A business data breach: what should you do first?

If a company says your personal information was exposed, take action before the investigation is over. Verify the notice through a trusted channel, secure affected accounts, contact your bank or card issuer if financial data may be involved, and keep the notice and later updates.

The right response depends on the data. An exposed email address mainly increases phishing and account-takeover risk. A Social Security number may justify a credit freeze. A company's deadline for sending notice isn't a deadline for you to protect yourself.

What to do in the first day

Check that the notice is genuine

Scammers sometimes use a real breach as a reason to send fake messages. Don't click the link or call the number in an unexpected email or text. Instead:

Keep the original notice, envelope, email headers, attachments, and instructions. The wording may help you work out what information was involved and when the company learned of the incident.

Lock down exposed or reused passwords

Change the affected password from a trusted device. If you used it on other sites, change those passwords too. Start with your email account if it can be used to reset other accounts.

Use a different password for each account and turn on multifactor authentication. Then review active sessions, recovery email addresses, phone numbers, and security questions. Sign out of devices you don't recognize.

A representative should not need your password or a one-time authentication code. Don't give either to a caller who contacts you after the breach.

Call the bank or card issuer when money information is involved

Use the number on your card or statement, not a number in the breach message. Ask the issuer whether you should:

If bank-account details may have been exposed, contact the bank promptly and ask what account-protection or replacement steps it recommends. Report suspicious transactions as soon as you see them. Credit cards, debit cards, and bank accounts can have different dispute procedures and deadlines, so ask the institution what applies to your situation. The breach notice itself does not replace a dispute.

Decide whether a credit freeze or fraud alert fits

These tools address new-credit identity theft, not every kind of fraud.

A freeze may be worth considering if the notice lists your Social Security number, date of birth, or identity-document information. It won't stop someone from taking over an existing account or using an already-issued payment card.

Equifax's guidance on freezes and fraud alerts explains the distinction and the need to handle a freeze with each nationwide credit reporting agency.

Deal with other exposed identity information

If you see signs that someone is using your information, follow the IdentityTheft.gov data-breach recovery steps. The FTC's consumer guidance on what to do after a data breach can help you identify the next step.

Contact the issuing agency if a driver's license, passport, or other government ID was exposed. If medical information was involved, watch health-plan statements and explanations of benefits for treatment you didn't receive.

Match the response to the information exposed

Information possibly exposed Main risk Practical response
Email address or phone number Phishing, impersonation, and account-recovery attacks Be wary of convincing follow-up messages and use trusted contact methods
Username and password Account takeover and password reuse Change the password everywhere it was reused and enable multifactor authentication
Payment-card information Unauthorized purchases Contact the issuer, turn on alerts, and review transactions
Bank-account details Unauthorized withdrawals or transfers Contact the bank promptly and ask about account protection or replacement
Social Security number or date of birth New-account identity theft Consider a credit freeze or fraud alert and watch credit activity
Medical information Medical identity theft and privacy exposure Contact the provider or health plan and review medical statements
Driver's license or passport details Document misuse and impersonation Contact the issuing agency about replacement or protective steps

A notice may say that information was "potentially" involved. That doesn't show that anyone has used it, but it also isn't a reason to ignore the warning. Follow the notice's instructions and choose precautions that fit the data category.

What should a breach notice tell you?

The FTC's data breach response guide for businesses says organizations should mobilize a response team and clearly describe what they know about a compromise.

A consumer notice may be updated as the investigation continues, but it should help answer these questions:

If the notice is vague, contact the company's privacy, security, or incident-response channel. Ask specific questions and record the answers, including the name of the person you speak with and the case number. Don't treat a lack of detail as proof that your information was safe; the investigation may still be developing.

Which U.S. breach law applies?

There isn't one general federal rule that gives every U.S. consumer the same notice, deadline, refund, or monitoring service. The applicable state law, type of information, and industry can change the answer.

State breach-notification laws differ in what they define as personal information, when notice is required, and how the notice must be delivered. The law that applies may depend on where the affected consumer lives and on the business involved.

Health information has a separate federal framework. If a HIPAA-covered provider, health plan, clearinghouse, or business associate has a qualifying breach of unsecured protected health information, individual notice is generally required without unreasonable delay and no later than 60 calendar days after discovery. The HHS breach-reporting information describes the organization's reporting duties.

That 60-day limit is the company's obligation, not a reason for you to wait before changing passwords or calling your financial institution. Likewise, receiving a breach notice doesn't by itself guarantee a payment.

Is free credit monitoring enough?

Credit monitoring can alert you to some changes, but it won't secure your accounts or catch every form of misuse. It may not show:

If the company offers monitoring, verify the enrollment process through a known company website or phone number. Check the enrollment deadline, service duration, information the provider collects, and whether identity-restoration assistance is included. Save the confirmation.

Even after enrolling, review bank and card statements, account alerts, and credit activity. Monitoring should supplement those checks, not replace them.

Can you get money after a data breach?

Not automatically. Any recovery may depend on the company's offer, your documented losses, the law that applies, or a settlement or court decision.

If you have lost money or paid costs because of the incident:

  1. Ask the company whether it has a reimbursement or claims process.
  2. Keep receipts for replacement cards, document fees, professional assistance, and other direct costs.
  3. Record unauthorized transactions, dates, calls, case numbers, and the time you spent resolving the problem.
  4. Report financial fraud to the bank, card issuer, or payment provider first.
  5. Read settlement or reimbursement notices carefully and use only their official contact details.

Don't pay an upfront fee just to submit a breach claim. If the loss is substantial or the notice refers to a pending legal settlement, consider speaking with a licensed attorney in your state.

Expect scams after a breach

A caller or message may use accurate details about the incident and still be fraudulent. Stop and verify independently if someone:

End the conversation and contact the company through a website or number you already trust. A legitimate breach administrator can explain the program without asking for your existing login credentials.

Where to take an unresolved problem

Choose the escalation route based on the harm:

A regulator complaint can create a record, but it may not restore account access or recover money as quickly as the bank or company can. Handle urgent financial and account problems first.

Keep a breach-response file

Put the following in one folder:

Having the record in one place makes follow-up easier if the company changes its instructions or sends another notice.

Common questions

Does a breach notice mean my identity has already been stolen?

No. It means the company believes unauthorized access, acquisition, or disclosure may have occurred. Take precautions based on the information involved and watch for signs of misuse.

Should I freeze my credit after an email-only breach?

Not necessarily. An email-only exposure mainly creates phishing and account-takeover risks. A freeze is more directly relevant when Social Security, date-of-birth, or similar credit-application information was exposed. You can still choose a freeze if the notice is unclear or you want additional protection.

Do I need to change a password if the notice says passwords weren't exposed?

Change it if you reused it elsewhere, the account shows suspicious activity, or the company recommends a reset. If it was unique and the company confirms credentials weren't involved, focus on multifactor authentication and account monitoring.

How long should I monitor my accounts?

Follow the company's instructions, but don't stop checking simply because a free monitoring period ends. Keep bank and card alerts active, review activity regularly, and report anything you don't recognize promptly.