Verify before responding

Reach the organisation through a known account portal or independently confirmed contact details. A message about a breach can itself be a phishing attempt. Save the original notice and record the incident dates, information types, and assistance offered. Avoid sending identity documents or payment to an unfamiliar address simply because the message uses an organisation’s logo.

Match protection to the information

An exposed password calls for account security action, including changing reused passwords and enabling stronger authentication where available. Exposure of financial or identity information raises different concerns. FTC guidance recommends checking relevant credit records and considering protections against new-account fraud. Make a short list of affected services rather than trying to change every personal record without a reason.

Understand a freeze and an alert

A credit freeze restricts access to your credit file and can make new-account identity theft harder. A fraud alert asks creditors to take additional identity-verification steps. FTC guidance explains that freezes are free and should be placed with each nationwide credit bureau. Neither tool fixes an existing fraudulent transaction or replaces monitoring your current bank and card accounts.

Document actual misuse separately

If you find an unfamiliar account or transaction, record the discovery date, institution, amount, and reference number. Report it promptly through the relevant institution’s process. Keep dispute submissions and replies together. The FTC’s identity-theft recovery service can help organise a report and next steps. Do not describe every exposed record as a confirmed financial loss when the evidence differs.

Keep follow-up secure and organised

Store recovery records where someone with access to a compromised email account cannot easily obtain them. Track each requested correction and whether it was completed. Preserve evidence of costs if you later seek advice about a claim, but do not assume a breach automatically creates a right to compensation. Laws, harm, and available remedies vary by jurisdiction and circumstances.

Keep this in mind

Your preparation list.

  • Verify the notice through a trusted channel.
  • Identify exactly which information was exposed.
  • Track account reports and credit protections.
  • Keep evidence of misuse and correction requests.

Reference points: Federal Trade Commission, What To Do After a Data Breach and Get a credit freeze to stop identity thieves. Reviewed September 30, 2026.

General information for U.S. readers. Local law and your circumstances determine the appropriate next step.