Do These 7 Things After a Data Breach — Before Lunch

Got a "your data may have been involved" email? Don't delete it, and don't panic either. The difference between a breach that ruins your month and one that ruins your year is usually about 40 minutes of boring admin work, done in the right order. Here's exactly what to do after a data breach — most of it today, the rest within the week. October's been a busy month for breaches, with millions of records exposed across retail, energy, and government systems, so treat this as a drill you'll actually use.

The first 30 minutes after a data breach

Before you do anything else, find out exactly what leaked. Breach notices bury the important part under paragraphs of corporate apology, but there's always a section labeled something like "information involved." Read that, not the apology. Email address only? Annoying but minor. Full name plus Social Security number plus date of birth? That's a different animal, and it changes how aggressive you need to be.

Then check Have I Been Pwned — type in your email address and it'll tell you which known breaches include it, and what data each one exposed. It's free, it takes a minute, and it turns a vague scare into a concrete list. If you want the full walkthrough, here's our leak-check guide that covers the common gotchas, like old email addresses you forgot you used.

The point of this first step is simple: your response should match the actual damage. A leaked email means spam and phishing attempts. A leaked SSN means someone can open credit cards in your name. Don't treat both the same.

Change every reused password (yes, all of them)

This is the step everyone half-does, and it's where most of the real-world damage happens. Attackers take breached username-password pairs and spray them across banking sites, email providers, and shopping accounts — a technique called credential stuffing. It works because most people reuse passwords. If your breached password was also your email password, the attacker doesn't just have one account now — they have the keys to reset every other account you own.

So: change the password on the breached account first, then change it everywhere else you reused it. Use a password manager to generate unique ones. Then turn on two-factor authentication on your email, bank, and any account that offers it — an authenticator app beats SMS codes, but SMS beats nothing. If the site supports them, passkeys are even better, since there's no password to steal in the next breach.

Do this today. Credential stuffing starts within hours of a breach going public, not weeks. Skipping this step is the most common mistake people make after a data breach — and the one attackers count on.

Freeze your credit — the single most effective step

If the breach exposed your Social Security number, date of birth, or full name, a credit freeze is the most powerful thing you can do, full stop. A freeze locks your credit files so no lender can pull them, which means no one — including you, temporarily — can open new credit in your name. It's free under federal law, it doesn't hurt your credit score, and you can lift it in minutes when you actually need to apply for something.

The catch: you have to contact each of the three bureaus separately — Equifax, Experian, and TransUnion. One freeze doesn't cover all three. It takes about 15 minutes total online, and here's the step-by-step freeze walkthrough with the direct links so you don't land on a lookalike site.

A freeze is the single most valuable defensive move available after a data breach, and people skip it because it sounds like a hassle. It's not. The hassle is spending 60 hours disputing fraudulent accounts, which is the average for identity theft victims who didn't freeze. Fifteen minutes now or sixty hours later — your call.

Add a fraud alert and set up monitoring

A fraud alert is the credit freeze's lighter-weight cousin. It doesn't block anything; instead, it tells lenders to take extra steps to verify your identity before opening new credit. You only need to place it with one bureau — by law, that bureau notifies the other two. An initial alert lasts one year, and if you can confirm you're an identity theft victim, you can extend it to seven years.

Think of the freeze as the lock and the alert as the alarm. The freeze stops most new-account fraud cold; the alert catches anything that slips through, plus it covers you at lenders who might pull a file you forgot to freeze.

While you're at it, pull your free credit reports — you're entitled to one per bureau per week — and actually read them. Look for accounts you didn't open, hard inquiries you didn't authorize, and addresses you've never lived at. Then turn on transaction alerts in your banking app so every charge pings your phone. Monitoring isn't glamorous, but it's how you catch the $1 test charge before it becomes a $4,000 problem.

If your SSN leaked, do these two extra things

A leaked email is a nuisance. A leaked Social Security number is a multi-year project for whoever stole it, because unlike a password, you can't change it. Two government tools exist specifically for this situation — use both.

First, file a report at IdentityTheft.gov. It's run by the FTC, it's free, and it generates a personalized recovery plan plus an official Identity Theft Report you can use when disputing fraudulent accounts. Think of it as creating a paper trail before you need one, because you probably will.

Second, get an IRS Identity Protection PIN. This is a six-digit number that prevents anyone from filing a tax return with your Social Security number — which blocks the classic tax-refund fraud where a thief files early in your name and pockets the refund. You apply once, the IRS sends you a new PIN each year, and tax season becomes dramatically less stressful.

Neither of these is optional if your SSN was in the breach. They're the difference between "someone tried to steal my identity" and "someone filed taxes as me."

Expect the follow-up scam

Here's the part people don't see coming. Breach data gets sold, and the buyers use the real details — your name, the company that was breached, even your account number — to craft phishing messages that look terrifyingly legitimate. "Following the recent incident at [company you actually use], please verify your identity here." The link goes to a lookalike site that harvests your credentials.

Rule: never click links in breach-related emails or texts, even ones that look real. If a message says you need to take action, go to the company's website yourself — type the address or use your bookmark — and handle it there. The real company will never ask for your password or full SSN through an email link. We break down the latest tricks, including the fake QR code scams riding this exact wave, in our phishing guide.

The cruel irony of a breach is that the breach itself becomes the bait for the next attack. Stay skeptical for at least a few months afterward — that's how long stolen details stay fresh enough to be useful. Honestly, the phishing wave that follows a breach causes more damage than the breach itself, which is why scam-proofing belongs in any guide to what to do after a data breach.

Your "after a data breach" checklist

1. Read the breach notice's "information involved" section; check Have I Been Pwned
2. Change the breached password and every password you reused; enable 2FA
3. Freeze your credit at Equifax, Experian, and TransUnion
4. Place a one-year fraud alert with any one bureau
5. Pull your free weekly credit reports; turn on bank transaction alerts
6. File at IdentityTheft.gov and get an IRS Identity Protection PIN (if SSN leaked)
7. Treat every breach-related message as a potential scam for the next few months

Nobody enjoys this list, but nobody enjoys identity theft either, and one of these is over by lunch. The breaches will keep coming — October alone proved that — but the people who sail through them aren't lucky. They're just the ones who did the boring work fast. Now you know the order. Go do it.