What to Do After a Data Breach: A Practical Recovery Plan

A data-breach notice can make your stomach drop, but panic is not a plan. The useful response is a sequence: verify what happened, contain access, protect your identity, watch for follow-on scams, and document what you do.

This guide is for everyday consumers. Credit freezes, fraud alerts, IdentityTheft.gov, and credit-report disputes are US-only steps. If you live elsewhere, use your country’s credit-reporting and identity-theft agencies instead. Do not send money or personal information to anyone who calls claiming to be an investigator helping with your breach.

TL;DR

First, confirm the notice through the organization’s official website or a phone number you find independently. Change the exposed password everywhere it was reused, sign out other sessions, turn on multifactor authentication, and update the email account that could reset other accounts. If a Social Security number or similar identity data was exposed, place free credit freezes with all three US credit bureaus; a freeze does not stop takeover of an existing account, so keep checking banks, cards, email, and phone accounts. If you find actual identity theft, go to IdentityTheft.gov for an FTC report and recovery plan, and contact affected companies through verified channels.

Table of contents

If you want to compare the role of a password manager in this plan, visit the password managers category. You can also use the neutral security quiz to decide which protection task to tackle next. No paid product is required to complete the urgent steps below.

Verify the notice before you act

A breach email may be genuine, misleading, or a phishing lure that uses a real company name. Do not click its links, open attachments, reply, or call a number printed in the message until you verify it. Instead, type the organization’s known web address yourself, use its official app, or find its contact page independently.

Look for a breach notice in the account’s message center, a public incident page, or a notice mailed to you. Check whether the notice names the affected system, the approximate data involved, and the company’s recommended actions. A vague message that demands an immediate login or payment deserves extra suspicion.

CISA warns that phishing commonly uses urgency, requests for personal or financial information, shortened links, and lookalike addresses. Perfect spelling is not proof of safety; modern scam messages can be polished. See CISA’s phishing guidance before interacting with a suspicious message.

Example: You receive a text saying a retailer breach requires you to “verify your Social Security number in 10 minutes.” You do not use its link. You open the retailer’s app, find no security notice, and call the number listed on the retailer’s official website. That pause may prevent a second, separate theft.

Keep the original notice, but save it without forwarding sensitive details. A screenshot or PDF can help you remember dates and promised services. Redact account numbers before sharing the notice with family or a support representative.

Identify what was exposed

The response depends on the data involved. A stolen password is urgent because it can unlock accounts now. A payment-card number calls for the issuer’s fraud process. A Social Security number can create longer-term new-account risk. A mailing address or phone number may make convincing impersonation easier, even if it cannot by itself open a new credit account.

Make a short list using the company’s notice:

Data named in the notice Immediate focus What it does not necessarily mean
Username and password Change the password and every reused copy; end sessions That the attacker can access every account automatically
Email address or phone number Expect targeted phishing; strengthen account recovery That every message from the company is fake
Payment-card information Contact the issuer, review transactions, replace the card if advised That your bank account or credit file was breached
Social Security number or identity data US-only: free freezes, credit reports, and identity-theft watch That fraud has already occurred
Health or sensitive personal records Follow the organization’s notice and watch for impersonation That you should post details publicly to seek help

Do not assume the most alarming possibility. Read the notice carefully and ask the organization’s verified support channel what information was actually involved. Avoid giving support agents extra data they did not request.

Lock down passwords and sign-ins

Start with the breached service, then work outward to every account that shared the same password or a similar one. Reusing a password lets an attacker try one stolen credential across email, shopping, banking, social media, and work accounts.

Use a new, unique password for each important account. A password manager can generate long random passwords and remember them so you do not have to create variations such as Summer2026! and Summer2026!2. The goal is separation: one compromised site should not provide a key to another.

Change the password for your primary email early. Email often controls password resets, so an attacker who enters it may reset other accounts even when those services were not part of the breach. Check the email account’s recovery addresses, phone numbers, forwarding rules, filters, and logged-in devices. Remove anything you do not recognize.

Then review the breached account’s security page:

  1. Change the password from a trusted device.
  2. Choose “sign out everywhere,” “end all sessions,” or the closest option.
  3. Remove unknown recovery methods and connected apps.
  4. Turn on multifactor authentication, preferably with an authenticator app or security key when the service supports it.
  5. Save backup codes somewhere safe, not in a public note or the same account you are protecting.
  6. Review recent login history and report activity you did not perform.

Multifactor authentication adds a second proof of identity. It helps even when a password is exposed, but it does not make a fake login page safe. Never enter a one-time code into a page reached from an unexpected message.

If you have dozens of reused passwords, do not wait for a perfect cleanup. Secure email, financial accounts, mobile-carrier access, cloud storage, and social accounts first. Then use the password manager’s audit or a written list to work through the rest. For a calmer sequence, see how to set up a password manager.

Secure email, phone, and devices

An attacker may target your recovery channels next. Contact your mobile carrier through its official app or website and ask how to add or strengthen an account PIN. If your phone suddenly loses service, your number behaves strangely, or you receive unexpected SIM-change notices, contact the carrier immediately from another phone if necessary.

