First, check the notice itself
Breach notices are a gift to scammers. They are expected, they sound urgent, and they ask you to act. So treat the message as information, not as a set of links. The FTC's advice after a breach is direct: if you get an email or text from a company you do business with, do not click any links in it even if you think it might be real. Contact the company through a website you know is trustworthy, or look up its phone number yourself, and do not use the number the message gives you or the one on your caller ID.
The FTC's phishing page lists the signs of a fake: a generic greeting, a claim that your account is on hold or has a problem, a link to update payment details, a request to confirm personal or financial information. The FTC also notes that legitimate companies do not usually send a link to update payment information by email or text. The suspicious link guide shows how to read a web address before you open it. Report a phishing email by forwarding it to reportphishing@apwg.org, and a text by forwarding it to 7726.
What was exposed decides what you do
The FTC sorts its steps by the type of information. Find each type named in the notice:
| Exposed | The FTC's steps |
|---|---|
| Social Security number | Check, freeze and monitor your credit. Review your work history in a my Social Security account. File taxes early and answer IRS letters right away. |
| Password or login | Log in and change the password, and the username if you can. Turn on two-factor authentication. Change the same password anywhere else you used it. |
| Debit or credit card number | Call the bank or card company, using the number on the back of the card, to cancel it and get a new one. Watch your transactions. Update automatic payments. |
| Bank or investment account | Tell the bank or investment company, close the account and open a new one. Watch your transactions. Update automatic payments. |
| Driver's license | Report it to the nearest DMV branch. The state might flag the number or suggest a duplicate license. |
| Children's information | Request a free credit freeze for the child. Ask each credit bureau whether the child has a credit report. |
For a card or bank account, the FTC adds: if you find fraudulent charges or withdrawals, call the fraud department and get them removed. For a login on a financial site, or a site that stores your card, check for charges you do not recognize and for account changes such as a new address. If you cannot log in at all, contact the company and ask how to recover or shut down the account.
The step for almost every breach: check, freeze, monitor
The FTC puts one step ahead of all the others: check, freeze and monitor your credit. It matters most for a Social Security number, and the FTC points back to it for cards, bank accounts and driver's licenses too.
- Check. Get your free credit reports from AnnualCreditReport.com, where you can check online every week for free. Look for accounts or debts you do not recognize.
- Freeze. A credit freeze keeps people from getting into your report, so nobody can open a new credit account while it is in place. Placing it is free, and so is lifting it temporarily when you apply for credit yourself.
- Fraud alert. The lighter option: a free, one-year alert that you place by contacting one of the three bureaus. Businesses then have to verify your identity before opening an account.
- Monitor. Accept free credit monitoring if the company offers it, and keep checking your reports from time to time.
The credit freeze vs fraud alert guide compares the two in detail.
A checklist by the clock
The FTC lists what to do, not when. This is one way to order its steps by urgency: the things that stop someone using your data come first, the things that catch misuse later come after.
In the first hour
- Read the notice and find out what was exposed. Check it on the company's own website, typed in yourself, not through a link in the message.
- If a password was exposed, change it on that site now, and on every other site where you used the same one.
- If a card number was exposed, call the number on the back of the card and ask for a new card.
In the first day
- Turn on two-factor authentication for email first, then banking and any account that stores a card.
- If your Social Security number was exposed, freeze your credit. It is free to place and to lift temporarily.
- If a bank account number was exposed, ask the bank to close the account and open a new one.
- Accept free credit monitoring if the company offers it.
In the first week
- Get your free credit reports at AnnualCreditReport.com and look for accounts or inquiries you do not recognize.
- Update automatic payments with any new card or account number.
- For a Social Security number: check your work history at the SSA and consider locking the number through E-Verify.
- Report a driver's license number to the DMV if it was exposed.
- Keep checking card and bank statements, and credit reports from time to time after that.
New passwords that will not leak the same way
A breach turns a reused password into a key for every account that shares it. The FTC's first step for an exposed login is to change the password and to make it long; CISA's guidance is at least 16 characters, either a random string of mixed letters, numbers and symbols or a passphrase of 4 to 7 unrelated words, and a different password for each account. The password length guide covers NIST's rules and why length beats complexity.
