The short answer

A breach notice does not mean you have a lawsuit or a guaranteed payment. It tells you what the company says happened and may describe a remedy. Save the notice, identify the information involved, secure affected accounts, review your credit reports and statements, and follow any stated deadline.

The correct dispute route depends on what happened next:

• An unfamiliar credit account or inquiry belongs in the credit bureau's dispute process and with the business that reported it.
• An unauthorized card, bank, or payment-app transaction should be reported to the provider through its official channel.
• A promise of monitoring, reimbursement, points, or deletion is controlled by the written company program, settlement, or regulatory order.
• A government fine or settlement payment does not automatically become cash for every affected consumer.

The steps below are for U.S. consumers. State law, contract terms, payment method, and the specific settlement notice can change the available process.

What controls your next step?

A breach notice documents that the company reported an incident. It doesn't, by itself, show that someone used your identity, prove that a credit-report entry is fraudulent, or establish that you qualify for cash.

Steps to take after a data breach

1. Save the notice and build a timeline

Keep the letter, email, or account message as a PDF or paper copy. Record:

• When you received it
• The company named in the notice
• The types of information involved
• The incident dates or date range given
• Any monitoring, reimbursement, or account-protection offer
• The claim, enrollment, or request deadline
• The company's official phone number and website

Don't rely on a social media post or forwarded email for these details. If the notice is unclear, use the company's known website or a phone number on a recent account statement to make contact.

2. Secure affected accounts and reused passwords

Change the password for the affected account and every other account where you reused it. Use multifactor authentication when it's available. Check recent sign-ins, recovery email addresses, phone numbers, and connected applications.

If an email password, security answer, authentication code, or other email-account credential was exposed, secure email first. Control of that account can make it easier for someone to reset other passwords.

3. Consider a credit freeze

The Federal Trade Commission's guidance on credit freezes and fraud alerts says a credit freeze is free and can help stop identity theft. It remains in place until you ask the credit bureau to remove it.

To protect each of your three credit files, follow the instructions for Equifax, Experian, and TransUnion. The FTC page links to each bureau's process.

A freeze is mainly a way to limit new credit applications based on your credit file. It doesn't replace checking existing accounts, reports, or statements.

4. Compare a fraud alert with a freeze

A fraud alert is different from a freeze. It tells businesses that check your credit report to take additional steps to verify an application. The FTC explains how alerts work, how to renew them, and when an identity theft report or police report may be needed for a longer alert.

Choose the tool that fits the situation. If you suspect someone is already using your identity, review both the alert and freeze instructions instead of treating either one as a complete solution.

5. Review credit reports and account statements

Review all three credit reports and look for:

• Accounts or inquiries you don't recognize
• New addresses, phone numbers, or employers
• Incorrect balances or payment histories
• Collection accounts that aren't yours
• Changes to existing accounts

The FTC recommends checking your reports regularly. An account in your name that you don't recognize could be a sign of identity theft. Also review bank, credit card, debit card, and payment-app statements because not every fraudulent transaction appears on a credit report.

Real-world data breach dispute examples

Marriott and Starwood

The Starwood intrusion began before Marriott acquired Starwood and continued undetected for years. The FTC later finalized an order requiring Marriott and Starwood to create a comprehensive information security program after three breaches affecting more than 344 million customers worldwide. The FTC's finalized Marriott order describes the required security measures.

The FTC's October 2024 announcement also described a consumer-facing remedy: Marriott would review loyalty accounts when customers request it and restore stolen loyalty points when appropriate. Separately, Marriott agreed to pay $52 million to 49 states and the District of Columbia. A New Jersey attorney general summary provides more details about that multistate resolution.

The practical point is narrow. A regulatory order can require better security, and a company program can offer account review or point restoration. Neither result automatically creates a cash payment for every affected guest. Use the request process in the official notice.

Capital One

The FTC's consumer alert about the Capital One incident said that about 100 million people in the United States and 6 million in Canada were affected. The information could include credit application and account data, including credit scores, credit limits, balances, payment history, contact information, and some transaction data.

The response should match the information involved. For exposed credit application data, watch for unfamiliar inquiries or accounts. If bank or card information was involved, review statements and contact the provider through an official channel. Credit monitoring offered after a breach doesn't replace a credit freeze or an account dispute.

