Data Breach: What to Do If Your Personal Information Leaks

You got the email. Or the push notification. Or you read the headline: your name, email, maybe your Social Security number, sitting in a database that now belongs to criminals.

Most people do two things: change one password, then forget about it. That is not enough. After breaches like Oracle Health’s 20 million exposed records, “nothing has happened yet” is not a plan. The steps below are drawn from official FTC and IRS guidance, in the order that matters. Do the first three today.

This guide covers the US system: the FTC, the three credit bureaus, and federal protections.

Step 1: Find out what actually leaked

Not all breaches are equal. An email address leak means spam. A Social Security number leak means someone can open credit cards in your name. Your response should match the exposure.

Start with Have I Been Pwned, the free breach-check service run by security researcher Troy Hunt. Enter your email address and it tells you which known breaches include it, and what data each one exposed. Then read the company’s breach notice itself. Most state breach-notification laws require it to say what was taken (there is no single federal law for this outside specific sectors like health care).

Write down the list. You will need it for the steps below.

Step 2: Change passwords, enable two-factor

Change the password on the breached service first. Then change it everywhere you reused that password, and be honest with yourself about how many places that is. Attackers run stolen passwords against banks, email providers, and shopping sites automatically. This is called credential stuffing, and it works because password reuse is that common.

Turn on two-factor authentication (2FA) on your email, bank, and the breached service at minimum. An authenticator app beats SMS codes, but SMS beats nothing.

If you are still reusing passwords across sites in 2026, this is the breach that should end that habit. A password manager is the only realistic fix.

Step 3: Freeze your credit (the step that actually matters)

A credit freeze blocks anyone (including you, temporarily) from opening new credit in your name, because lenders cannot pull your credit report. For identity theft, which is the real danger after an SSN leak, this is the strongest protection available, stronger than monitoring or alerts.

Freezes are free under federal law, and you must place one with each of the three bureaus separately. Freezing one does not freeze the others:

• Equifax: equifax.com/personal/credit-report-services or 1-800-685-1111
• Experian: experian.com/help or 1-888-397-3742
• TransUnion: transunion.com/credit-help or 1-888-909-8872

If your children’s data was exposed, you can request a free credit freeze for a child under 16. The process differs from an adult freeze, and each bureau publishes its own steps for minors.

The one real downside: when you apply for credit, a loan, or sometimes an apartment, you have to temporarily lift the freeze. Ask the lender which bureau they will check and lift only that one. That turns a three-bureau chore into a single one. By law, online and phone lift requests must be processed within one hour. That inconvenience is the entire cost, and it is worth it.

A freeze does not affect your credit score, and it does not stop fraud on accounts you already have. Keep monitoring those separately.

Step 4: Consider a fraud alert

A fraud alert tells lenders to verify your identity before opening new accounts. It is weaker than a freeze but easier: you only contact one bureau, and it notifies the other two. The initial alert lasts one year.

Placing even the initial alert entitles you to a free credit report from each of the three bureaus, which flows directly into the next step. If you have already confirmed identity theft (not just a breach), you can get an extended seven-year alert with a police report or FTC Identity Theft Report. The extended alert also gets your name removed from prescreened credit and insurance offer lists for five years. Our take, not the FTC’s: freeze first and treat the alert as a complement, not a substitute. The FTC presents both as options and says the right choice depends on your situation. Details are on the FTC’s freezes and fraud alerts page.

Step 5: Pull your credit reports

Order your free reports from AnnualCreditReport.com, the only federally authorized source, and read them line by line. The three bureaus have permanently extended free weekly reports, so “check once a year” is outdated advice. You are looking for accounts, inquiries, or addresses you do not recognize. One unfamiliar credit inquiry is often the first visible sign that someone is using your identity.

All three reports are free every week, so during a heavy monitoring period just check all three weekly. Stolen data gets used on the thief’s schedule, not yours.

Step 6: Report it at IdentityTheft.gov

If your Social Security number was exposed, file a report at IdentityTheft.gov, the FTC’s identity theft site. It generates a personal recovery plan and an Identity Theft Report, a sworn statement you can use with banks, lenders, and the bureaus. If the breach notice offers free credit monitoring or identity theft insurance, take it, but skim the terms first. Some settlement offers attach claim-filing requirements or arbitration clauses.

Step 7: Block tax refund fraud with an IRS Identity Protection PIN

Tax refund fraud is one of the most common real-world uses of a stolen Social Security number: someone files a return in your name and takes the refund. The IRS lets any taxpayer with an SSN or ITIN who can verify their identity opt in to a free six-digit Identity Protection PIN at irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin. Without your current-year PIN, a fraudulent return filed with your SSN gets rejected. You get a new PIN each year.

The catch the IRS buries in the fine print: if you opt in online, no CP01A notice is mailed to you. You must retrieve your PIN from your IRS online account each year, and it is only visible from mid-January through mid-November. Miss that window and you will have to go through the IRS’s reissue process instead.

Parents and legal guardians can also request IP PINs for dependents. And note the IRS’s own rule, which ties directly into the next step: the IRS will never call, email, or text asking for your IP PIN. Any message that does is a scam.

Step 8: Expect targeted scams

This is the step people miss. After a breach, criminals do not just use your data. They impersonate the breached company. Expect phishing emails, texts, and calls that reference the real breach to sound legitimate. “We need to verify your account after the incident” is the oldest trick in this playbook, and it works best in the weeks right after a public breach.

Rule: never click links in breach-related messages. Go to the company’s site or app directly. We covered exactly this pattern in our ASOS breach breakdown (attackers pushed a fake “ASOS HACKED” notification to users’ phones) and in the Oracle Health breach, where medical data raised the stakes further.

What not to do

Do not pay for identity theft protection in a panic on day one. The free steps above (freeze, reports, FTC filing) cover the fundamentals, and many breach notices include free monitoring anyway. Do not ignore the breach notice because “nothing has happened yet.” And do not assume a strong password alone fixes an SSN exposure, because it does not.

Frequently asked questions

Should I freeze my credit after every breach?

If your Social Security number was exposed, yes. No hesitation. If only your email leaked, a freeze is overkill; a password change and 2FA are enough.

Will a credit freeze hurt my credit score?

No. A freeze only restricts access to your credit report. It does not change your score, close accounts, or appear as a negative mark. Lifting it temporarily for a legitimate application is free and takes minutes.

How long does a fraud alert last?

The initial fraud alert lasts one year and renews if you ask. An extended alert lasts seven years but requires proof of identity theft, such as an FTC Identity Theft Report or police report.

Sources

• Federal Trade Commission: what to do after a data breach and personal recovery plans (IdentityTheft.gov)
• FTC: credit freezes and fraud alerts
• IRS: Identity Protection PIN opt-in program (irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin)
• Have I Been Pwned breach search