What to Do After You Get a Data Breach Notice Letter

After you get a data breach notice letter, confirm it is genuine, note exactly what information was exposed, and take the protective steps that match that data, such as freezing your credit if your Social Security number was involved. Then keep the letter. It is not a settlement notice, but it often becomes useful evidence if a class action settlement follows.

What the letter actually is

Every US state has a data breach notification law. These laws generally require a business to notify people when certain personal information is accessed or acquired without authorization. The letter is the company meeting that legal duty. It typically explains what happened, roughly when, what kinds of data were involved, and what the company is offering, which is often a free period of credit monitoring.

It is different from a class action notice. A breach letter comes from the company. A settlement notice comes later, if a lawsuit is filed and settled, and is sent by a court-approved settlement administrator. Many breaches never lead to a settlement at all.

Step 1: Make sure the letter is real

Scammers know that breach letters make people anxious, and they imitate them. Before you call a number or visit a link in the letter:

• ✓Look up the company's official website on your own and check for a breach announcement or FAQ page.
• ✓Check whether the breach appears on your state attorney general's website, since many states publish the notices they receive.
• ✓Never give out a full Social Security number or bank login to someone who calls you about a breach.
• ✓Enroll in any offered monitoring through the website named in the letter, and compare it with the company's own site.

Step 2: Match your response to the data exposed

The most important line in the letter is the list of data types. Your next steps depend on it.

• ✓Social Security number: freeze your credit at all three bureaus. A freeze is free and is the strongest protection against new-account fraud.
• ✓Bank or card numbers: watch statements closely and ask your bank about a new card or account number.
• ✓Passwords or security questions: change them, starting with email and financial accounts, and turn on two-factor authentication.
• ✓Medical or insurance details: review the explanation-of-benefits statements from your insurer for services you never received.
• ✓Driver's license number: check your state motor vehicle agency's guidance on replacement.

Our guide to the first 48 hours after a data breach covers these steps in more detail, and how to freeze your credit walks through each bureau.

Step 3: Decide on the free monitoring

Many letters include an enrollment code for credit monitoring. Enrolling generally does not stop you from joining a later class action settlement, though you should read the terms of service for anything you sign up for. Note the enrollment deadline, because codes usually expire.

Step 4: Keep a record

If a settlement happens, it may pay for documented losses and time spent dealing with the breach. That is much easier to claim if you start a record now.

1. 1Save the letter or email, including the envelope or the date it arrived.
2. 2Keep receipts for anything you pay because of the breach, such as postage, notary fees or replacement documents.
3. 3Write down the date, the task and the time spent whenever you deal with fallout, like calling a bank or reviewing statements.
4. 4Save any fraud alerts, police reports or FTC identity theft reports if fraud occurs.

Step 5: Watch for a settlement

Lawsuits over large breaches often follow within weeks, but a settlement, if one comes, can take a year or more. The settlement notice may arrive by mail or email, or you might never get one if the administrator does not have your current address. That is why it helps to watch for it yourself.

You can check the open data breach settlements now. To catch future ones, add the companies that sent you breach letters to SettleScout, and it will alert you if a matching settlement opens and remind you before the deadline.