What to do after a data breach

The steps for what leaked

• Social Security number. Freeze and check your credit, as in the steps below. Review your Social Security work history at socialsecurity.gov/myaccount. Try to file your taxes early, before a scammer can, and respond right away to letters from the IRS.
• Password or login. Log in and change your password, and your username if you can. If you can't log in, contact the company and ask how to recover or shut down the account. If you use the same password anywhere else, change that too.
• Card or bank account numbers. Contact your bank or card company. Use a number you know is real, like the one on the back of your card or on your statement. Cancel the card or close the account and get a new one, then update any automatic payments.
• Driver's license. Contact the nearest DMV branch to report it. The state might flag your license number, or suggest that you apply for a duplicate.
• Children's information. If your child is under 16, the FTC says to request a free credit freeze, using each bureau's own instructions. Children generally won't have credit reports unless someone is using their information for fraud. To find out, ask each bureau to check its records.
• Passport, Medicare or other information. IdentityTheft.gov has steps for those too. For anything else, it says to contact the organization or company involved. Tell them your information was lost or exposed, and ask what you can do to prevent an identity thief from using it.

Scams to watch for after a breach

• Fake emails about the breach. In its alert on the Marriott breach, the FTC said phishing scammers often try to take advantage of situations like this. They pose as legitimate companies and send emails with links to fake websites to try to trick people into sharing their personal information.
• Unexpected calls, texts and emails. IdentityTheft.gov says not to respond to them. Scammers often pretend to be from the government or a business you know.
• Links and numbers in a message. Even if a text or email seems to come from a company you do business with, IdentityTheft.gov says not to click its links. Contact the company on a website you know is trustworthy, or look up its number. Don't use the number in the message or on your caller ID.
• Settlement scams. For the settlement over the 2017 Equifax breach, the FTC warned of fake websites meant to look like the official claims site. It said you'd never have to pay to file a claim for those benefits. And anyone who called to get you to file one was almost certainly a scammer.

What to do after a breach, step by step

1. 1

   Read the company's notice and find out what was exposed. Then follow IdentityTheft.gov's steps for each type of information that was part of the breach: identitytheft.gov/databreach (opens in a new tab)

2. 2

   If a password leaked, change it right away, and on any account where you use the same or a similar password. Then turn on two-factor authentication, sometimes called two-step verification, on accounts that offer it. The FTC says it helps secure your account even if your password is exposed.

3. 3

   Freeze your credit with all three credit bureaus: Equifax, Experian and TransUnion. The FTC says a freeze is free to place or lift, and doesn't affect your credit score. It also says a freeze won't stop a thief from making charges to your existing accounts.

4. 4

   Concerned about identity theft? You can also place a free, one-year fraud alert. Contact one bureau, and it must tell the other two.

5. 5

   Get your free credit reports at AnnualCreditReport.com. The FTC says you can check your report from each of the three bureaus once a week for free. If you see an account or debt you don't recognize, contact the company and ask about it. IdentityTheft.gov says to accept free credit monitoring if a company offers it.

6. 6

   Watch for scam calls, texts and emails about the breach. Don't click their links or call the numbers they give. Not sure about a text or email? Paste it into our free scam check. It's an automated check, so it can be wrong: Is this a scam?

7. 7

   Want to know if your email address is in known data breaches? Our free email breach check looks it up, and we email you the report: Has your email leaked?

8. 8

   If someone used your information, for example to open an account or make a purchase, report it at IdentityTheft.gov. The FTC says you'll get a free recovery plan with next steps.

Should I freeze my credit or place a fraud alert?

You can get both. The FTC says a freeze is available to anyone, for any reason, and you can add an initial fraud alert if you are, or suspect you may be, affected by identity theft. Both are free. The FTC says both can help by making it harder for scammers to open new credit accounts in your name. A freeze lasts until you lift it. Unlike a freeze, a fraud alert doesn't prevent businesses from seeing your credit report. It makes lenders verify your identity before they grant new credit. An initial alert lasts one year, and you can renew it.

Can I still apply for credit with a freeze?

Yes, after you lift it. You can lift a freeze for a while, for things like getting a credit card or buying a car. The FTC says you only need to contact the credit bureau the lender will use. When you're done, you can freeze it again.

Can I get a new Social Security number?

Not in most cases. IdentityTheft.gov says that in most instances, you can't get a new one without evidence that someone else is misusing your number. It adds that a new number likely won't solve all your problems: agencies and others will still have records linking you to your old one.

I got an email saying my info is for sale on the dark web. Is it real?

It may not be. In 2022 the FTC warned that such an email could be phishing, designed to trick you into disclosing sensitive information to scammers. Don't click a link or use a phone number in the message. If you think it's real, for example because you have a credit monitoring service or a credit card with a company that monitors the dark web, contact the company using a website or phone number you know is real.