Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start with the breach notice, not assumptions. Find the sentence that identifies the exposed information: a username or password, payment-card or bank details, Social Security number, or another type of personal data. The right response depends on that category. Use the Federal Trade Commission’s IdentityTheft.gov/DataBreach tool for a step-by-step plan, and contact the organization through a website or phone number you already know is genuine if the notice is unclear.
What a data-breach notice actually tells you
A breach notice is supposed to explain what information an unauthorized person could access. Read the entire notice, including any section headed “information involved,” “data affected,” or similar wording. A notice may say that data was exposed without saying that it was downloaded, sold, or used for fraud. Exposure and confirmed misuse are different events, so do not assume that every possible consequence has already happened.
- Account credentials: A username, email address, password, security-question answer, session token, or similar login data.
- Payment information: A card number, bank-account details, or other information used to make payments.
- Identity information: A Social Security number or information that can be used to apply for credit or services.
- Other personal information: The notice may list contact details, medical information, employment data, or another category. The remedy depends on the exact fields named.
If the notice uses vague language such as “personal information” without a list, ask the organization what fields were involved and whether your individual record was included. Use its official customer-service channel, typed into your browser or taken from a statement you already have, rather than a link in an unexpected message. The FTC’s IdentityTheft.gov/DataBreach questionnaire can also direct you to actions based on the information involved.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →First response: a safe sequence for any breach
- Save the notice. Keep the letter or email, the date you received it, the organization’s incident reference, and any deadline for offered assistance. Do not forward it with unnecessary personal details.
- Identify the exposed category. Write down exactly what the organization says was involved. If the notice lists several categories, handle each one separately.
- Verify the contact route. Navigate to the organization’s known website yourself or use a phone number from a statement, card, or prior account record. Do not use an unexpected link or caller’s number to “enroll” in protection.
- Use tailored government guidance. Enter the category into IdentityTheft.gov/DataBreach and follow the resulting checklist. The tool is more useful than applying a credit freeze or password change to every kind of exposure.
- Document what you do. Record when you changed a password, called an issuer, placed a freeze, disputed a transaction, or filed a report. Keep confirmation numbers and copies of letters.
A company may offer free credit monitoring or identity-theft insurance after an incident. The availability, length, enrollment deadline, and coverage vary by breach. Treat such an offer as an option, not proof that it replaces the steps below.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If a username or password was exposed
Change the affected password immediately
Sign in by entering the service’s known address yourself, then change the password from the account-security page. Do not reuse the new password on another service. If you cannot sign in, use the provider’s normal account-recovery process and check that recovery email and phone details have not been changed.
Eliminate reuse and close variations
Attackers commonly try a stolen password on other services. Change it anywhere the same password was used, and anywhere you used a close variation that an attacker could predict. Prioritize email, financial, cloud-storage, workplace, and social accounts because access to one can help reset another.
Turn on stronger multi-factor authentication
Enable multi-factor authentication (MFA) in the account’s security settings. When the provider supports them, the FTC identifies an authenticator app or a hardware security key as stronger choices than a code sent by text message or email. A security key is optional; compatibility depends on the particular account, and you do not need to buy one to respond to a breach. Keep backup or recovery codes in a secure place that is separate from the account.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Review security questions and active sessions
If security-question answers may have been exposed, replace them with new answers that are not easily found in public profiles. Sign out of unfamiliar sessions and revoke unknown connected apps or access tokens. Check the account’s recovery email, phone number, forwarding rules, and notification settings for changes you did not make.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If payment-card or bank information was exposed
Contact the issuer through a known channel
Call the bank or card issuer using the number printed on the card, a statement, or the institution’s established website. Explain that your information was included in a breach and ask whether the account should be closed or a new card number issued. FTC guidance for exposed payment-card data specifically recommends requesting a new card number.
Check activity and report unfamiliar transactions
Review recent and subsequent statements, pending transactions, alerts, and linked digital-wallet activity. Report anything you do not recognize promptly, following the institution’s dispute process. Continue checking until the issuer tells you the old number is no longer usable and any dispute is resolved. A replacement card does not automatically protect a separate bank account or another card that was not included in the incident.
Beware of “verification” scams
Fraudsters may pose as the issuer and ask for a one-time code, full password, or transfer to a “safe” account. Do not provide those details in response to an unsolicited call, text, or email. End the contact and call the issuer using a known number.
If your Social Security number was exposed
Review your credit reports
Obtain your credit reports and look for accounts, inquiries, addresses, or collection activity you do not recognize. Keep a copy of anything suspicious. A credit report review can reveal new-credit activity, but it does not show every form of identity misuse, so continue monitoring account statements and official correspondence.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose between a credit freeze and a fraud alert
| Protection | What it does | How to set it up | Duration and cost |
|---|---|---|---|
| Credit freeze | Restricts potential creditors from accessing your credit report, making it harder for an identity thief to open many new credit accounts. | Contact Equifax, Experian, and TransUnion separately. You must place the freeze with all three nationwide credit bureaus. | Free, does not affect your credit score, available to anyone for any reason, and remains until you lift it. |
| Fraud alert | Asks lenders to verify your identity before granting new credit. It does not block access to the report. | Place an initial alert with one nationwide bureau; that bureau must notify the other two. | Free. An initial alert has a limited term; check the FTC’s current instructions for the period in effect when you file. |
A freeze is the stronger barrier against many new-credit applications, but it can add a step when you legitimately apply for credit because you must temporarily lift it or provide the required access information. A fraud alert is less restrictive and may be simpler if you expect to apply for credit soon. Neither protection prevents every type of misuse, such as takeover of an existing account or tax-related fraud.