Update the operating system, browser, apps, and security software on devices used for the affected accounts. Updates close known flaws and remove compatibility excuses for leaving old software in place. Use a screen lock and avoid saving sensitive recovery codes in an unprotected text file.

Review banking and payment notifications. Turn on alerts for logins, password changes, new payees, transfers, card-not-present purchases, and address changes where available. Alerts do not prevent every transaction, but they shorten the time between an event and your response.

If you clicked a suspicious link or installed an unexpected app, stop entering passwords on that device until you update and scan it. Change important passwords from a different trusted device if you think the first one may be compromised. Contact the relevant service using an independently verified number rather than the message that started the scare.

A VPN is optional privacy tooling, not breach recovery. It can protect some traffic on an untrusted network, but it does not change a stolen password, stop phishing, or make you anonymous. Do not let a VPN distract you from unique passwords, MFA, updates, and account alerts. Our guide to using a VPN at home explains the narrower job a VPN can do.

Protect your US credit and identity

The next steps apply to US consumers. If the breach included your Social Security number or other information that could support new-account fraud, consider a credit freeze at Equifax, Experian, and TransUnion. The FTC says freezes are free, do not affect your credit score, and remain until you lift them. You must place each freeze separately; one bureau does not automatically freeze the other two. Read FTC guidance on freezes and fraud alerts and use official bureau websites, not links in an unsolicited email.

A freeze blocks prospective creditors from accessing your file in many new-credit situations. It does not stop an attacker from taking over an existing bank, email, or card account. It also does not mean you can never apply for credit: temporarily lift it at the bureau a lender needs, then restore it when the application is complete.

A fraud alert is different. An initial alert is free and lasts one year; a business must take reasonable steps to verify you before opening new credit. You place it with one bureau, which must notify the other two. If you have documented identity theft through an FTC identity-theft report or police report, an extended alert can last seven years. Choose based on your situation, and do not pay a third party to place a free alert.

Order and review your credit reports through AnnualCreditReport.com, the official site identified by federal consumer guidance. Look for accounts, inquiries, addresses, and collection activity you do not recognize. Save a copy of each report and note the date reviewed.

Credit monitoring can be useful for alerts, especially if the breached organization offers it at no cost. It is not a substitute for a freeze, and it cannot undo fraud. Put free freezes first when the exposure warrants them; consider paid monitoring only after you understand what it adds and what it cannot do.

Situation Practical US step Important limit
SSN exposed, no known fraud Freeze all three credit reports; review reports and alerts A freeze does not secure existing accounts
You suspect new-account fraud Freeze reports and place an initial fraud alert; review reports You still need to contact the affected creditor
Identity theft confirmed Report at IdentityTheft.gov; consider an extended alert and disputes Keep evidence and follow each creditor’s process
Child under 16 affected Ask each bureau about a minor’s free freeze The adult process and documents may differ

A child’s information deserves care, not public exposure. Do not post the child’s name, birth date, or documents in a support group. For a minor under 16 in the US, the FTC notes that a parent or guardian can request a free credit freeze through the bureaus’ minor-specific process. Explain the situation in age-appropriate terms and respect the child’s privacy and the limits of the device or account involved.

Watch for scams and account takeover

Breach news creates a believable excuse for follow-up scams. A caller may claim to be from the breached company, your bank, the FTC, a credit bureau, or law enforcement. They may know your name and the company involved. That knowledge is not proof of identity.

Never transfer money to “protect” it, buy gift cards or cryptocurrency, share a one-time code, install remote-access software, or read a full password to an inbound caller. The CFPB warns that scammers impersonate agencies and financial institutions. Contact the organization through an official app, a known statement number, or a website address you type yourself. Read the CFPB identity-theft guidance for this and related recovery steps.

Watch for password-reset emails you did not request, new-device notices, changed profile details, missing phone service, unfamiliar payment methods, and small “test” charges. Treat each as a prompt to open the account directly and inspect it, not as a reason to click the notification.

Tell household members what kind of message to ignore without repeating the exposed information. A simple rule works: no one should act on an urgent security request until they independently open the company’s app or website.

If fraud already happened

A breach exposure is not the same as confirmed identity theft. If you see an unauthorized transaction or account, move quickly but stay organized.

First, contact the affected bank, card issuer, lender, or service through a verified channel. Ask for the fraud department, close or secure the account, replace compromised payment credentials, and ask what written dispute or affidavit it requires. Do not wait for a scammer’s promised “investigation.”

Second, report the theft at IdentityTheft.gov. The FTC’s recovery process can produce an Identity Theft Report and a personalized plan. CFPB guidance also recommends reporting to local police when appropriate. This is the right emergency path; it is not a reason to buy a protection package from an inbound salesperson.

Third, dispute fraudulent information with the credit-reporting companies and the companies that furnished it. The CFPB explains that an identity-theft report, proof of identity, and a letter identifying fraudulent information can support a request to block or remove identity-theft-related items. Keep copies and use trackable delivery when mailing documents.

