Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Act promptly, but do not panic. Read the company’s notice to learn exactly what information was exposed, when the incident occurred, and which protective services are offered. Then use the Federal Trade Commission’s IdentityTheft.gov/databreach guidance to match your response to the data involved. Change exposed or reused passwords immediately, secure affected accounts, review financial activity, and consider a credit freeze or fraud alert if your Social Security number was involved.
The steps below reflect U.S. FTC consumer guidance. They are not a complete statement of breach-notification laws or deadlines in every state or country.
Start with the breach notice, not a guessed response
A breach notice does not automatically mean someone has stolen your identity. It means the company says information was exposed, accessed, or potentially accessed. Your first task is to determine what the notice actually says.
Check that the message is genuine
Criminals sometimes imitate breach notices to steal more information. If an email, text, or letter asks you to click an unexpected link, call a number, or provide a password, verify the incident independently. Visit the company’s website by typing an address you already know, use a statement or official app, or call a number from a prior bill or account record. Do not use contact details supplied only in a suspicious message.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Record the facts that determine your next steps
- Information involved: identify whether the notice names a password, email address, financial account, payment-card number, Social Security number, medical information, or another identifier.
- Relevant dates: note when the exposure occurred, when the company discovered it, and whether the notice says your information was confirmed involved or only potentially involved.
- Accounts affected: list the service, username, account number, and any other companies where the same credentials were used.
- Company recommendations: check whether it tells you to reset credentials, contact a bank, or enroll in free credit monitoring or identity-theft services.
- Enrollment deadlines: save the notice and any service code. Free services may be limited to a stated period.
The FTC’s plain-language starting point is: “First, take a deep breath. Then, visit identitytheft.gov/databreach.” The FTC video and guidance provide a data-specific action plan.
Match your response to the exposed information
Different data creates different risks. Follow the branch that applies instead of treating every breach as if it exposed your entire identity.
If a password or login was exposed
- Open the affected service through its known website or app and change the password immediately.
- Change that password anywhere else you reused it, including accounts with a similar variation. Attackers routinely try exposed credentials on other services.
- Use a long, unique password for each account. A password manager can generate and store unique credentials, but it is not required to complete the essential steps.
- Sign out other sessions or revoke active logins if the service offers that control. Remove unfamiliar devices, apps, browser sessions, or connected accounts.
- Turn on multifactor authentication (MFA). An authenticator app, text message, approved device, or a security key can provide the second factor when the account supports it. A hardware key is optional; no purchase is required to follow the FTC’s core guidance.
- Check the account’s recovery email address, phone number, backup codes, and forwarding rules. Replace anything you do not recognize.
For email and social-media accounts, also review sent messages, deleted mail, login history, and connected applications. The FTC’s account-hijacking guidance covers these checks at Email or social media hacked? Here’s what to do.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If bank, debit-card, or payment information was exposed
Contact the bank, card issuer, or payment service through an official channel. Ask whether the account or card should be replaced, whether online access or a PIN must be changed, and how to dispute unauthorized transactions. Review recent and future statements for unfamiliar charges, withdrawals, transfers, or new payees. A credit freeze does not stop fraudulent use of an existing card or bank account, so account-level monitoring remains necessary.
If your Social Security number was exposed
Obtain and review your credit reports for accounts, inquiries, addresses, or collection activity you do not recognize. Consider placing a credit freeze with each of the three nationwide credit bureaus, or placing an initial fraud alert through one bureau. Watch for tax-related warning signs such as an IRS notice about a return you did not file, a rejected return because one was already filed, or unfamiliar employment income. The FTC’s IdentityTheft.gov recovery guide explains steps for suspected tax and identity theft.
Credit freeze or fraud alert: which fits your situation?
Both tools are free and can be used together. They address new-credit fraud, not unauthorized activity on accounts you already have.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Feature | Credit freeze | Initial fraud alert |
|---|---|---|
| What it does | Restricts access to your credit report, making it harder to open a new account in your name. | Asks businesses to verify your identity before opening new credit. |
| Where you apply | Contact Equifax, Experian, and TransUnion separately. | Contact any one of the three bureaus; that bureau must notify the other two. |
| Cost | Free. | Free. |
| Duration | Lasts until you lift it. | Initial alert lasts one year. |
| Applying for credit | You must temporarily lift the freeze, or provide access to a lender, when a legitimate lender needs your report. | You can generally apply without lifting a freeze, but the lender should take extra steps to verify you. |
| Protection level | Stronger restriction on new-credit access, with more setup and maintenance. | Easier to place, but it does not block access to your report. |
The FTC states that a freeze “is something you can do anytime, for any reason.” Its current explanation of freezes is available at Get a credit freeze to stop identity thieves. For help deciding between the two tools, see Is a credit freeze or fraud alert right for you?
