I got a data breach notice

If you answered “Not sure” to “Did the notice come from a company you know, through a channel you trust?”

Don't click links or call numbers in the notice until you're sure it's real. Look up the company's official website or phone number yourself and confirm the breach.

Why: Fake breach notices are a common scam.

If you answered “Social Security number” to “What information was exposed (check the notice)?”

Freeze your credit with Equifax, Experian and TransUnion. It's free to place and lift, and it doesn't affect your credit score.

Why: A freeze stops anyone from opening new credit in your name.

If you answered “Username and password” to “What information was exposed (check the notice)?”

Change the password on the breached account and anywhere you used the same password. Turn on two-factor login.

Why: Stolen passwords are tried on other sites.

If you answered “Credit card or bank account number” to “What information was exposed (check the notice)?”

Call your bank or card issuer to cancel the card or account and get a new number. Check recent transactions.

Why: A new number makes the stolen one useless.

If you answered “Yes, or I see accounts I don't recognize” to “Has anyone already used your information?”

Go to IdentityTheft.gov to report the misuse and get a personal recovery plan.

Why: It creates an FTC identity theft report you can give to companies and credit bureaus.

Get your free credit reports at AnnualCreditReport.com and look for accounts or inquiries you don't recognize. You can check weekly for free.

Why: Early detection limits damage.

Accept free credit monitoring if the company offers it, but read the sign-up terms.

Why: It alerts you to new activity on your credit reports.

If you answered “Social Security number” to “What information was exposed (check the notice)?”

If your Social Security number was exposed, get an IRS Identity Protection PIN and check your Social Security work history at ssa.gov/myaccount.

Why: An IP PIN stops others from filing a tax return with your number.

If you answered “Driver's license, medical, or other ID” to “What information was exposed (check the notice)?”

For a driver's license, contact your state DMV; for medical or insurance information, contact your insurer or Medicare and watch your benefit statements.

Why: These agencies can flag your records.

If you'd rather not freeze, you can place a free one-year fraud alert by contacting any one bureau (it notifies the other two).

Why: Lenders must take steps to verify your identity first.

Keep checking your credit reports and statements every few months.

Why: Stolen data can be used months or years later.

If the company's breach caused you losses (fraud charges, costs), ask the company in writing to reimburse you and check whether a class action settlement covers you.

Why: Settlement notices come by mail or email; verify them on the court or administrator's official site.

You can report concerns about how a company protected your data to your state attorney general and the FTC.

Why: Many state AG offices collect breach notices and enforce state data-security laws.