Example: You find a phone account you never opened on a credit report. You save the report, call the carrier using its official site, ask for its fraud process, file at IdentityTheft.gov, freeze all three reports, and keep a dated log. You do not call the number in a suspicious “recovery” email offering to fix it for a fee.

If a debt collector contacts you about an account created through identity theft, tell it in writing that the debt is fraudulent and provide the requested documentation. Keep your tone factual. Save letters, confirmation numbers, screenshots, and dates in one folder.

Mistakes to avoid

Only changing the breached password. If you reused it, the attacker may try it elsewhere. Search for every account that shared it and replace each with a unique credential.

Clicking the “free monitoring” link in the notice. The offer may be real, but reach it through the organization’s independently verified breach page. Compare the enrollment deadline and what the service actually covers.

Assuming a credit freeze handles everything. It is aimed at new credit, not account takeover, payment fraud, phishing, malware, or social engineering. Secure existing accounts separately.

Paying for a freeze or fraud alert. In the US, the federal credit bureaus’ freezes and the FTC-described alerts are free. Avoid middlemen that create confusion or upsell you under pressure.

Using one “strong” password everywhere. Strength cannot compensate for reuse. Unique passwords are the protection that limits the blast radius.

Posting evidence publicly. Screenshots can contain account numbers, addresses, email headers, or recovery codes. Redact before sharing, and send sensitive documents only through a verified secure channel.

Treating a VPN as an identity shield. It does not stop phishing or make you anonymous. Keep the focus on account and device controls.

Monitoring only your credit score. A score can remain unchanged while an email, card, phone, or shopping account is being taken over. Review transactions, sessions, security settings, and reports.

Keep a simple recovery file

Make one private note or folder with the breach notice, the date you received it, the data named, accounts changed, freeze confirmation numbers, dispute copies, and contacts used. Do not store passwords or full recovery codes in the same plain-text file.

Set a calendar reminder to review the affected accounts again, check promised breach-service deadlines, and revisit credit reports. A reminder is not a prediction about how long risk lasts; it is a way to avoid forgetting the work after the news cycle ends.

Use the checklist below and stop when a step does not apply. The goal is controlled progress, not an anxious search for every possible disaster.

  • Verified the breach through an official channel.
  • Identified the specific data exposed.
  • Changed the breached password and every reused password.
  • Secured primary email and recovery methods.
  • Enabled MFA and ended unfamiliar sessions.
  • Updated devices and checked for suspicious apps.
  • US-only: froze all three credit reports when appropriate.
  • US-only: reviewed reports and considered a fraud alert.
  • Reported confirmed identity theft at IdentityTheft.gov.
  • Saved evidence and confirmation numbers.
  • Warned household members about follow-on phishing.

Frequently asked questions

What should I do first after a data breach?

Verify the notice using the organization’s official website or app. Then change the exposed password anywhere it was reused, secure your email and recovery methods, enable MFA, and inspect the affected account for unfamiliar activity.

Should I change my password after a data breach?

Yes. Change it on the breached service and every other account where you reused it. Make each replacement unique; a password manager can generate and store them without requiring you to memorize every one.

Should I freeze my credit after a data breach?

If your Social Security number or similar identity data was exposed, a free freeze at Equifax, Experian, and TransUnion is a strong US-only option. It helps with new-credit fraud, but you must still secure existing accounts.

Is a credit freeze better than credit monitoring?

They serve different purposes. A freeze can make it harder to open new credit in your name, while monitoring can alert you to changes. A freeze is free, so place it before paying for monitoring when a freeze fits your risk.

What if I see an account I did not open?

Contact the company’s fraud department through a verified channel, report the identity theft at IdentityTheft.gov, review your credit reports, and document every action. Ask the creditor what evidence it needs to investigate and remove the fraudulent account.

Can a VPN protect me after a data breach?

No. A VPN may encrypt some traffic on certain networks, but it does not repair an exposed account, stop phishing, or make you anonymous. Use it only as one optional privacy measure after handling passwords, MFA, devices, and credit protections.

What should I do if my child’s information was exposed?

Confirm what data was involved and avoid posting the child’s details publicly. In the US, ask the three credit bureaus about their free minor-freeze process for a child under 16. Respect the child’s privacy and the limits of the device or service involved.

How long should I monitor my accounts after a breach?

Follow the affected organization’s instructions and continue normal account and credit reviews. There is no universal end date because a stolen password, payment card, and Social Security number create different kinds of risk.

The next sensible step

You do not need to solve every security problem today. Finish the high-impact steps first: unique passwords, protected email, MFA, verified account alerts, and—when relevant in the US—free credit freezes and an IdentityTheft.gov report.

When you are ready to make the routine easier, return to the password managers category and take the security quiz without treating either as a recommendation for a specific paid product. For another practical privacy step, read how to remove your data from brokers. If you want a broader overview of warning signs, see identity theft warning signs. You can also learn more about the site at /about/.

Sources