checking your credit to verify your identity before opening a new account. Unlike a freeze, you only need to contact one of the three nationwide credit bureaus; that bureau must notify the other two.
An initial fraud alert lasts one year. An extended alert may be available to identity-theft victims who complete an official report. A freeze usually offers stronger control over access to your credit file, but the two tools serve different purposes.
Check All Three Credit Reports
Visit AnnualCreditReport.com, the federally authorized site for free reports, and review your Equifax, Experian, and TransUnion files. Look for unfamiliar accounts, hard inquiries, addresses, employers, balances, or collection items.
Your credit report and credit score are not the same thing. The report contains the account-level information you need when hunting for fraud. Read our guide to credit reports versus credit scores if you are unsure what each one shows.
Secure Your Financial, Tax, and Mobile Accounts
Review recent transactions—even very small ones. Fraudsters sometimes test stolen payment details with a tiny charge before attempting a larger purchase. Turn on transaction alerts and contact the bank or card issuer through its official channel when something looks wrong.
If your Social Security number was exposed, consider requesting an IRS Identity Protection PIN to help prevent someone from filing a federal tax return using your identity. Also add a carrier account PIN to reduce the risk of a criminal hijacking your phone number through a SIM-swap scam.
Use Credit and Identity Monitoring Wisely
Monitoring cannot prevent every form of identity theft, and it is not a replacement for a credit freeze. Its value is speed: an alert may help you notice a suspicious application, account change, or use of your personal information sooner.
If the breached company offers free monitoring, read the terms and consider enrolling before the deadline. You can also compare ongoing services in our guide to the best credit-monitoring apps and learn how credit alerts can help protect you.
Want Ongoing Identity Alerts and Restoration Support?
LifeLock Standard includes identity alerts, monthly credit access, and access to a U.S.-based identity-restoration specialist. Review the current Amazon listing, coverage terms, activation requirements, and renewal details before purchasing.
Check LifeLock Standard on AmazonReport Identity Theft and Keep Records
If someone actually uses your information, visit IdentityTheft.gov. The Federal Trade Commission can help you create an Identity Theft Report and a personalized recovery plan.
Contact the company where the fraud occurred, dispute fraudulent credit-report information, and keep a written timeline. Save confirmation numbers, letters, emails, screenshots, receipts, and the names of representatives. Send important disputes using a trackable method and keep copies.
Credit Freeze vs. Fraud Alert vs. Monitoring
| Tool | What it does | What it does not do |
|---|---|---|
| Credit freeze | Restricts access to your credit file, making many new-account applications harder to complete. | Does not monitor existing bank or credit-card transactions. |
| Fraud alert | Asks businesses to take extra steps to verify your identity before issuing new credit. | Does not block access to your credit report. |
| Credit monitoring | Notifies you about certain changes or activity in monitored credit files. | Does not stop fraud by itself or guarantee every identity event will be detected. |
| Identity monitoring | May scan additional sources for signs that personal information is being misused. | Cannot remove exposed data from every criminal marketplace or prevent every scam. |
Common Mistakes to Avoid After a Breach
- Waiting for fraud before acting: Sensitive information can be stored and misused months or years later.
- Freezing only one bureau: Complete the process with all three nationwide credit bureaus.
- Reusing a “new” password: Every important account should have its own password.
- Paying to freeze your credit: A legitimate credit freeze is free.
- Assuming monitoring prevents fraud: Monitoring is an early-warning system, not an invisible wall.
- Ignoring small charges: A tiny unauthorized transaction may be a test.
- Trusting unexpected callers: A real alert can be followed by fake “support” calls designed to steal codes or money.
Frequently Asked Questions
How quickly should I act after a data breach?
Act as soon as you confirm the notice and understand what was exposed. Immediately change compromised passwords and contact financial institutions about exposed account information. If a Social Security number was involved, prioritize freezing your credit.
Will a credit freeze lower my credit score?
No. A credit freeze does not affect your credit score. It also does not stop you from using existing credit cards or paying current loans.
Should I replace my Social Security number?
A replacement number is not a routine response to a data breach, and getting one does not erase the history connected to the old number. Start with freezes, report actual identity theft, and follow guidance from the Social Security Administration if misuse creates serious ongoing harm.
Is free monitoring from the breached company safe?
It can be useful if the offer is legitimate. Enroll by navigating to the company’s verified website—not by blindly clicking an email link—and read the duration, renewal terms, data collected, and scope of monitoring.
Do I still need monitoring if my credit is frozen?
A freeze and monitoring perform different jobs. A freeze restricts many new-credit checks, while monitoring may alert you to certain changes. Neither tool covers every form of fraud, including misuse of an existing bank account, tax identity theft, or medical identity theft.
Take the Next Step
Compare LifeLock Standard’s current features, eligibility, reimbursement terms, activation instructions, and renewal conditions directly on Amazon.
View LifeLock StandardEditorial note: This article provides general educational information and is not legal, financial, or cybersecurity advice. Product features and terms can change. Verify current details before purchasing or taking action.