The password generator creates random passwords in your browser, and the password strength checker shows which patterns make a password easy to guess. A password manager, which CISA describes as a program that generates, stores and fills in your passwords, means you only have to remember one strong password.
Then add a second factor. CISA's advice is to turn on multifactor authentication for every account or app that offers it, starting with email, banks and other important accounts. CISA's own example is a person whose hacked email account led to the takeover of his other accounts. Authenticator apps generate a new code every 30 seconds; the 2FA code generator shows how those codes come from a shared secret. Where a site offers passkeys, there is no password to leak at all; the passkeys guide explains how they work.
If the notice says passwords were hashed
A notice may say the passwords were stored "hashed" or "encrypted". A hash is a one-way fingerprint of the password, and the hash generator shows what one looks like: type a word and see its SHA-256 value. The same word always gives the same hash, which is the weakness. The OWASP password storage guide describes how hashes are cracked: guess a password, hash it, compare, using lists of passwords from other breaches, wordlists of common passwords or brute force. A strong password stored with modern hashing should be effectively impossible to crack, but a weak one is not safe, and you cannot see from outside how the company hashed it. Change the password anyway. The hash generator does not check whether a password or email appears in a breach and sends nothing anywhere; it only computes the hash on your device. The hashing vs encryption guide explains the difference between the two words in the notice.
If your data has already been used
The FTC's page starts with one question: did someone use your information, for example to open an account, make a purchase, apply for a loan, get a job, file taxes or get government benefits? If the answer is yes, the steps change from protection to recovery: report it at IdentityTheft.gov to get a recovery plan. The identity theft recovery guide walks through that plan from the first phone calls to fixing your credit report.
Frequently asked questions
I got a data breach email. Is it real?
It may be, and scammers copy real breach notices to get you to click. The FTC's advice is not to click links in an email or text from a company you do business with even if you think it is real, and to contact the company through a website you know or a phone number you look up yourself. Read the notice for what was exposed, then act through your own bookmarks.
Should I freeze my credit after a data breach?
If your Social Security number was part of it, yes. The FTC says a freeze keeps people from getting into your credit report, so nobody can open a new credit account while it is in place, and it is free to place and to lift temporarily. A free one-year fraud alert is the lighter option.
Do I need to change my password if it was stored hashed?
Yes. A hash is a one-way fingerprint, but OWASP explains that attackers crack hashes by hashing guesses from wordlists and earlier breaches and comparing, so weak passwords can still be recovered. The FTC's steps for an exposed login are the same either way: change the password, and change it anywhere else you used it.
Can I get a new Social Security number after a breach?
Usually not. The FTC says that in most cases you cannot get a new number without evidence that someone else is misusing it, and that a new number may not solve every problem because records still link you to the old one. A credit freeze and an E-Verify lock are the practical protections.
Can the hash generator tell me if my password was in a breach?
No. The hash generator only computes a hash of what you type, in your browser; it does not look up any breach database and sends nothing anywhere. Use it to understand what a notice means by hashed, then change the password.
Sources
- FTC, IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach (check, freeze and monitor credit; free credit freeze and free one-year fraud alert; free weekly credit reports; steps for Social Security numbers, logins, card numbers, bank accounts, driver's licenses and children's information; do not click links in messages, contact the company through a site or number you know)
- FTC Consumer Advice: How to recognize and avoid phishing scams (signs of a phishing message; contact the company using a phone number or website you know is real; report to reportphishing@apwg.org, SPAM 7726 and ReportFraud.ftc.gov)
- CISA: Use Strong Passwords (at least 16 characters; a passphrase of 4 to 7 unrelated words; a different password for each account; password managers)
- OWASP Password Storage Cheat Sheet (hashing is one-way; attackers crack hashes by hashing candidate passwords from earlier breaches, wordlists or brute force and comparing; strong passwords with modern hashing should be effectively impossible to crack)
- CISA: Turn On MFA (turn on multifactor authentication for every account that offers it, including email and banks; the example of a hacked email account leading to other accounts; authenticator apps make a new code every 30 seconds)