Data breaches have become an increasingly common part of modern life. Companies, healthcare providers, schools, financial institutions, employers and government agencies may all maintain sensitive information that could be exposed during a cybersecurity incident.
A breach does not automatically mean that someone has stolen your identity. It does mean that you should understand what information may have been exposed and take reasonable steps to reduce the risk of future misuse.
The appropriate response depends on the type of information involved. An exposed email address presents a different level of risk than an exposed Social Security number, bank account number, driver's license number or medical record.
What Is a Data Breach?
A data breach occurs when personal, confidential or protected information is accessed, disclosed, obtained or used without proper authorization.
Information exposed in a breach may include:
- Names
- Home addresses
- Email addresses
- Telephone numbers
- Dates of birth
- Social Security numbers
- Driver's license or state identification numbers
- Bank account or payment information
- Health insurance information
- Medical information
- Employment or payroll information
- Online account usernames or passwords
The risks are different depending on which information was involved. For example, a stolen password may create immediate account-access concerns, while an exposed Social Security number may create a long-term identity-theft risk.
Does a Breach Mean Your Identity Was Stolen?
Not necessarily. A data breach and identity theft are related, but they are not the same.
Data breach
Personal information may have been accessed, copied, disclosed or obtained without authorization.
Identity theft
Someone uses another person's information to commit fraud, open accounts, obtain services or impersonate that individual.
Sometimes exposed information is never misused. In other cases, criminals may wait months or years before attempting to use it. Taking preventive action can therefore be worthwhile even when you do not see immediate signs of fraud.
What to Do During the First 24 Hours
Read and save the breach notice
Keep the original email, letter or official notification. Note the organization involved, the incident date, the notice date and the categories of information that may have been exposed.
Confirm the notice through the organization's official website or published contact information before clicking links or providing personal information.
Change affected passwords
Change passwords immediately when login credentials may have been exposed. Use a strong, unique password that is not reused across other accounts.
Change any other account that uses the same or a similar password.
Enable multi-factor authentication
Turn on multi-factor authentication for important accounts, especially email, banking, investment, payroll, tax and healthcare accounts.
Review your financial accounts
Look for unfamiliar purchases, withdrawals, transfers, new payees, password changes or contact-information changes.
Contact the financial institution promptly if you see activity you do not recognize.
Consider security freezes
When sensitive identifying information has been exposed, consider placing security freezes with the nationwide credit bureaus and reviewing whether specialty consumer reports should also be frozen.
Freeze Your Nationwide Credit Reports
A security freeze restricts access to a consumer credit report. This can make it more difficult for someone to open a new credit account using your identity.
Consumers generally need to contact Experian, Equifax and TransUnion separately. Placing a freeze with one bureau does not automatically freeze the other two.
Learn more in our guide: How to Freeze a Credit Report .
Do Not Forget Specialty Consumer Reports
Experian, Equifax and TransUnion are not the only companies that may maintain consumer information.
Specialty consumer reporting agencies may collect information involving:
- Checking and savings accounts
- Identity verification
- Alternative loans
- Telecommunications and utilities
- Rental housing
- Employment and income verification
- Insurance claims
- Public-record and fraud-prevention information
Depending on the information exposed and your personal circumstances, you may want to review or freeze reports maintained by agencies such as:
- LexisNexis
- Innovis
- ChexSystems
- SageStream
- CoreLogic Teletrack
- Clarity Services
- FactorTrust
- MicroBilt
- DataX
- LCI
Availability and procedures differ by agency. Some reports may be frozen, while others may offer different consumer-access or suppression procedures.
See: The Complete Guide to Consumer Reporting Agencies .
Consider a Fraud Alert
A fraud alert tells businesses reviewing a traditional credit report to take additional steps to verify the identity of the applicant.
A fraud alert is different from a security freeze. A freeze restricts access to the report, while a fraud alert allows access but requests heightened identity verification.
Learn more about the differences in: Credit Freeze vs. Credit Lock .
Secure Your Online Accounts
When an email address, username or password is exposed, criminals may attempt to access other accounts using the same credentials.
Prioritize these accounts:
- Primary email accounts
- Bank and credit-union accounts
- Credit card accounts
- Investment and retirement accounts
- Payroll and employment portals
- Tax-preparation accounts
- Health insurance and medical portals
- Mobile phone accounts
- Cloud-storage accounts
- Social media accounts
Your email account deserves particular attention because password reset messages for many other accounts may be sent there.
Protect Bank and Payment Accounts
When bank account, debit card or payment information may have been exposed, contact the relevant financial institution promptly.
Possible steps may include:
- Replacing a debit or credit card
- Changing account credentials
- Adding account alerts
- Reviewing automatic payments
- Watching for small test transactions
- Discussing whether an account number should be changed
- Reviewing ChexSystems or other banking-related reports
Do not assume that monitoring a traditional credit report will reveal all forms of bank-account fraud.
What If Your Social Security Number Was Exposed?
An exposed Social Security number creates a potentially long-term risk because it cannot be changed as easily as a password or payment card.
Consider taking these steps:
- Freeze your nationwide credit reports.
- Review relevant specialty consumer reports.
- Secure your Social Security and tax-related online accounts.
- Watch for unfamiliar tax documents, benefit claims or employment records.
- Review financial statements and important mail carefully.
- Keep the breach notice and related documentation indefinitely.
What If Your Driver's License Number Was Exposed?