Equifax and other high-profile cases

Equifax is often discussed as if it produced one single legal result. A high-profile breach can instead lead to more than one settlement, enforcement action, or private proceeding, each with its own eligibility rules, remedy, and deadline.

Before relying on a large dollar figure in a headline, identify the specific court notice, agency announcement, or claims administrator connected to it. A payment described in one proceeding may not be available under another.

How to dispute suspected identity theft

Deal with the specific problem rather than sending the same complaint to every organization.

If an unfamiliar account appears on your credit report

1. Save the report or page showing the account or inquiry.
2. Contact the credit bureau that lists the information and follow its dispute instructions.
3. Contact the lender or company that reported the account through its official fraud department.
4. State that you don't recognize the account and ask which documents the company requires.
5. Keep copies of the dispute, attachments, delivery confirmation, and every response.

You may be asked for proof of identity, proof of address, account records, or an identity theft or police report. Send copies instead of irreplaceable originals, and provide only what the official process requires.

If you see an unauthorized card or bank transaction

Call the card issuer or bank using the number on your card, statement, or official app. Ask for a case number and written confirmation of the report.

Credit card, debit card, bank-transfer, and payment-app disputes can follow different procedures. A rule or deadline for one payment method may not apply to another. Change compromised credentials and monitor the account while the provider investigates.

If the company denies the dispute, request the reason and any documents it relied on. Keep the denial with the original statement and breach notice.

If loyalty points or another account benefit was stolen

Use the company's official account-recovery or settlement process. Ask the company to review the account history, restore eligible points or benefits, and confirm the decision in writing. A general breach announcement may not create the same remedy as a specific restoration or reimbursement program.

How to evaluate a settlement or compensation offer

Before filing a claim, check these details:

• Eligibility: Which customers, dates, products, or types of loss are covered?
• Deadline: When must the claim, enrollment, or request arrive?
• Proof: Are receipts, account records, identity-theft reports, or other documents required?
• Remedy: Is the offer cash, monitoring, reimbursement, account correction, points restoration, or deletion?
• Legal effect: Does accepting the remedy release claims or affect arbitration, exclusion, or court participation?

Verify the notice independently. Type the company's known website into your browser, or find the agency or court announcement directly. Don't pay an upfront fee to receive a settlement, and don't give a caller your password, full banking login, or one-time authentication code.

A company-paid monitoring service can be useful, but it doesn't establish that you have a compensable loss. A regulatory penalty is intended to resolve alleged violations or require corrective action; it isn't automatically distributed to individual consumers.

Litigation and arbitration: what consumers should know

An arbitration clause doesn't freeze your credit, correct an inaccurate report, or report an unauthorized transaction for you. Take those protective steps separately. If a settlement notice gives you a choice involving arbitration, exclusion, or an individual case, read the notice carefully and consider advice from a qualified consumer attorney or legal-aid service.

Escalating an unresolved breach dispute

Start with a written complaint to the company. Identify the account or claim number, describe what happened, state the correction or remedy you want, and attach only relevant documents.

If the response is inadequate:

1. Send a follow-up listing the points that remain unanswered.
2. Ask for the company's final position in writing.
3. Dispute inaccurate credit information with both the bureau and the business that furnished it.
4. Use the relevant state or federal regulator's complaint process for the business or product involved.
5. Consider your state attorney general's consumer-protection office.
6. Seek legal help if you have substantial documented losses or a notice imposes a significant deadline.

Keep a dated file with the breach notice, reports, statements, correspondence, call notes, claim forms, and delivery confirmations. That record is more useful than a general allegation that a company was hacked.

Frequently asked questions

Does a data breach automatically entitle me to money?

No. Payment depends on the specific settlement or company program, your eligibility, any proven loss, and the deadline. A breach alone doesn't guarantee compensation.

Should I freeze my credit or place a fraud alert?

They serve different purposes. A freeze limits access to your credit file for new credit decisions and stays in place until you request removal. A fraud alert asks businesses to take extra verification steps. Review the FTC's guidance and follow the bureau instructions that fit your situation.

Does a government fine go directly to affected consumers?

Not necessarily. Government settlements may require security improvements, consumer account reviews, or payments to states. Any individual remedy will be described separately in the official notice.

What should I do before joining a data breach settlement?

Confirm the official source, check eligibility and the deadline, gather the required proof, and read whether accepting payment affects other claims. After submitting a claim, keep monitoring your accounts and dispute suspicious activity through the appropriate provider.