Security

What to Do After a Data Breach

A breach notice is stressful, but the right steps in the right order limit the damage. What you do depends on what was taken, so start there.

Last updated October 23, 2026 · By Harbor Privacy

1. Confirm What Was Exposed

Read the notice for the data types involved: email and password, payment card, Social Security number, health records, or only contact details. Scammers also send fake breach notices, so go to the company's real website instead of clicking links in the message. You can also check whether your email appears in known breaches.

2. Act on What Leaked

PasswordsChange the password on the breached account and on any account where you reused it. Use a unique password for each.

Two-factorTurn on two-factor authentication. See which method to choose.

Payment cardsAsk your bank to replace the card and review recent charges. Turn on transaction alerts.

Social Security numberFreeze your credit at all three bureaus. See how to freeze your credit.

Tax identityIn the US, you can request an IRS Identity Protection PIN to block fraudulent tax returns filed in your name.

3. Watch for Follow-On Attacks

Breached data fuels phishing. Expect messages that quote real details, such as your name or an old password, to sound convincing. Treat unexpected calls, texts, and emails with suspicion. See how to spot phishing.

If a phone number was exposed, read how to protect against SIM swaps.

4. Monitor for a While

Review bank and card statements weekly for several months.
Pull your free credit reports at annualcreditreport.com and look for accounts you do not recognize.
Free credit monitoring offered in the notice is fine to accept, but a freeze is the stronger protection.

5. Reduce Future Exposure

The less data companies hold, the less can leak. Delete accounts you no longer use, give each site its own email with email aliases, and remove your details from data broker sites.

Common Questions

How do I know if I was in a data breach?

Companies must usually notify affected people, and you can check your email address against public breach databases.

Should I freeze my credit after a breach?

If your Social Security number or other identity data was exposed, yes. A freeze is free and blocks new accounts opened in your name.

Do I need to pay for credit monitoring?

Usually not. A free credit freeze and free weekly checks of your reports cover most of the risk.

What if only my email address leaked?

Expect more spam and phishing. Keep your passwords unique and turn on two-factor authentication.

Are breach notices ever fake?

Yes. Verify through the company's official website or phone number, not through links or numbers in the message.

WANT THIS DONE FOR YOU?

Harbor Scan finds your name, address, and phone for sale on data broker sites and files the opt-outs for you. See where you are exposed.