If a company tells you your data was exposed, you usually do not file its breach notice with a regulator. Report the harm that reached you instead: identity theft, an online crime, an unauthorized transaction, or a possible privacy violation.

Start with the notice itself. Save it, verify it through a known company website or phone number, then protect the account or credit file most likely to be abused.

These steps are for U.S. consumers. State, industry, and data type can change the rules, and this information does not replace the company's legal duties or legal advice.

Exposure is not the same as identity theft

A breach notice shows possible exposure. It does not prove that anyone used your information. The risk depends on what was exposed, whether that was an email address, reused password, Social Security number, payment detail, or medical record.

Some notices say only "personal information." It is annoyingly vague. Keep the notice anyway, ask the company which records were involved, and preserve the original wording.

Turns out, the event determines the reporting route more than the company's name does.

Choose the reporting route

Match the report to what happened.

A focused report works better than the same vague complaint sent everywhere.

What to do in the first day

Work through these steps in roughly this order.

1. Keep the breach notice. Save the email, letter, attachment, and envelope. Note when you received it and what the company says was affected. Do not click an unexpected link until you check the company through a known website or phone number.

2. Lock down high-risk accounts. Change reused passwords, beginning with your email account. Turn on multifactor authentication where it is available. If a bank or card account may be involved, contact the institution through its official app, website, or the number printed on your card.

3. Match credit protection to the risk. A Social Security number or similar identity information may justify a credit freeze or fraud alert. They are different tools.

4. Report confirmed misuse. Use IdentityTheft.gov for identity theft, IC3 for a cyber-enabled crime, and the HHS OCR complaint portal for a possible HIPAA complaint. If a financial institution asks for a police report, ask your local police department how to obtain one.

5. Keep a case file. Save confirmation numbers, screenshots, call dates, representative names, disputed transaction details, and every response. Keep copies of anything you submit.

6. Question the company in writing. Ask what information was involved, when the incident and notice occurred, and what protective steps the company has taken. Written questions create a useful timeline if you need to escalate.

If someone used your identity

Exposure alone is not identity theft. It becomes an identity-theft matter when someone uses your information, tries to use it, or creates an account in your name.

An unfamiliar account, loan, benefit claim, tax filing, or similar activity can be a warning sign. Use IdentityTheft.gov when you find one.

The Consumer Financial Protection Bureau's identity theft guidance says the FTC process can provide an Identity Theft Report and recovery plan. That report can help organize the steps that follow.

Tell the affected bank, lender, or card issuer exactly what you recognize and what you do not. Ask for a case number and follow the institution's written instructions. Do not call an incident confirmed fraud unless your records support that description.

Credit freeze or fraud alert?

A credit freeze and a fraud alert protect against different risks. A freeze can help stop new-account identity theft, while a fraud alert asks businesses that check your credit to take extra steps to verify you.

The FTC's credit freeze and fraud alert guidance says freezes are free and remain in place until you tell the bureaus to remove them. Use the official process for Equifax, Experian, and TransUnion, and remember that you may need to lift a freeze when applying for new credit.

You can request a fraud alert from one nationwide credit reporting company. That company must notify the other two. Initial and extended alerts have different eligibility rules and durations, so check which type applies to you.

Review your credit reports as well. An account in your name that you do not recognize could signal identity theft. Neither a freeze nor an alert investigates the breach or reverses an unauthorized payment.

Reporting cybercrime to IC3

Choose IC3 when the internet or a connected device formed part of the crime. Phishing, ransomware, online extortion, account takeover, and other online fraud are examples.

The IC3 FAQ says anyone affected by a cyber-enabled crime may file a complaint, including people outside the United States. Trained analysts review complaints and share information with law enforcement and partner agencies when appropriate.

IC3 is not a live response desk. It does not investigate individual complaints or provide the investigative status of a filing. Save the submission confirmation anyway.

Give IC3 the details you actually have: dates, email addresses, usernames, website addresses, payment details, wallet addresses, screenshots, and messages. Stick to what you observed. Do not guess who attacked you.

