The short answer
Change the password for the breached account and anywhere you reused it, turn on two-factor authentication, and if your Social Security number or financial details were exposed, freeze your credit at all three bureaus. Then watch for scam messages that mention the breach.
A breach notice can feel like a fire alarm with no fire in sight. You don’t know who has your information or what they’ll do with it. The good news: a few steps, done in the right order, close most of the doors a criminal would try.
First, work out what was exposed
Read the company’s notice carefully. What you do next depends on what leaked:
| What was exposed | How serious | What matters most |
|---|---|---|
| Email address only | Low | Expect more phishing emails |
| Email and password | High | Change passwords now |
| Card number | Medium | Card issuer can replace it |
| Social Security number | Very high | Freeze your credit |
Today: lock down your accounts
- Change the password on the breached account. Make it long and unique.
- Change it anywhere else you used the same password. Criminals routinely try leaked passwords on other sites.
- Turn on two-factor authentication, starting with email, banking and shopping accounts. Even with your password, a thief then can’t log in without the second step. Our guide on setting up two-factor authentication walks you through it.
A password manager makes unique passwords painless: it creates and remembers them for you.
This week: protect your credit
If your Social Security number or financial details were in the breach:
- Freeze your credit with all three bureaus: Equifax, Experian and TransUnion. A freeze stops new accounts being opened in your name. It’s free, and you can lift it when you need to apply for credit.
- Check your credit reports for accounts you don’t recognize at AnnualCreditReport.com, the official free source.
- Accept free credit monitoring if the company offers it, but treat it as an extra, not a replacement for a freeze.
From now on: expect follow-up scams
Breaches are often followed by messages that mention the breach, offer “help,” or ask you to “verify your identity.” Don’t click links in those messages. Go directly to the company’s website or app instead.
If someone has already used your information
Go to IdentityTheft.gov, the FTC’s official site. It builds a personal recovery plan and helps you report the theft.
Related guides
Turn on two-factor authentication for your most important accounts. If your email account was taken over, follow what to do if your email is hacked.
The bottom line
Change reused passwords, turn on two-factor authentication, and freeze your credit if sensitive data leaked. Those three steps stop most of the damage a breach can do.
Frequently asked questions
Should I freeze my credit after every data breach?
It matters most when your Social Security number or financial details were exposed. A freeze is free and stops new accounts being opened in your name, so many people choose to keep one in place permanently.
Is free credit monitoring enough?
Monitoring tells you about problems after they happen. A credit freeze helps prevent them. If it's offered for free, monitoring is a useful extra, but not a replacement.
Will scammers contact me after a breach?
Often, yes. Expect emails, texts or calls that mention the breach or offer help. Don't use their links or numbers; contact the company directly instead.
Why you can trust this guide
- Based on official sources. The steps here are checked against the 4 official sources listed below, such as the help pages of the companies involved.
- Checked and dated. Last checked on November 7, 2026. We update guides when software or advice changes.
- Independent. No company paid for or reviewed this guide. We don't sell products, and ads never influence our advice.
- Open to corrections. Spotted an error? Tell us and we'll fix it. Read how we research.
Sources
- FTC — IdentityTheft.gov
- U.S. PIRG — Worried about a data breach or identity theft? Here's what to do now, soon and always
- AnnualCreditReport.com — free credit reports
- FTC — Use two-factor authentication to protect your accounts
This guide is general information. Menus and features can change with software updates, and steps may differ on your device or version. Back up important data before making big changes. Read our disclaimer.
