What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Did you get a notice that says your personal information was exposed in a data breach? Start by finding out exactly which data was involved, then follow the response for that data type. The Federal Trade Commission (FTC) sends consumers to IdentityTheft.gov/databreach for a tailored checklist and says to use free services the affected company offers.
The FTC’s calm first step is: “First, take a deep breath. Then, visit identitytheft.gov/databreach.” A breach notice does not automatically mean you need paid monitoring, a new device, or the same response as every other victim. Passwords, Social Security numbers, payment-card details and other exposed information create different risks.
1. Read the breach notice before changing anything
Save the email or letter, and note the incident date, the organization involved, the categories of information exposed, and the deadline for any offered service. Breach notices commonly distinguish among email addresses, passwords, security-question answers, Social Security numbers, bank details, payment-card numbers, medical information and identity documents. The distinction determines your next action.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use the contact details in the notice only after checking that they are genuine. Instead of clicking an unexpected link, type the organization’s known web address yourself or call a number printed on an account statement or official card. Keep a copy of the notice and any confirmation numbers in case you need to prove when you acted.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Then open the FTC’s breach-specific guide at IdentityTheft.gov/databreach. The FTC’s October 2024 consumer guidance also explains how to respond to exposed passwords, Social Security numbers, payment information and phishing attempts: Have you been affected by a data breach? Read on.
Quick match: exposed data and first response
| Information named in the notice | Immediate priority | Continue doing |
|---|---|---|
| Username, password or security questions | Change the affected password and every reused copy; replace exposed security-question answers. | Turn on multifactor authentication (MFA) and watch for takeover attempts. |
| Social Security number | Review free credit reports and consider a credit freeze with all three nationwide credit bureaus. | Use any free monitoring offered by the breached company and check for unfamiliar accounts. |
| Payment-card number or related data | Contact the card issuer and ask whether a new card number is appropriate. | Review transactions and report unauthorized charges quickly. |
| Email address, phone number or other contact data | Expect targeted phishing and impersonation messages. | Verify requests through a trusted channel and avoid unexpected links or attachments. |
| Other personal, medical or identity information | Follow the specific instructions in the notice and the FTC’s breach checklist. | Take advantage of any free assistance the organization provides. |
2. Secure accounts when credentials were exposed
Change the breached password and every reused password
Sign in through the organization’s normal app or a web address you enter yourself. Set a new, unique password that you have not used anywhere else. If you reused the exposed password on email, banking, shopping, social-media or work accounts, change each of those accounts too. Attackers routinely test a stolen password against other services.
Use a password manager to create and store different passwords, or create long passphrases that are unique to each service. Do not send a password to anyone who contacts you claiming to be the breached company.
Replace exposed security questions
If the notice says security questions or their answers were included, change the answers wherever you used them. Do not substitute facts that can be found on social media, such as a pet’s name or birthplace. Where a service allows it, use a random answer stored in your password manager.
Turn on multifactor authentication
MFA requires an additional proof after the password, such as an authenticator-app code, a text message, a biometric check or a physical security key. Enable it in the account’s Security, Login or Account settings and save the recovery codes offline. The FTC describes security keys as one possible second factor, not a required purchase; app-based and other MFA methods may be available. See Email or social media hacked? Here’s what to do for the FTC’s examples.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Protect yourself when a Social Security number was exposed
Review your credit reports
Order and review your free credit reports for accounts, inquiries, addresses or collection activity you do not recognize. Look for newly opened credit, altered contact information and unfamiliar lenders, not just missed payments. Record the creditor’s name and the date of every item you question. The FTC’s recovery guide covers this review after Social Security number exposure: IdentityTheft.gov: A Recovery Guide.
Consider a credit freeze
A credit freeze is free, available to anyone, does not change your credit score and remains until you lift it. It restricts access to the credit report lenders generally use when deciding whether to open new credit. You must place the freeze separately with Equifax, Experian and TransUnion. When you later apply for credit, temporarily lift the freeze for the bureau the lender uses, then reinstate it afterward. The FTC’s January 2025 explanation is at Freezing? Maybe freeze your credit, too.
A freeze does not stop activity on accounts you already have. Continue checking existing bank, loan and card accounts for unauthorized transactions.
