🎯 In 30 seconds: Read the notice for one thing: what exactly was exposed. A leaked card number takes five minutes to fix. A leaked Social Security number calls for a credit freeze, an IRS Identity Protection PIN and a few months of watching. A leaked password means changing it everywhere you reused it.
First, make sure the notice is real
Fake breach notices exist to get you to call a number or click a link and “verify” your details. Don’t use the contact details in the notice until you have checked them. Look up the company’s own website, find its breach page or customer service number, and confirm the notice there. Never give your full SSN to someone who calls you about a breach.
What was exposed decides the response
| Exposed | Do this | Effort |
|---|---|---|
| Social Security number | Freeze credit at Equifax, Experian and TransUnion. Get an IRS IP PIN. Take any free monitoring offered. Pull your credit reports. File taxes early. Check your earnings record in my Social Security. | About an hour once |
| Credit or debit card number | Ask the issuer to cancel and reissue the card. Update autopays with the new number. Watch the next statement. | 10 minutes |
| Bank account number | Ask the bank whether to close and reopen the account. Turn on alerts for every debit. | 30 minutes |
| Password or login | Change it on that site, and on every site where you reused it. Turn on multifactor login. If you can’t log in, contact the company to recover or close the account. | 15 minutes |
| Medical or insurance ID | Read every Explanation of Benefits and Medicare Summary Notice for care you never got. Ask your insurer about a new member number. | Ongoing |
| Driver’s license | Contact your state motor vehicle agency about the exposure; a freeze helps here too, since a license plus SSN can open accounts. | Varies by state |
| A child’s data | Parents can freeze a child’s credit file at each bureau, free. | 30 minutes |
The free tools, and how they work
| Credit freeze | Free to place and lift. A bureau must place it within one business day of an online or phone request, and lift it within one hour when you ask online or by phone. Contact each of the three bureaus separately. |
| Fraud alert | Free. Lasts one year; an extended alert for identity theft victims lasts seven years. Placing it at one bureau tells the other two. |
| Credit reports | Free every week from each bureau at AnnualCreditReport.com, the only authorized site. |
| IRS Identity Protection PIN | A six-digit number, valid for one calendar year, without which no one can e-file a return with your SSN. Anyone with an SSN or ITIN who can verify their identity can get one in their IRS online account. |
| Breach company’s monitoring | The FTC says take it if offered. Read the sign-up terms, and remember monitoring tells you after a problem; a freeze prevents one. |
A worked example
A notice from a health insurer says your name, date of birth, SSN and member ID were exposed. Here is a 60-minute plan:
- 10 min: confirm the notice on the insurer’s website and enroll in the free monitoring it offers, using the enrollment code from the letter only after you confirm it.
- 30 min: freeze your credit at Equifax, Experian and TransUnion (about 10 minutes each). Store the PINs or logins in a password manager.
- 10 min: get an IRS IP PIN in your IRS online account. If you can’t verify online, Form 15227 is an option when your adjusted gross income was below $84,000 (single) or $168,000 (married filing jointly), per the IRS page as of October 2026.
- 10 min: ask the insurer how to get a new member ID, and set a calendar reminder to read every Explanation of Benefits for the next year.
If the data is already being misused
Go to IdentityTheft.gov for a recovery plan and an official FTC Identity Theft Report. The full rights and recovery steps are on the Money Theft & Forensics page.