A driver's license or state identification number may be used for identity verification or impersonation.
Review the breach notice to determine whether the number, an image of the license or additional identifying information was involved.
Depending on the circumstances, you may consider contacting your state's motor vehicle agency for current guidance and watching for unfamiliar identity-verification activity.
What If Medical Information Was Exposed?
Medical identity theft can involve more than unauthorized charges. Someone may use another person's information to obtain treatment, prescriptions, insurance benefits or medical equipment.
Review:
- Health insurance explanation-of-benefits statements
- Medical bills
- Prescription history
- Patient portal activity
- Provider contact information
- Changes to insurance or medical records
Contact the healthcare provider or insurer if you see services, prescriptions or providers you do not recognize.
Watch for Follow-Up Scams
Criminals sometimes use information from a breach to make phishing messages sound convincing.
A scammer may know your name, employer, healthcare provider, bank, address or part of an account number. Possessing some accurate information does not prove that the caller or sender is legitimate.
Common warning signs include:
- Unexpected requests for security codes
- Pressure to act immediately
- Threats that an account will be closed
- Requests to move money to a “safe” account
- Requests for payment by gift card, cryptocurrency or wire transfer
- Links to unfamiliar websites
- Messages asking you to confirm a full password or Social Security number
When in doubt, stop communicating and contact the organization using a telephone number or website you independently verify.
Monitor More Than Your Credit Score
Credit monitoring may help identify certain changes to traditional credit reports, but it does not necessarily monitor every type of consumer report or financial activity.
Continue reviewing:
- Bank and credit card statements
- Credit reports
- Specialty consumer reports
- Insurance notices
- Medical statements
- Utility and telecommunications accounts
- Tax correspondence
- Mail involving unfamiliar accounts
Account alerts can help notify you of purchases, transfers, password changes, new payees or changes to contact information.
Signs That Information May Have Been Misused
Possible warning signs include:
- An unfamiliar account appears on a credit report.
- You receive a bill for a service you did not use.
- A bank account application is unexpectedly denied.
- You receive mail addressed to an unfamiliar person.
- Your password or contact information changes without authorization.
- You receive a verification code you did not request.
- A tax return is rejected because one was already filed.
- You receive collection notices for an unfamiliar debt.
- Your insurance statement lists unfamiliar medical treatment.
- Your mobile phone suddenly loses service because the number was transferred.
One unusual event does not always prove identity theft, but it should be investigated promptly.
What to Do If You Find Fraud
Contact the business involved
Report the unauthorized account or transaction and ask what documentation is required to dispute it.
Secure affected accounts
Change passwords, replace compromised payment cards and review account-recovery information.
Document everything
Save letters, screenshots, account statements, confirmation numbers, dates, names and notes from each conversation.
Review related consumer reports
Check traditional and relevant specialty reports for additional unfamiliar activity.
Use official reporting resources
Follow current guidance from appropriate government agencies, financial institutions, consumer reporting agencies and law enforcement when necessary.
Data Breach Action Checklist
- Read and save the official breach notice.
- Determine exactly what information may have been exposed.
- Verify the notice through the organization's official website.
- Change exposed or reused passwords.
- Enable multi-factor authentication.
- Review bank, credit card and investment accounts.
- Freeze Experian, Equifax and TransUnion when appropriate.
- Review relevant specialty consumer reports.
- Consider available freezes with specialty agencies.
- Set transaction and account-change alerts.
- Watch for phishing calls, emails and text messages.
- Save confirmation numbers and freeze-management information.
- Continue monitoring important accounts and correspondence.
How Long Should You Remain Alert?
There is no single expiration date for data-breach risk.
A stolen payment card can usually be replaced. A Social Security number, date of birth or identity profile may remain useful to a criminal for much longer.
Continue practicing strong account security, reviewing important reports and protecting sensitive information even after any complimentary monitoring offered by the breached organization ends.
Frequently Asked Questions
Does a data breach mean my identity has already been stolen?
No. A breach means information may have been accessed or exposed. Identity theft occurs when someone actually uses another person's information to commit fraud or impersonate them.
Should I freeze my credit after every data breach?
The appropriate response depends on the information involved. A breach involving a Social Security number or other sensitive identity information generally presents a different risk than one involving only an email address.
Should I freeze reports beyond the Big Three?
Some consumers choose to review or freeze specialty consumer reports in addition to Experian, Equifax and TransUnion. Availability and procedures vary by agency.
Will a security freeze stop all identity theft?
No. A freeze can restrict access to a consumer report, but it does not prevent every form of fraud, account takeover, tax identity theft, medical identity theft or misuse of existing accounts.
Does a credit freeze affect my existing credit cards?
A freeze generally restricts access to a credit report for new applications. It does not prevent you from using existing credit cards or other established accounts.
Should I accept free credit monitoring offered after a breach?
Complimentary monitoring may be useful, but consumers should read the terms, understand what is monitored and recognize that monitoring may not cover every specialty report or type of fraud.
How long should I keep the breach notice?
Keep the notice and related documentation for your records, particularly when sensitive identifying information such as a Social Security number was involved.
Protect More Than the Big Three
FreezeReports.com helps consumers learn about specialty consumer reporting agencies and understand available procedures for requesting reports and placing security freezes.
Our document-preparation service can help prepare and mail requests to selected consumer reporting agencies for consumers who would rather not handle each request individually.