Data Breach: What to Do, in Order

Exposure and misuse need different responses.

IdentityTheft.gov, the FTC’s recovery site, starts with one question: did someone use your information — to open an account, make a purchase, take out a loan, get a job, file taxes, or claim government benefits? If so, report identity theft there and follow the recovery plan it builds for you. If not, or if you do not know, the steps below are the protective ones.

It is free, and it stops new accounts in your name.

While a credit freeze is in place, nobody can open a new credit account in your name — including you. The FTC notes that placing and lifting a freeze costs nothing and does not affect your credit score, and that a freeze lasts until you lift it. Each bureau must be contacted separately: Experian (888-397-3742), TransUnion (888-909-8872), and Equifax (800-685-1111). When you apply for a loan, a card, an apartment, or a job that involves a credit check, ask which bureau the lender uses, lift the freeze at that bureau only, and put it back afterwards.

An alert asks lenders to check; a freeze stops them.

A fraud alert does not block access to your credit report. It tells businesses to verify your identity before they open new credit, and you can place one even with a freeze in place.

All three are free, according to the FTC.

Each kind of data has its own steps.

IdentityTheft.gov lists steps by type of information:

• Password or login: change the password, and the username if possible; change it everywhere else you reused it; turn on two-factor authentication.
• Debit or credit card: cancel and replace the card through the number on its back or on your statement, review transactions, and update automatic payments.
• Bank or investment account: tell the institution, close the account, and open a new one.
• Social Security number: review your work history in a my Social Security account at socialsecurity.gov/myaccount, consider locking the number through E-Verify at e-verify.gov/mye-verify, file your taxes early, and answer IRS letters right away.
• Driver’s license or passport: report it to your state motor vehicle office, or to the State Department at 1-877-487-2778.

A new Social Security number is rarely an option: the site says you generally need evidence that someone is already misusing yours.

It reports activity; a freeze prevents it.

If the company that lost your data offers free credit monitoring, IdentityTheft.gov says to accept it. Monitoring scans your credit reports and alerts you when something appears, such as a credit check, a new loan or card, or a late payment. That is detection after the fact; the freeze is what stops a new account from being opened at all. Keep reviewing your own reports as well: AnnualCreditReport.com provides them free, online, every week.

Breach news hands impostors a script.

Scammers pose as the government agencies and companies people expect to hear from — the FTC, Social Security, the IRS, Medicare, a utility, a tech company. IdentityTheft.gov’s advice: do not respond to unexpected calls, texts, or emails, do not click their links even when they look real, and reach the organization through a website or phone number you already trust, never the caller ID. The phishing guide shows the common stories.