Understand a fraud alert
A fraud alert is different from a freeze. It asks lenders to verify your identity before granting new credit; it does not block access to your credit file in the same way. The FTC explains the basic functions and placement process for both measures at Credit Freezes and Fraud Alerts.
| Feature | Credit freeze | Fraud alert |
|---|---|---|
| What it does | Restricts access to your credit report for new-credit decisions. | Asks lenders to verify your identity before issuing new credit. |
| Who can use it | Anyone. | Eligibility depends on the applicable alert type and circumstances. |
| Cost | Free. | Free. |
| Duration | Stays until you lift it. | Duration depends on the alert type; check current FTC instructions. |
| What you must do before applying for credit | Temporarily lift the freeze for the relevant bureau. | Tell the lender about the alert and complete its identity checks. |
| Does it protect existing accounts? | No; monitor those accounts separately. | No; monitor those accounts separately. |
Use free monitoring offered after the breach
If the organization offers credit monitoring or identity-theft insurance at no cost, enroll through a verified channel and note the enrollment deadline and coverage period. Monitoring can alert you to changes, but it does not replace reviewing reports or deciding whether to freeze your files. Paid monitoring is optional; FTC guidance notes that many services charge recurring fees, so check what is monitored, how long the offer lasts, the renewal price and cancellation terms before paying.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Respond when payment-card information was exposed
Contact the issuer
Call the number on the back of your card or use the issuer’s official app. Tell the representative that your card data was included in a breach and ask whether the account should receive a replacement card or new number. The FTC gives this advice for card breaches in Breaches at Lord & Taylor, Saks, & MyFitnessPal.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAsk whether your recurring payments will continue, whether your digital wallet token needs updating and how to dispute an unauthorized transaction. Do not provide a one-time passcode or full account credentials to an unsolicited caller.
Watch transactions after replacement
Review checking, savings and card activity frequently. Enable transaction alerts for purchases, withdrawals and transfers. Report charges you did not authorize through the issuer’s official channel and keep the case number, date and supporting documents. Replacing a card reduces future use of the exposed number but does not eliminate risk from activity that already occurred.
5. Prepare for phishing and impersonation
A breach can give criminals enough context to make convincing follow-up messages. Be skeptical of requests to “verify” an account, claim a refund, pay a fee, install remote-access software or read a security code aloud. Unexpected urgency, threats of closure and unfamiliar payment methods are warning signs.
- Do not click links or open attachments in an unexpected breach-related message.
- Navigate to the organization’s known app or type its established web address manually.
- Call a trusted number from a statement, card or previously saved contact.
- Check the sender’s address and the destination domain, but do not treat either as proof of legitimacy.
- Report the message through your email provider or the impersonated organization, then delete it.
The FTC’s breach guidance emphasizes using a trusted route rather than links in unexpected messages. If you already clicked, change the relevant password from a clean device, enable MFA, update security software and contact the organization through a verified channel.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Use the company’s assistance without overbuying
Read the notice for free monitoring, an identity-restoration service, a replacement card process, a dedicated telephone line or reimbursement instructions. Confirm that enrollment is on the company’s real site and note expiration dates. These free services can be worthwhile, but they do not make a freeze, password change or transaction review unnecessary.
You do not need to buy a hardware security key, paid monitoring subscription or identity-protection package merely because your data appeared in a breach. A security key is an optional MFA method for accounts that support it. If you compare a paid service, check four items before entering payment details:
- Which data and accounts it actually monitors.
- How long the introductory or breach-sponsored period lasts.
- The recurring price after that period.
- How to cancel and whether identity-theft insurance has exclusions or claim deadlines.
7. Act quickly if you find actual identity theft
Exposure and confirmed misuse are different situations. If a credit report shows an account you did not open, an unfamiliar withdrawal appears, or someone is using your identity, document each event and report it at IdentityTheft.gov. The FTC’s recovery plan provides individualized steps for contacting businesses, disputing fraudulent accounts and replacing compromised credentials.
Keep a dated incident log with copies of notices, reports, emails, bills and case numbers. Contact the affected bank, card issuer or lender through its official fraud department. Follow its documentation requirements and keep proof of delivery for disputes. If your device or email account was taken over, secure that account first because it may be used to reset other passwords.
8. A practical first-day checklist
- Save the breach notice and write down every data category it names.
- Verify the organization’s contact details independently.
- Open IdentityTheft.gov/databreach and follow the checklist for the exposed data.
- Change the affected password, all reused passwords and exposed security-question answers.
- Enable MFA and store recovery codes safely.
- If a Social Security number was exposed, review free credit reports and decide whether to freeze all three files.
- If card data was exposed, call the issuer about a replacement number and turn on transaction alerts.
- Enroll in any verified free monitoring or recovery service before its deadline.
- Ignore unexpected follow-up links and verify every request through a trusted route.
- Report confirmed identity theft through IdentityTheft.gov and retain your documentation.
9. What a breach response cannot guarantee
No single measure reverses every consequence of exposure. A password change does not remove copies of a stolen password from criminal databases. A credit freeze addresses new-credit access, not purchases on existing accounts. Monitoring can identify some changes after they occur, but it cannot guarantee detection of every misuse. Your response should therefore combine the measure that matches the exposed data with continued account and credit-file review.
This guidance is for U.S. consumers and reflects FTC consumer resources. Procedures, eligibility and legal remedies can differ in other countries or for specialized data such as medical records. For an active identity-theft case, use the individualized instructions at IdentityTheft.gov rather than relying on a general checklist.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