To be honest, one report is rarely enough after a financial cybercrime. Tell your bank or payment provider too, and say whether the money moved by credit card, debit card, ACH, wire, or a peer-to-peer payment service. The payment rail controls the dispute process, and an IC3 complaint does not replace the provider's own fraud procedure.

Health information and HIPAA complaints

Health information creates a separate jurisdiction question. HHS OCR investigates complaints involving covered entities and business associates under the HIPAA Privacy, Security, and Breach Notification Rules.

Use the HHS OCR complaint portal if a health plan, covered provider, clearinghouse, or business associate may have mishandled protected health information or failed to meet an applicable HIPAA requirement. OCR is a complaint route, not a substitute for contacting the organization about immediate account protection.

Include the organization's name, the relevant dates, what happened, the information involved, and the breach notice if it is safe to provide. Keep medical records and full identification numbers out of ordinary email unless the recipient gives you a secure submission method.

Deadlines are not interchangeable

The company's regulatory deadline and your response deadline are separate clocks. No single U.S. deadline covers every breach, record type, or reporting channel.

Thing is, a deadline quoted for another country, industry, or regulator may not control your situation. Report suspected identity theft and cybercrime promptly, and follow the bank or payment provider's instructions because financial dispute procedures can have their own time limits.

Record the date you received the notice. If it gives you a deadline to enroll in a service, reset an account, or contact support, keep that instruction with your other records.

A simple report template

Use this outline for an agency, financial institution, police department, or company privacy team. It is a starting point, not an official form.

Subject: Possible identity theft or cybercrime after a data breach

Name and safe contact:
Affected company:
Date the breach notice was received:
Date of suspicious activity:
What the notice says was affected:
What happened:
Evidence available:
Money or account impact:
Steps already taken:
Report or case numbers:
What I am asking this office to do:

Use facts and dates. Send only what the recipient needs, and confirm that the submission channel is official and secure before sending sensitive records.

If the company's response seems inadequate

Start with the privacy, security, or customer-support contact listed in the breach notice. Ask for the categories of information involved, the incident and notice dates, the protective steps taken, and the right contact for follow-up questions.

Keep your request and the company's reply. If the response is missing, evasive, or inconsistent with the notice, consider your state's attorney general or consumer-protection office. A sector regulator may be a better fit for health, financial, or other specialized information.

IC3 is not a general complaint desk for slow customer service. Use it when the facts point to a cyber-enabled crime, and use HHS OCR when they point to a possible HIPAA issue.

If you discovered the breach at work

Consumers do not file the affected company's regulatory breach report. If you work for the business that discovered the incident, this consumer workflow is not a compliance checklist.

Preserve logs and other evidence, limit further access, identify the data and residents involved, and bring in the organization's incident-response team and legal advisers. State requirements, sector rules, contracts, and law-enforcement requests may create separate obligations.

An IC3 report does not replace any notice the business may owe. An HHS OCR complaint route does not replace other duties that apply to a HIPAA-regulated organization.

Common mistakes to avoid

Do not treat a breach letter as proof that identity theft has already happened. Keep the letter, emails, phishing messages, ransom notes, transaction records, and screenshots instead of deleting them.

A credit freeze at one bureau does not mean the other two were notified. A fraud alert is different: one nationwide credit reporting company must notify the other two, while a freeze uses the official process for each bureau.

Never send a full Social Security number to an unverified caller or email address. An unauthorized card, ACH, wire, or peer-to-peer transaction should not be reported only to IC3.

Payment rails have different dispute procedures. Say exactly how the money moved.

If no fraud has appeared yet

You can still act before misuse appears. Save the notice, change reused passwords, consider a freeze or fraud alert when the exposed data creates that risk, and review your credit reports.

Do not file an identity-theft report saying someone opened an account when you have no evidence of that event. Report what you know, keep monitoring, and update the relevant institution if suspicious activity appears later.

Your next step

Open the breach notice now and save a copy. Secure any reused email password, then choose the reporting route that matches the harm rather than the company's name.