What to do depends on what was taken. Start with the four steps below, then tick what was in the breach to see the rest.
First steps
1
Make sure the breach is real. Go to the company’s site or a news report yourself instead of following a link in an email about it: breach notices are a favourite phishing lure.
2
Change the password for that account, and for every other account where you used the same one. Make a new one →
3
Turn on two-factor authentication there, preferably a passkey or authenticator app rather than SMS. See what it supports →
4
Expect messages that mention the breach, your name or details from it. Knowing a real fact about you is how scammers sound legitimate.
Use a password manager so every site gets its own random password, and a leak at one site can’t open another.
Look at recent sign-ins and connected devices on important accounts, and sign out any you don’t recognise.
Government IDs and SSNs
This is what identity thieves need to open accounts, claim benefits or file tax returns in your name. Act on it the same day.
US Freeze your credit with Equifax, Experian and TransUnion. It’s free, and it stops new credit being opened in your name. Experian →
US Get an Identity Protection PIN from the IRS, so nobody else can file a tax return with your SSN. IRS IP PIN →
US If someone has already used it, report it and get a recovery plan. IdentityTheft.gov →
If a passport or licence number leaked along with a scan of the document, ask the issuer whether you can replace it.
Payment cards
Full card numbers get sold and used quickly. Partial numbers (the last four digits) are mostly used to make scam calls sound genuine.
Ask your bank for a new card number. Most will do it free, and fraud on the old one is usually refunded.
Turn on transaction alerts in your banking app so you see every charge as it happens.
Update the card on subscriptions that used the old number, or they’ll fail.
Bank account numbers
Account and routing numbers can be used for unauthorised debits or to open accounts. Transaction details make scam calls very convincing.
Tell your bank. It can watch the account, block debits you haven’t approved, or change the account number.
US Freeze your ChexSystems report so nobody can open a new bank account in your name. ChexSystems →
Never move money to a “safe account” because someone called to say yours is at risk. Banks don’t ask for that.
Phone numbers
Expect scam texts and calls. A leaked number also gives SIM swappers a target, and with it, the codes texted for logins and resets.
Lock your number at your carrier so it can’t be moved to another SIM or network. SIM-swap protection →
Move important accounts off SMS codes to an authenticator app, passkey or security key. 2FA directory →
Don’t act on a call or text claiming to be your bank. Hang up and call the number on your card.
Security questions
The answers are often the same on every site that asks, and they can be used to reset a password without the old one.
Change the answers on every site that used the same question, starting with email and banking.
Treat answers like passwords: give random ones and keep them in your password manager. Your first pet’s name doesn’t have to be true.
Names, addresses, birth dates
On their own these rarely let anyone into an account, but they answer the identity checks that call centres and some sites use.
US Put a free credit freeze on with all three bureaus, so nobody can open credit in your name. Lift it for a day when you apply for something. Equifax →
US Check your credit reports for accounts you didn’t open. They’re free every week. AnnualCreditReport.com →
UK If you’re worried someone will apply for credit as you, Cifas Protective Registration makes lenders do extra checks. It’s a paid service and lasts two years. Cifas →
Set an account PIN or passphrase with your bank and mobile carrier, so your birth date and address alone aren’t enough to pass as you.
Private messages and photos
The main risk is extortion: someone threatens to send it to your family or employer unless you pay.
Don’t pay or reply to extortion emails. Many bluff, and paying marks you as someone who pays. Keep the messages and report them to the police.
If intimate images are being shared, StopNCII.org can stop them being posted on the platforms that work with it, without you uploading the images. StopNCII.org →
Change the password and sign out of all sessions on the breached service, and consider deleting the account.
Health and insurance data
Medical identity theft means someone gets treatment or files claims as you, and the wrong details can end up in your records.
Read every statement from your insurer or health provider and query treatment you didn’t have.
Ask your insurer whether you can get a new member ID number.
Email addresses
Your address goes on spam and phishing lists, often combined with other details from the same breach to make messages convincing.