Your Personal Data Has Been Exposed — Here's Exactly What to Do.

You just got the notification: your data was part of a breach. Maybe it's your email and password. Maybe it's your Social Security number or credit card. The first instinct is panic. The better instinct is a systematic response.

Step 1: Assess What Was Exposed

Not all breaches are equal. An email-only leak is annoying but manageable. A breach that includes passwords requires immediate action. A breach involving financial data or government IDs demands a comprehensive response including credit freezes and identity monitoring.

Step 2: Contain the Damage

Change passwords for the breached service immediately. If you reused that password anywhere else (be honest), change those too. Enable two-factor authentication on every account that supports it. If financial data was exposed, contact your bank and place a fraud alert with the credit bureaus.

After the immediate response

Once the immediate panic of a breach passes, the next 30 days matter more than the first hour. Set up daily monitoring on your primary email through Have I Been Pwned notifications, and enroll in any free credit monitoring offered by the breached company. These services usually upgrade to paid tiers after a year, so calendar a reminder to cancel before that conversion. The watchful posture in the first month after a breach is what catches the secondary attacks that follow the initial dump.

A credit freeze is free, takes about fifteen minutes per bureau, and is the single most powerful tool you have to stop identity theft cold. Freeze all four major bureaus, including Equifax, Experian, TransUnion, and the often forgotten Innovis. You can thaw temporarily for any legitimate credit application using a PIN. Anyone trying to open a new line in your name will be stopped at the credit check stage, even if they have your full social and date of birth in hand.

Phishing follow-up is the most common downstream consequence of a data breach. Attackers buy the leaked dataset, then craft messages that reference real services and real account numbers you used. The message looks convincing precisely because it is built on accurate stolen data. Slow down before clicking anything in the first 90 days after a breach. Type the company URL manually, or use a bookmark. The slight friction shuts down most of these targeted phishing waves at no cost to you.

SIM swap risk rises sharply after a breach that included phone numbers. Call your mobile carrier and add a port out PIN, a number transfer lock, or whatever the equivalent feature is called on your plan. T-Mobile, Verizon, and AT&T all support this now, but it is opt-in. Without that lock, an attacker armed with your stolen personal data can convince a support representative to port your number to their device and intercept every SMS based 2FA code you receive.

Document everything. Keep a simple log of which accounts you changed, which credit bureaus you froze, and which monitoring services you signed up for. If identity theft does materialize a year from now, that paper trail is what insurance underwriters and law enforcement will ask for first. The boring administrative work after a breach is what determines whether the next twelve months are stressful or completely manageable, regardless of how bad the original incident was.

Freezing your credit is the single best move

If your Social Security number, date of birth, or driver's license number was in the breach, place a security freeze with all three US credit bureaus the same day. Equifax, Experian, and TransUnion are required by federal law since 2018 to offer freezes free of charge, online, in under ten minutes per bureau. A freeze blocks new credit accounts from being opened in your name even if a criminal has every piece of your personal data. It is the closest thing to a real lock that exists in the consumer credit system.

Outside the US, the equivalent steps vary but exist. In the UK, register a CIFAS Protective Registration for around 30 GBP, which flags your file to lenders for two years. In Canada, contact Equifax Canada and TransUnion Canada to add a fraud alert and a security freeze. In Australia, request a ban under the Privacy Act through Equifax, Experian, and Illion. Write down your freeze PINs in a password manager, because thawing the freeze to apply for legitimate credit later requires them.

Lock down the accounts that control everything else

The accounts that matter most after a breach are not your bank login, they are your primary email and your phone carrier. Email controls every other password reset. Your carrier controls your SMS, which is still the recovery channel for too many services. Sign into Gmail or Outlook, force a sign-out from all devices, rotate the password, and enable a passkey or hardware key as the primary factor. Then call your carrier, AT&T, Verizon, T-Mobile, EE, whoever, and set a port-out PIN or account passcode. Without that, a SIM-swap attack is trivial.

While you are in your email, search for every message containing the phrase 'welcome to' or 'verify your account' from the last five years. That is your real account inventory, far more accurate than memory or any password manager. For each account you forgot existed, either close it or rotate the password and add 2FA. Most identity fraud after a breach happens on dormant accounts the victim no longer monitors.

Monitor the right signals, ignore the noise

Free credit monitoring offered by the breached company is fine, but it is not the only signal you should watch. Sign up for AnnualCreditReport.com to pull all three bureau reports for free every week, a permanent expansion of the COVID-era rule. Set Google Alerts for your full name, email, and phone number. Enable transaction notifications on every credit card and checking account, with a threshold of one dollar or the local equivalent, so any test charge surfaces immediately.

Have I Been Pwned remains the canonical breach database, and you can enable its notification feature with your email so future exposures hit your inbox automatically. For deeper monitoring, services like Bitdefender Digital Identity Protection or Aura scan dark-web forums for your data and notify you when it appears in a new dump. Treat those alerts as early warnings, not emergencies, and verify with your own actions before paying for anything labeled 'identity restoration'.

Handle the IRS and tax fraud preemptively

Tax-refund fraud is one of the fastest payouts for criminals holding your SSN, and it spikes every January through April. Request an Identity Protection PIN from the IRS at irs.gov/ippin. It is a six-digit number unique to your tax return each year, and without it nobody, including you, can file electronically under your SSN. Setup takes about fifteen minutes and requires verifying your identity through ID.me. Once you have one, you must use it every year forward.

If you live outside the US, look up the equivalent. HMRC in the UK uses a separate Government Gateway ID. The Canada Revenue Agency offers a similar PIN system tied to your My Account login. France's impots.gouv.fr lets you set additional 2FA on your tax profile. None of these are perfect, but each one closes a door criminals are actively probing in the months after major breaches.

What about the data broker problem

Even if the original breach was at a single company, your data has likely already been aggregated and resold by data brokers like Spokeo, Whitepages, BeenVerified, and Radaris. Each one is required under California's Delete Act and similar laws in Texas, Vermont, and Oregon to honor deletion requests, but the process is exhausting if you do it manually. Services like DeleteMe, Optery, Kanary, and Privacy Bee will file the requests on your behalf for somewhere between 100 and 200 USD a year.

If you would rather not pay, Yael Grauer's open-source Big Ass Data Broker Opt-Out List is the most maintained resource and walks you through removals at over 200 sites. Block off a Saturday morning, work through the top twenty brokers, and then set a calendar reminder to repeat the sweep every six months. Brokers re-acquire data constantly, so opting out is a recurring chore, not a one-time fix.

Document everything for the long tail

Identity-fraud cases often surface months or years after the breach. Open a dedicated folder, paper or digital, and save the breach notification letter, your FTC IdentityTheft.gov report number, every police report, and screenshots of every fraudulent charge or account. When a debt collector calls about a credit card you never opened in 2028, you will need this paper trail. Having it ready cuts a typical dispute from weeks to a single phone call.

File the IdentityTheft.gov report even if no fraud has happened yet, because it generates a free FTC Identity Theft Affidavit that banks and creditors are legally required to accept. That single document removes most of the friction from disputing fraudulent accounts later. It is the cheapest insurance policy in this entire process, and almost nobody bothers to file it preemptively.