Watch for tax identity theft
Someone using your Social Security number may try to file a tax return or obtain employment under your identity. Pay attention to unexpected notices from the Internal Revenue Service and respond through the IRS’s known official contact methods. Do not give tax or payment information to a caller who threatens arrest or demands immediate payment; hang up and initiate contact yourself.
If other personal information was exposed
There is no single remedy for every data field. An exposed email address may mainly increase phishing attempts; medical information can require contact with a provider’s privacy or billing office; employment or government identifiers may call for a specialized agency report. Start with the exact list in the notice and use IdentityTheft.gov/DataBreach for a tailored sequence.
- Contact the organization responsible for the record and ask what protective steps it recommends for that data category.
- Change credentials if the information can be used to access an account, even when the notice does not explicitly say “password.”
- Watch related statements and portals for unfamiliar claims, profile changes, addresses, or beneficiaries.
- Limit further disclosure. Do not send a copy of an identity document or additional personal details to an unsolicited “breach support” contact.
What to do when you see signs of identity theft
Evidence can include an account you did not open, a bill for a service you never received, a credit inquiry you cannot explain, a tax letter about a return you did not file, or transactions you did not authorize. Act on the affected account first: contact the company or financial institution, ask it to secure or close the account, and follow its fraud or dispute procedure.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Report the identity theft at IdentityTheft.gov and complete the questions about what happened.
- Use the recovery plan generated for your situation, including its suggested letters and forms.
- Secure related accounts by changing credentials and enabling MFA where available.
- Review credit reports and challenge inaccurate information with the reporting bureau and the business that supplied it.
- Keep a dated log of calls, reports, documents sent, and promised follow-up.
The FTC report does not instantly undo every loss, but it organizes the recovery steps and creates documentation you can use when working with businesses and financial institutions.
How to recognize follow-up phishing after a breach
A real breach often creates a believable pretext for a second scam. Be skeptical of messages that use the incident’s name, claim your account will be closed today, or ask you to “verify” a Social Security number, password, card number, or one-time code. Unexpected links can lead to a counterfeit login page or install malware.
- Open the organization’s site by typing its address or using a bookmark you created earlier.
- Call the number on your card, statement, or prior correspondence, not a number supplied in the message.
- Check the account directly for alerts instead of replying to an email or text.
- Never transfer money to protect it and never disclose an MFA code to an unsolicited caller.
Common mistakes that leave a breach response incomplete
Changing only the password named in the notice
If that password was reused, every account sharing it remains exposed. Search your password manager or account list and update reused and closely related passwords.
Freezing credit instead of addressing card fraud
A credit freeze concerns access to a credit report. It does not replace calling a card issuer, replacing a card number, or disputing an unfamiliar charge.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Assuming monitoring proves you are safe
Monitoring may alert you to some credit or account activity, but it cannot prevent every takeover, payment-card misuse, tax scam, or phishing attempt. Keep the direct controls and reviews in place.
Using contact details supplied by an unexpected caller
Scammers exploit the urgency of a breach. Verify every contact route independently before sharing information or enrolling in a service.
A practical follow-up schedule
Today
- Save and verify the notice.
- Change exposed or reused passwords.
- Enable MFA and review account recovery settings.
- Call the card or bank issuer if payment data was involved.
Within the next few days
- Review credit reports if a Social Security number or other identity data was exposed.
- Place a freeze or fraud alert if appropriate.
- Check statements, pending transactions, and account notifications.
- Submit IdentityTheft.gov reports and preserve confirmation details if you find fraud.
Ongoing
- Watch for unfamiliar credit inquiries, accounts, bills, tax letters, and transactions.
- Keep the incident log and all correspondence.
- Revisit the organization’s instructions before any deadline for offered assistance.
- Continue treating breach-related messages as untrusted until you verify them independently.
When to seek additional help
Contact the relevant bank, card issuer, credit bureau, healthcare provider, employer, or government agency when the exposed information falls within its records or when you need to dispute activity. If losses are substantial, multiple accounts are affected, or a business refuses to correct documented identity theft, consider professional legal or consumer-protection assistance in your jurisdiction. The FTC’s recovery plan can help you organize the evidence needed for those conversations.
Frequently asked questions about exposed data
Does every data breach require a credit freeze?
No. A freeze is most directly relevant when a Social Security number or other information usable for new-credit applications was exposed. A stolen password or card number requires account and issuer action even if no credit file is involved.
What if the notice does not say exactly what was exposed?
Ask the organization through a verified channel, keep the notice, and use the FTC’s data-breach questionnaire. Do not guess that the most sensitive category was included, but do not ignore the notice while waiting for clarification.
Is a hardware security key required after a password breach?
No. It is an optional MFA method, and whether it works depends on the account provider. An authenticator app or another MFA option offered in the account’s settings may be sufficient.
Can a credit freeze stop all identity theft?
No. It mainly restricts access to a credit report for new-credit decisions. It does not stop account takeover, payment-card transactions, tax identity theft, or scams that trick you into sending information.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
