What to do after a data breach
Find out what was exposed, then act on that. Change a leaked password everywhere you used it and turn on two-factor login. If your Social Security number leaked, freeze your credit at all three bureaus. If card or bank details leaked, ask for new ones. Then expect phishing that mentions the breach.
View all 13,115 breaches- Last updated
Start with what was exposed
Every breach notice and every entry on Have I Been Pwned lists the kinds of data that leaked: email addresses, passwords, phone numbers, dates of birth, government IDs. That list decides what you need to do. A leaked email address alone mostly means more phishing. A leaked Social Security number means someone could open credit in your name, and that needs a credit freeze.
If the company emailed you, read the notice itself rather than a news story about it. It usually says what was taken, when, and whether the company offers free credit monitoring. If it does, the FTC recommends taking it.
Why the order matters
Criminals use breach data in a predictable order. Passwords get tried on other sites within days, because so many people reuse them. Emails and phone numbers feed phishing and text scams that quote real details from the breach to look convincing. Identity data like a Social Security number or date of birth can be used months or years later to open loans, cards or phone contracts, or to file a fake tax return.
So lock down accounts first, then protect your credit, then stay alert for a while.
What a credit freeze and a fraud alert do
A credit freeze stops lenders from seeing your credit report, which blocks most new accounts in your name. According to the FTC, it's free, lasts until you lift it, and you place it separately at Equifax, Experian and TransUnion. When you need to apply for credit yourself, you lift it at the bureau the lender uses and freeze again afterwards.
A fraud alert is lighter: lenders can still see your report but have to verify your identity first. An initial alert is free, lasts one year, and you only contact one bureau, which tells the other two.
Breaches that need extra steps
Health data is worth extra attention. If a medical provider or insurer was breached, read the explanation of benefits statements your insurer sends and question any treatment you didn't get. If a child's details leaked, you can freeze a child's credit at the three bureaus as well, which stops anyone opening accounts in their name before they're old enough to notice.
What you can't undo
A breach can't be reversed. Once data has leaked, copies can circulate for years, and nobody can delete them from criminal forums or dump files. What you can do is make the data less useful: new passwords, frozen credit, replaced cards, and watching for misuse. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak, so you know when to repeat these steps.
What to do if you were in it
- 1
Change the leaked password, and every reuse of it
Change it on the breached site first, then on every other account where you used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where you can. It stops most account takeovers even when a password is already out there.
- 3
Freeze your credit if identity data leaked
If your Social Security number, date of birth or a government ID was exposed, place a free credit freeze at Equifax, Experian and TransUnion. Then check your reports at annualcreditreport.com for accounts you don't recognize.
- 4
Replace exposed cards and bank details
Ask your bank or card issuer for a new card number, and watch statements for charges you don't recognize. If a bank account number leaked, ask the bank whether to open a new account.
- 5
Treat breach-related messages as suspect
Expect emails, texts and calls that mention the breach or offer help with it. Don't click links in them; go to the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 6
File taxes early and check your earnings record
If your Social Security number leaked, filing early makes a fake return harder. Check your work history in your my Social Security account.
- 7
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan. To find out which other breaches include your email or phone, run a free Serus scan.
Frequently asked
How do I know if I was in a data breach?
Companies usually notify affected customers by email or letter. You can also look up your email on Have I Been Pwned, or run a free Serus scan, which checks breach databases for your email, phone and other details.
Should I freeze my credit after every breach?
Only when identity data leaked, such as a Social Security number, date of birth or a government ID. A freeze is free and easy to lift, so many people keep one on permanently.
Can leaked data be removed from the internet?
No. Breach data spreads on criminal forums and in dump files that nobody can take down. You protect yourself by making the data useless: new passwords, a credit freeze and new card numbers.
Is the free credit monitoring a company offers worth taking?
Yes, the FTC recommends taking it. It alerts you to new credit activity, but it doesn't stop it, so pair it with a credit freeze if identity data leaked.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
