What to do after a data breach notice

1. Read the notice carefully

Breach letters usually explain what happened, what types of information were involved (for example name, Social Security number, account numbers, medical information, or passwords), and what the company is offering. If free credit monitoring is offered, note the enrollment code and deadline. You can find many notices, and the sample letters companies filed, on the California AG data breach list — or search for the company on our index.

Be careful with follow-up messages. Scammers send fake “breach” emails and calls. Use contact details from the official notice or the company's own website, not links in unexpected messages.

2. Freeze your credit (free)

A credit freeze blocks most new credit from being opened in your name. It is free by federal law, does not affect your credit score, and you can lift it temporarily when you apply for credit. You need to contact each of the three bureaus:

• Equifax — credit freeze
• Experian — credit freeze
• TransUnion — credit freeze

Keep any PIN or account login you create so you can lift the freeze later.

3. Or place a fraud alert (free)

A fraud alert asks lenders to take extra steps to confirm it's really you before opening credit. Contact any one of the three bureaus; it must tell the other two. An initial fraud alert lasts one year. Identity theft victims can get an extended alert that lasts seven years. A freeze is stronger; you can use both.

4. Check your credit reports

Get your free credit reports from all three bureaus at AnnualCreditReport.com — the official site. Look for accounts, addresses, or inquiries you don't recognize.

5. Change passwords and turn on two-step verification

If the notice mentions usernames, emails, or passwords, change that password right away — and anywhere else you used the same or a similar one. Use a unique password for every account (a password manager helps) and turn on two-step verification for email, banking, and other important accounts.

6. Watch your accounts

• Review bank and card statements for charges you don't recognize, and report them quickly.
• If medical or insurance information was involved, review “explanation of benefits” statements for care you didn't receive.
• If your Social Security number was involved, consider getting an IRS Identity Protection PIN at IRS.gov.

7. If your information is misused

Report identity theft and get a personalized recovery plan at IdentityTheft.gov, run by the Federal Trade Commission. Contact the companies where fraud occurred, and keep copies of everything.

8. Check for a settlement

Some breaches lead to class action settlements that pay for losses or offer monitoring. See our settlements & claim deadlines page (partial list) and always file through the official settlement website.