Your Data Was in a Breach: What to Do in the First 48 Hours

Breach notification letters are written by lawyers and read like it. They tell you your information "may have been involved" and offer a year of credit monitoring. What they don't do is tell you plainly which actions actually reduce your risk. Here's that list, in the order worth doing it.

First, find out what was actually exposed

The right response depends entirely on the data type, and the notice usually specifies it somewhere. Roughly in order of severity:

• ✓Social Security or national ID number — the serious one. This enables new-account fraud, which is the hardest kind to unwind. Freeze your credit.
• ✓Financial account or card numbers — serious but more contained. Cards can be reissued and fraudulent charges reversed.
• ✓Medical or health information — can't be reissued and is valuable for insurance fraud. Watch your explanation-of-benefits statements.
• ✓Login credentials — dangerous mainly through reuse. If that password exists anywhere else, change it everywhere.
• ✓Name, address, email, phone — lowest direct risk, but this is the raw material for convincing phishing, which is how most follow-on fraud actually starts.

The 48-hour checklist

1. 1Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion each require a separate freeze. It's free, it's the single most effective step against new-account fraud, and you can lift it temporarily whenever you need to apply for credit.
2. 2Change the password — and everywhere you reused it. Credential stuffing is automated: attackers take one leaked pair and try it across hundreds of sites. Reuse is the actual vulnerability.
3. 3Turn on two-factor authentication on email and banking first. Your email account is the reset path to everything else, so it's the highest-value thing to protect.
4. 4Check your accounts for activity you don't recognise — and don't only look for large charges. Test transactions are often tiny.
5. 5Keep the breach notice. This is the step people skip, and it matters later. See below.

What a freeze does and doesn't do

Worth being precise, because people over-trust it:

• ✓It does stop most lenders pulling your credit file, which blocks new credit accounts opened in your name.
• ✓It doesn't affect your existing accounts, or stop fraud on cards you already hold.
• ✓It doesn't stop tax fraud, medical identity fraud, or someone using your details for employment.
• ✓It doesn't hurt your credit score. Freezing and unfreezing are free and unlimited.

Watch for the phishing that follows

Breaches are followed by a wave of targeted phishing, because attackers now know which company you had a relationship with. The messages that work are the ones that reference the breach itself — offering compensation, monitoring, or urgent "account security" steps.

The rule that defeats nearly all of it: never act through a link in a message about a breach. Go to the company or the official site by typing the address yourself. This applies equally to messages about settlements, which is a well-worn scam pattern — see how to spot fake claim sites.

The step that pays you back later

Large breaches frequently end in a class action settlement, and those settlements often reimburse documented out-of-pocket losses and time spent dealing with the fallout — sometimes at a stated hourly rate — on top of any flat payment to the class. But that's typically one to three years later, and by then almost nobody can produce evidence.

So while it's fresh, start a folder and keep:

• ✓The breach notification letter or email itself, with its date
• ✓A note of hours you spent on freezes, calls, and disputes
• ✓Receipts for anything you paid — credit report fees, monitoring, notary or postage costs
• ✓Records of any actual fraud: the fraudulent charge, the dispute, the resolution

If you'd rather not track that yourself, SettleScout monitors active data breach settlements and reminds you before deadlines close. You can also read what these settlements realistically pay in our guide to data breach settlement payouts.