What to do after a data breach
If a company that has your Social Security number tells you it was breached, assume your details are out there. These steps close the doors that matter most, in order.
1. Freeze your credit at all three bureaus
This is the most important step. With a freeze, your stolen details can't be used to open new credit, because lenders can't pull your report. It's free and doesn't affect your score. See how to freeze your credit.
2. Check your credit reports
Look for accounts or inquiries you don't recognize. Each of the three bureaus lets you check your report once a week for free at AnnualCreditReport.com, the official site.
3. Consider a fraud alert
A fraud alert asks lenders to verify it's really you. An initial alert lasts one year. If your identity has actually been stolen, an extended alert lasts seven years and needs an identity theft report. It works alongside a freeze. See credit freeze vs. credit lock vs. fraud alert.
4. Protect your tax refund
Ask the IRS for an Identity Protection PIN. It stops someone else from filing a tax return with your Social Security number.
5. Secure your accounts
Change the password for the breached service and anywhere you reused it. Turn on two-step verification for email, banking, and bureau accounts.
6. If you find fraud, report it
Go to IdentityTheft.gov, the FTC's site, to report identity theft and get a recovery plan.
Keep the freeze on
Breaches happen every year. The simplest long-term habit is to keep your credit frozen and only thaw it when you apply for something.
Sources
Questions
What is the first thing to do after a data breach?
Freeze your credit at Equifax, Experian, and TransUnion. It stops your stolen details from being used to open new credit.
How can I check my credit reports for free?
Each bureau lets you check your report once a week for free at AnnualCreditReport.com.