Free tools Windows power users keep installed
One-click scans. No signup required.
When a freeze is usually the better fit
Choose a freeze when your Social Security number or other identity data was exposed and you want the strongest barrier against new accounts. You will need to manage three separate bureau relationships and plan ahead before applying for a mortgage, loan, apartment, utility service, or other credit-based product.
When an alert may be more convenient
An alert may suit someone who wants a quick, one-year warning for lenders or expects to apply for credit soon. It is not a substitute for a freeze when you want new-credit access restricted.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use free breach services, but inspect their limits
If the company offers free credit monitoring or identity-theft insurance, enrolling can add useful alerts. Before signing up, read:
- which credit files, databases, or personal-information elements are monitored;
- what events trigger an alert and how alerts are delivered;
- how long the service lasts and whether enrollment must occur by a deadline;
- whether a human recovery specialist is available and what the service will do for you;
- insurance limits, deductibles, exclusions, reimbursement rules, and documentation requirements; and
- whether the offer is free for the entire term or converts to a paid subscription afterward.
FTC guidance encourages consumers to accept free monitoring offered after a breach and to ask questions before paying for a service. Monitoring can tell you that something changed; it cannot change a reused password, close a compromised bank account, or replace a freeze when a freeze is appropriate. The FTC’s identity-theft overview is at What To Know About Identity Theft.
Recommended Free Tools
Keep watching for signs of misuse
Set a calendar reminder to review statements, credit activity, and account alerts. Look for:
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- unfamiliar purchases, cash withdrawals, transfers, or new billers;
- credit inquiries, accounts, addresses, or collection notices you did not initiate;
- password-reset messages or MFA prompts you did not request;
- letters from a lender, employer, insurer, or government agency about an activity you do not recognize; and
- tax correspondence suggesting that someone used your identity to file or work.
Do not wait for a monitoring alert if something looks wrong. Contact the institution through its official fraud department, preserve statements and messages, and ask what evidence or affidavit it needs.
If someone is already using your information
- Contain the affected account. Ask the bank, card issuer, lender, or service provider to close, freeze, or secure the account. Request replacement account numbers, cards, or credentials when appropriate.
- Change access credentials. Reset passwords and PINs, remove unauthorized recovery methods, sign out other sessions, and enable MFA.
- Document every contact. Record dates, names or ticket numbers, disputed transactions, promised actions, and copies of letters or screenshots.
- Review credit reports again. Identify every fraudulent account or inquiry and follow each bureau’s dispute process. Ask the creditor what documentation it needs to block or close the account.
- Report the identity theft. File a report at IdentityTheft.gov. The FTC can generate an individualized recovery plan and explain follow-up steps.
- Follow tax-specific instructions. If the problem involves a tax return, wage report, or IRS notice, follow the IRS response instructions in that correspondence while continuing the broader recovery process.
Identity theft recovery can involve several institutions, so keep one secure timeline and copies of all documents. The FTC’s recovery material explains how to organize those steps and communicate with businesses.
A practical order of operations
Use this checklist when you need a concise sequence:
- Verify the notice independently.
- Write down the exposed data, incident dates, affected accounts, and enrollment deadline.
- Change the exposed password and every reused version; sign out other sessions and enable MFA.
- Contact banks or card issuers if payment information was involved and inspect transactions.
- If a Social Security number was involved, review credit reports and choose a freeze, fraud alert, or both.
- Enroll in any free monitoring offered after checking its duration, coverage, and insurance terms.
- Set reminders for statements, credit activity, account alerts, and tax correspondence.
- If misuse appears, secure the account, document the case, dispute fraudulent activity, and report it at IdentityTheft.gov.
These actions address the main risks without assuming that every breach has already become identity theft. Keep the company notice and your records so you can respond quickly if new information appears.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
