What to do after a data breach

Step 1: confirm what actually happened

Scammers send fake breach notices, so confirm before you act. Go to the company's website by typing the address yourself or using a bookmark, and look for a notice there. A real notice usually says what kind of information was involved, such as email addresses, passwords, a Social Security number or payment details. What was exposed decides which steps below matter most.

You can also check Have I Been Pwned at haveibeenpwned.com. Per the site's own About and FAQ pages (read October 31, 2026), it is a free resource built by Troy Hunt that aggregates breaches so you can see whether an account of yours was exposed. You search one email address or username at a time. Its Pwned Passwords service lets you check whether a particular password has been seen in a breach, and the FAQ says passwords are not stored next to personal data such as email addresses. The site also says it sends notifications to impacted subscribers, and that certain sensitive breaches can only be viewed by the verified owner of the address. Absence from the site does not prove you were not exposed, because it only covers breaches that have been loaded into it.

Step 2: change the password, and every place you reused it

Change the password on the affected account first. Then change it anywhere else you used the same or a similar password, starting with email, banking and shopping accounts. Attackers commonly try a leaked email and password pair on other sites, which is why reuse is the real danger.

Make each new password unique. A long passphrase works well. If you cannot sign in because the password was already changed, use the site's account recovery, and check the recovery email and phone number are still yours.

Step 3: use a password manager and turn on two-factor authentication

A password manager creates and remembers a different password for every account, so one breach cannot spread to your other logins. Many browsers and phones have one built in. Pick one you trust and move your most important accounts over first.

Two-factor authentication, also called 2FA or two-step verification, asks for a second proof when you sign in, such as a code from an authenticator app. Turn it on for email first, because email can reset your other passwords, then for banking, cloud storage and social accounts. An authenticator app or a hardware key is generally a stronger choice than text messages where the site offers one.

Step 4: freeze your credit if a Social Security number was exposed

If the notice mentions a Social Security number, date of birth or other identity details, a credit freeze is the most direct step. According to the Consumer Financial Protection Bureau (pages read October 31, 2026), a freeze prevents prospective creditors from accessing your credit file, which makes it harder for an identity thief to open new accounts in your name. Since September 21, 2018, placing and lifting a freeze is free under federal law. You must contact each of the three nationwide credit bureaus separately: Equifax, Experian and TransUnion.

The CFPB says a freeze placed online or by phone must be in place within one business day, and that a freeze can be lifted, including temporarily, for free: within one hour if you ask by phone or secure electronic means. It does not affect your credit scores. The trade-off is that creditors typically will not offer you credit while the file is frozen, so you lift it when you apply for a loan, card or apartment. Keep your PIN or login safe.

A few parties can still see your file during a freeze, including creditors of accounts you already hold and companies you hired to monitor your file. The CFPB also notes the free-freeze law does not apply to people requesting your report for employment, tenant-screening or insurance purposes. Note that the CFPB distinguishes freezes from credit locks, which may have monthly fees. If you want the free option guaranteed by federal law, ask for a freeze.

Fraud alerts, free credit reports and statements

A fraud alert is different from a freeze. It tells businesses that check your credit to check with you before opening a new account. The CFPB says a fraud alert is free and lasts one year, and identity theft victims can get an extended alert lasting seven years. Contact one bureau and it must notify the other two. You can place one alongside a freeze.

Check your credit reports at AnnualCreditReport.com. The CFPB says you can view your free reports from Equifax, Experian and TransUnion once a week there. Look for accounts or inquiries you do not recognize. Also read your bank and card statements and turn on transaction alerts from your bank, so a charge you did not make stands out quickly.

If someone has already misused your identity

The CFPB points identity theft victims to the Federal Trade Commission's IdentityTheft.gov, where you can get a personalized recovery plan that walks you through the steps. We could not load the FTC's own breach pages when writing this guide, so we are not repeating their steps here. Use their site for the current process.

If a Social Security number was involved, the freeze and regular credit report checks above are the main protection we could verify. We did not verify any other Social Security-specific steps, so follow official instructions for those.

What not to do

• Do not pay anyone who contacts you offering to remove your data from the breach or recover it. If you are unsure whether an offer is real, check with the breached company through its official website.
• Do not click links or open attachments in an unexpected email or text about the breach. Criminals reuse news of a breach to send convincing follow-up phishing. Go to the company's site yourself.
• Do not give out a password, a one-time code or your full Social Security number to someone who called you. A genuine company will not ask for a code you received by text.
• Do not reuse your new password. A fresh breach with the same password would put you back where you started.
• Do not assume a free credit monitoring offer in the notice is a scam, but read the terms and enrol through the company's official page, not a link in a message.

Optional and secondary: reducing what strangers can find

A breach and a people-search listing are different problems. A breach exposes data from one company's systems. People-search sites publish information collected from public records and other sources. Removing the second does not undo the first.

That is the only place a service like DeleteMe fits, and it is optional. From DeleteMe's own website, as read on October 31, 2026, it searches data brokers and people-search sites for your information and submits opt-out requests for you. It does not undo a breach, it does not secure your accounts, and it does not change a password or stop a thief from using data already taken. We have not tested it. If you want to see what it covers, see DeleteMe's current plans (Affiliate link) and check the current price before deciding. The same opt-outs can be done yourself for free, as our guide on removing your personal information explains.

A one-page checklist

• Confirm the breach from the company's own site, and check haveibeenpwned.com for your email address.
• Change the password on the affected account and on any account that shared it.
• Move to a password manager so each account has its own password.
• Turn on two-factor authentication, starting with email.
• Freeze your credit at Equifax, Experian and TransUnion if an SSN or identity details were exposed.
• Consider a fraud alert, and read your credit reports at AnnualCreditReport.com.
• Watch bank and card statements, and set up transaction alerts.
• Ignore anyone who contacts you offering to fix the breach for a fee.
• If anything is misused, visit IdentityTheft.gov for a recovery plan.

If you also want less of your information publicly listed, the free opt-outs are step one. If you prefer to hand off the repetitive part, view DeleteMe (Affiliate link) is one option, with the limits described above.