">

A breach notice means information may have been accessed, exposed, or taken without authorization. It does not automatically mean someone stole your identity. For a U.S. consumer, match the report to the harm, not to the letterhead on the notice.

Contact the company for incident details. If money or payment information is involved, call your bank or card issuer the same day. Report identity theft to the Federal Trade Commission. Use IC3 for phishing, account takeover, hacking, ransomware, or online fraud. Local police or the FBI are for an ongoing crime, a threat to life, or a serious national-security concern.

The company's duty to notify you is a separate issue from those options. State notification rules differ, and so do sector rules for health care and financial firms. Don't borrow another state's timeline and assume it applies to you.

You can use more than one route. Someone whose account was taken over and whose money was stolen may need the company, the bank, the FTC, IC3, and local police.

Choose the right reporting route

What happened Start with What the report does
You only received a breach notice The company, then a credit freeze or fraud alert Confirms what data was involved and helps prevent new-account fraud
Someone used your personal information The company, bank, or creditor, then the FTC Creates an identity-theft recovery record and documents the harm
You experienced phishing, account takeover, hacking, ransomware, or online fraud IC3 Sends a detailed cybercrime complaint to the FBI's Internet Crime Complaint Center
There is an ongoing crime, threat to life, or serious national-security concern Local law enforcement or the FBI Provides a direct law-enforcement response route
Medical records or health information were mishandled The provider's privacy office and, where applicable, HHS Office for Civil Rights Separates a possible HIPAA privacy complaint from a general cybercrime report
A company appears to have ignored its notification duties Your state attorney general or consumer-protection office Creates a complaint about the company's handling of the incident

The rows overlap on purpose. If funds already moved, the bank call comes before any federal form.

Confirm the notice is real

A mailed letter or a notice inside an account you already use is one thing. An unexpected text with a login link is another. Type the company's known web address yourself, open its official app, or call the number printed on a statement or payment card. Skip a phone number or link that appears only in the suspicious message.

When you reach a real contact, ask:

Save the original notice, any mailed letter, and your communications with the company. Don't email your full Social Security number, password, security code, or bank login. A legitimate company shouldn't need your password to confirm a breach.

If the message demands payment, asks for remote access, or sends you to an unfamiliar login page, treat it as possible phishing. Keep a copy and consider reporting it through IC3.

Lock down accounts and credit

Do this even if the company hasn't confirmed that anyone used your data.

Change exposed passwords first. Start with the affected account and your email, especially if you reused that password elsewhere. Use a unique password for each account and turn on multifactor authentication.

Call the bank, card issuer, or payment service on an official number. Ask whether the account or card should be replaced, review recent activity, and report unauthorized transactions promptly.

A credit freeze is free and can stop identity thieves from opening new accounts in your name. Contact Equifax, Experian, and TransUnion separately if you want all three files frozen. The freeze stays until you tell that bureau to remove it. A fraud alert is a different, narrower tool. Review the FTC's guide to credit freezes and fraud alerts for the options.

Check credit reports and account statements for unfamiliar accounts, inquiries, addresses, or charges. Date anything that looks wrong.

If a government ID, tax information, employment record, or benefits file was involved, contact that agency through its official website, not through a number in the breach email.

A freeze only limits access to your credit file. It doesn't investigate the company, reverse fraudulent charges, or recover an account that has already been taken over.

File with the FTC if someone used your information

Use the FTC identity-theft process when someone opened an account in your name or used your personal information. You'll get a free personal recovery plan with recommended next steps.

Gather what you have:

Keep the completed report and the recovery plan. A business or law-enforcement agency may ask for a copy when you dispute an account. The FTC's identity-theft recovery guidance covers reporting and recovery.

That FTC file does not replace a bank's fraud investigation, a credit-billing dispute, or a police report. It also doesn't guarantee reimbursement.

File an IC3 complaint for cyber-enabled crime

The FBI's Internet Crime Complaint Center is the federal intake when the incident involves:

Use the IC3 data-breach guidance and submit the complaint through the official IC3 site. Include a clear timeline and use the words data breach in the incident description, as IC3 instructs.

Put in the complaint:

Don't delete suspicious emails or alter files before you save copies. Keep original messages when you can, including their headers. Submit only the sensitive information the form requests.

IC3 receives a large number of complaints and can't respond directly to every submission. Filing therefore doesn't guarantee an investigation, contact from an agent, or recovery of lost money. Anyone who claims to represent IC3 and asks for a payment or another transfer is a warning sign. Use the official site rather than a link sent by a stranger.

When to involve police or the FBI

For an ongoing crime, a threat to life, or a national-security concern, use the FBI's cyber reporting page to reach a local field office, or file at tips.fbi.gov. Call 911 if there is immediate physical danger.

A local police report can also help if identity documents were stolen or misused, a creditor, bank, or government agency asks for one, you know who committed the fraud, or you need a local record of account takeover or identity theft.

You don't normally need a police report just because a company sent a breach notice. Ask the agency how it wants evidence submitted, and keep the report number with your other records.

Health records, state complaints, and filings that aren't yours

If medical records or health insurance information were involved, contact the provider's privacy office and ask what was affected. A possible HIPAA privacy complaint to HHS's Office for Civil Rights is a different path from an IC3 cybercrime complaint. Not every health-data incident is a HIPAA violation. The reporting duty under HIPAA generally falls on the covered organization or business associate, not on the patient.

If a company won't answer reasonable questions, appears to have sent an incomplete notice, or refuses to address known misuse of your information, consider a complaint with your state attorney general or consumer-protection office. State laws vary, so a deadline or remedy from another state may not apply.

A state complaint may help regulators spot a pattern. It doesn't guarantee an individual refund.

SEC Form 8-K disclosures and certain CISA incident reports are organization-level requirements. They aren't consumer complaint forms. A public company decides whether an incident is material and whether a securities filing is required. CISA rules can depend on the organization, industry, and type of incident. For a consumer cybercrime complaint, IC3 is usually the federal route that applies to you.

Is there a deadline to report?

There isn't one universal U.S. deadline for consumers to report a breach to authorities. When the company had to notify you can depend on state law, the type of information, and rules for sectors such as health care or financial services.

Act on the pieces you control. Call the bank as soon as you see an unauthorized transaction, change exposed credentials, and file an FTC or IC3 report once you have enough detail to describe what happened.

Rules such as the GDPR's 72-hour requirement, a HIPAA breach-notification period, or an SEC Form 8-K deadline bind the organizations those rules cover. They aren't general consumer filing clocks.

Records to keep

Create one folder, preferably with a backup, containing:

Write facts rather than guesses. Record that an unfamiliar account appeared on a credit report on a particular date. Don't name a thief unless you have a basis for that.

The company can confirm the incident and say which data was involved. After that, each office does a narrower job: banks handle payment disputes and replacement cards, the FTC documents identity theft, IC3 collects cybercrime complaints, and credit bureaus place or lift freezes and alerts. Police, the FBI, or a state attorney general may document or investigate conduct in their jurisdiction. None of those filings is a promised path to compensation.

Save the notice, then contact the company through a channel you already know. If there is actual fraud, secure the account and call the financial institution before you sit down with the FTC or IC3 form.