Got a Data Breach Notice? What to Do First, and What's Worth Paying For
This page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. Every step on this page that matters most is free, and we say so where it is.
A breach letter or email usually arrives weeks after the breach itself, and it tends to be vague: “some of your information may have been accessed.” You do not need to panic, and you do not need to buy anything today. Most of the protection that works is free. This page walks through what to do in the first hour, the first week, and then which paid tools are worth the money for some people and which are not.
Bottom line#
- Freeze your credit at all three bureaus. It is free, it does not affect your credit score, and it is the single strongest step against someone opening new accounts in your name (FTC).
- Change the password for the breached account, and anywhere you reused it. Turn on multi-factor authentication while you are there.
- If your Social Security number was exposed, get an IRS Identity Protection PIN. It blocks someone else from filing a tax return in your name (IRS).
- Worth paying for, for most people: a password manager, because password reuse is how one breach turns into five.
- Worth paying for, for some people: a data broker removal service, if your address and phone number keep showing up on people-search sites.
- Usually not worth paying for separately: credit monitoring, because the breached company often offers it free, and a freeze does more.
First: check the notice is real#
Breach news is a favorite hook for phishing. Before you click anything:
- Do not use links or phone numbers in the email. Go to the company’s website by typing the address yourself, or call the number on your card or statement.
- Look for the breach on the company’s own site or newsroom. Real breaches are usually announced there too.
- Be suspicious of urgency. “Act within 24 hours or lose coverage” is a pressure tactic, not how legitimate offers work.
If the notice offers free credit monitoring with an enrollment code, it is usually fine to enroll, but do it through the company’s site, not a link in an unexpected email.
The first hour: free steps that matter most#
Freeze your credit (all three bureaus)
A credit freeze stops lenders from pulling your credit report, which means a thief cannot easily open a new card or loan in your name. Under federal law since 2018, placing and lifting a freeze is free (FTC press release). It does not affect your credit score, and it stays in place until you lift it. You have to contact each of the three bureaus (Equifax, Experian and TransUnion) separately (FTC).
When you need to apply for credit later, you lift the freeze temporarily at the bureau the lender uses, then put it back.
A fraud alert is a lighter option: it asks lenders to verify your identity before opening credit. An initial alert is free and lasts one year, and you only need to contact one bureau, which notifies the other two (FTC). For most people a freeze is the stronger choice.
Change passwords and turn on MFA
Change the password on the breached account first. Then change it anywhere else you used the same or a similar password, starting with email and banking, because your email inbox is the key that resets everything else.
While you are in each account, turn on multi-factor authentication. An authenticator app or a passkey is stronger than a text-message code. Our explainer are passkeys better than passwords? covers why.
Watch the right accounts for the next few weeks
- Bank and card statements: look for small test charges, not only big ones.
- Email: watch for password-reset messages you did not request.
- Phone carrier: if your phone number and personal details were exposed, ask your carrier about a port-out PIN or account lock to make SIM swapping harder.
The first week: depends on what was exposed#
| What the notice says was exposed | What to do |
|---|---|
| Email and password | Change that password everywhere you reused it. Turn on MFA. Expect more phishing for a while. |
| Card number | Ask your card issuer for a new card number. Watch statements. |
| Bank account number | Call your bank. Ask about monitoring or a new account number. |
| Social Security number | Freeze your credit. Get an IRS IP PIN. Consider an extended watch on your credit reports. |
| Driver’s license or passport number | Check your state DMV’s guidance on reporting a compromised license. Watch for accounts opened in your name. |
| Medical or insurance information | Read your insurer’s explanation-of-benefits statements for services you did not receive. |
| Address, phone, date of birth | Expect targeted scam calls and texts. Consider data broker removal (below). |
Get an IRS Identity Protection PIN
If your Social Security number was involved, the IRS Identity Protection PIN is one of the most useful free tools you probably have not used. Anyone with an SSN or ITIN who can verify their identity can get one, and a new PIN is issued each year. The fastest way is through your IRS online account (IRS). With an IP PIN, a tax return filed in your name without it gets rejected.
If something has already gone wrong
If you see an account you did not open or a charge you did not make, go to IdentityTheft.gov. It builds a personal recovery plan and an official identity theft report you can give to banks and creditors. That report also lets you place an extended fraud alert, which lasts seven years (FTC).
What’s worth paying for#
Nothing below is required. These are the paid tools that genuinely reduce your risk after a breach, in rough order of value for most people.
1. A password manager (worth it for almost everyone)
The real damage from a breached password comes from reuse. A password manager generates a different strong password for every site, so the next breach exposes one account instead of ten. It also makes the “change every reused password” step above realistic in an afternoon instead of a weekend.
Good options:
- 1Password: polished apps and strong family sharing. Try 1Password →
- Keeper: strong admin and sharing controls if you also want it for a small team. Try Keeper Security →
- Bitwarden: a well-regarded free tier if budget is the main concern (bitwarden.com).
Free alternative: the password manager built into your browser or phone is far better than reusing passwords. Our password manager comparison goes deeper.
2. Data broker removal (worth it for some people)
After a breach, the scam calls and texts that follow are often built from people-search sites that list your address, phone number and relatives. A removal service files opt-out requests with those brokers for you and repeats them, because listings tend to come back.
This is worth paying for if you search your name and find your home address on several of these sites, or if you have a reason to keep your address private.
- Optery offers a free scan with exposure reports showing where your data appears, plus free do-it-yourself opt-out links. Paid plans file the removal requests for you, starting at $3.99 per month according to Optery (Optery). Remove your data with Optery →
Free alternative: start with the free scan and submit the opt-outs yourself. It works, it just takes time.
3. A private email address for sign-ups (nice to have)
Using a separate address, or an email alias per site, makes the next breach less useful to scammers and makes phishing easier to spot. Proton offers encrypted email and aliases. Try Proton Mail →
What’s usually not worth paying for#
- Standalone credit monitoring. It tells you after someone has opened an account. A free credit freeze prevents it. If the breached company offers monitoring for free, enrolling does no harm.
- “Dark web monitoring” sold on its own. Knowing your email appeared in a breach list is useful, but you can check that for free at Have I Been Pwned, and the response is the same: change the password and turn on MFA.
- Anything sold through the breach email itself, unless you have confirmed it is the company’s real offer.
FAQ#
Do I need to do anything if the notice says “no evidence of misuse”?
Yes, the free steps are still worth it. “No evidence of misuse” means the company has not seen it yet, not that the data is safe. Placing a credit freeze online takes a few minutes per bureau and costs nothing.
Will a credit freeze hurt my credit score?
No. A freeze does not affect your score (FTC). It only stops new lenders from seeing your report until you lift it.
Should I accept the free credit monitoring the company offers?
Usually yes, as long as you enroll through the company’s official website. It is free, and it adds a second set of eyes. Just do not treat it as a replacement for a freeze.
Is identity theft insurance worth it?
For most people, not as a separate purchase. It is often bundled into the monitoring that breached companies offer for free, and the expensive part of identity theft is usually time, not money. A freeze and good passwords do more to prevent the problem in the first place.
Sources
- FTC: Credit freezes and fraud alerts
- FTC: New federal law allows free credit freezes and yearlong fraud alerts (2018)
- IRS: Get an Identity Protection PIN
- IdentityTheft.gov: Recovery steps
- Optery: What is an exposure report
This page is general information, not legal or financial advice.