Match the response to the data that was exposed
Match the response to the data
An email address alone creates different risk from a password, payment credential, government identifier or medical record. Avoid both panic and a one-size-fits-all checklist.
Treat reused passwords as exposed
Change the breached password everywhere it was reused, beginning with email, mobile, finance and cloud accounts. Use unique replacements and stronger multi-factor authentication where supported.
Evaluate credit controls
In the US, a credit freeze can help address new-credit risk when sensitive identity data is exposed. Other countries have different systems; use the relevant regulator's guidance.
Expect follow-on phishing
Breach details make convincing messages easier. Navigate to services directly and distrust calls that know personal facts but demand codes, money or remote access.
Let the exposed data choose the response
A notice naming only an email address does not call for the same controls as a leaked password or identity number.
Password or recovery data
Replace reused credentials and protect the email and phone accounts that reset other services.
Payment data
Ask the issuer what was exposed, monitor the account and follow its replacement or reporting advice.
Identity or health data
Use the relevant official identity, credit or medical-record process instead of relying only on monitoring.
Let the exposed field determine the control
A breach notice should name the organization, incident and data involved. Verify that information independently before acting on links or phone numbers in the notice.
- Password data
- Change the password on the affected service and every important account where it was reused. Protect the email and phone routes that can reset those accounts, then review sessions and recovery details.
- Payment data
- Ask the issuer what type of card or account detail was exposed and whether monitoring, replacement or another control is appropriate. Continue reviewing activity without assuming every exposed number will be used.
- Identity data
- Use the official identity-theft or credit-reporting controls available in your location. Keep the breach notice because it may explain later account, benefit, tax or credit activity.
- Health or account records
- Review the relevant provider or insurer records for unfamiliar entries and learn its correction process. Credit monitoring alone does not correct a clinical, benefits or service record.
Do not buy protection solely because an urgent message claims a breach. Confirm the notice on the organization's official site and understand any offered monitoring before providing more personal data.
Verify the notice before taking action
- Reach the company from its normal website, not the notice link.
- Write down the data types, affected dates and official assistance offered.
- Change reused credentials and protect the accounts with the greatest consequence first.
Record what the breach notice actually says
- Save the notice, sender, affected organization and independently verified notice page.
- List the data types the organization says were involved without assuming additional exposure.
- Record each protective action, enrollment deadline and confirmation from an official service.
Questions before trusting the warning
Is free monitoring the same as a credit freeze?
No. Monitoring can alert you to activity; a freeze restricts certain access to a credit file.
Should I replace every card named in a breach notice?
Ask the issuer. The right response depends on what was exposed and the issuer's risk controls.
Follow the signal if it points elsewhere
For exposed identity data, compare a credit freeze with a fraud alert before choosing a US credit-file control.
Unexpected reset prompts after a breach require the account-recovery attack checklist.
If the notice involves health or insurance records, review the medical identity-theft correction process.
If tax identifiers or filing accounts are involved, follow the tax identity-theft route for the relevant authority.
If the exposed data was used to create an account, follow the fraudulent new-account correction steps.
Processes, rights and deadlines depend on your location, provider and policy. Use the relevant official service for your jurisdiction.