What to do after a data breach: A 2026 step-by-step guide to protecting yourself

If a company tells you your personal information was exposed in a data breach, the most effective first moves are to figure out exactly what was taken, change any exposed passwords, and freeze your credit at all three nationwide credit bureaus. Federal agencies including the Federal Trade Commission and the Cybersecurity and Infrastructure Security Agency also recommend turning on multifactor authentication, checking your credit reports regularly and reporting any misuse at IdentityTheft.gov.

The stakes are rising. The FTC said in June 2026 that people reported losing about $16 billion to fraud in 2025, the highest total on record and roughly 25% more than the year before. This guide walks through what to do, step by step, based on official federal and credit bureau guidance.

What should I do first after a data breach?

Start by reading the breach notice carefully. The FTC's data breach guidance organizes its advice by the type of information exposed, because the right steps for a leaked password differ from those for a stolen Social Security number.

Look for answers to three questions:

• What data was involved? Names and emails are lower risk than Social Security numbers, bank account numbers or login credentials.
• Is the notice real? Scammers sometimes pose as breached companies. The FTC warns that AnnualCreditReport.com and the credit bureaus will not email you asking for Social Security or account numbers, so do not click links in unexpected messages. Go to the company's website directly instead.

What should I do if my Social Security number was exposed?

A stolen Social Security number is the most serious scenario because it can be used to open new accounts or file taxes in your name. FTC guidance points to four steps:

• Get your free credit reports and look for accounts or charges you do not recognize.
• Place a credit freeze, or at least a fraud alert, so it is harder for someone to open new credit in your name.
• File your taxes early, before a scammer can use your number to claim a refund.
• Enroll in the breached company's free credit monitoring, if offered.

The IRS also offers an Identity Protection PIN, a six-digit number that prevents anyone else from filing a federal return with your Social Security number or taxpayer ID. According to the IRS, anyone who can verify their identity can request one through an online IRS account, and parents can request one for dependents. A new PIN is issued each calendar year, and people who enroll online must retrieve it online each year.

Credit freeze vs. fraud alert: which should I choose?

Both tools are free, but they work differently. The FTC explains that a freeze blocks creditors from checking your report, while a fraud alert keeps your report accessible but tells businesses to verify your identity before opening an account.

A freeze does not affect your credit score, according to the FTC and TransUnion, and you can lift it temporarily when you apply for a loan, apartment or job that requires a credit check.

How do I freeze my credit at Equifax, Experian and TransUnion?

You must contact each bureau separately; a freeze at one does not carry over to the others, Experian notes. All three say placing and lifting a freeze is free.

• Equifax: Place a freeze online through a myEquifax account or by phone at (888) 298-0045. Equifax says it verifies callers with a one-time text code or questions based on their credit report.
• Experian: Freeze online through a free Experian account, where Experian says changes happen in real time, or call 1-888-397-3742. Mailed requests take up to three days after receipt.
• TransUnion: Use the free TransUnion Service Center online or call 800-916-8800. TransUnion says online and phone changes usually take effect almost immediately, while mailed requests can take up to three business days.

Can I freeze my child's credit?

Yes. Equifax and Experian say parents or guardians can freeze the file of a child under 16, and TransUnion offers a "protected consumer" freeze for minors and incapacitated adults. These requests generally must be made by mail with proof of identity and authority; TransUnion says it does not accept them online or by phone.

The FTC, in an August 2026 consumer alert, noted that children under 18 generally should not have a credit report at all, so finding one may be a sign of identity theft.

What if my password or bank card was exposed?

For a leaked login, the FTC recommends changing the password, and the username if possible, right away. If you reused that password anywhere else, change it on those accounts too. If you cannot log in, contact the company to recover or close the account.

For financial information, the FTC advice is direct:

• Bank account number: Contact your bank to close the account and open a new one.
• Credit or debit card: Ask your card issuer to cancel the card and send a replacement.
• Any site storing payment details: Review recent statements for charges you do not recognize.

How do I secure my accounts going forward?

CISA's Secure Our World campaign recommends four basic habits for individuals and families:

• Use strong passwords and a password manager so each account has a unique password.
• Turn on multifactor authentication, which requires something beyond a password, such as a text code or fingerprint.
• Recognize and report phishing, the deceptive emails and texts that often follow high-profile breaches.
• Install software updates promptly, since unpatched flaws can give criminals access to files or accounts.

How do I check my credit reports for free?

The FTC says AnnualCreditReport.com is the only site authorized to fill orders for the free reports guaranteed by federal law, and the bureaus have permanently extended free weekly access there. You can also call 1-877-322-8228.

Review all three reports, because each bureau may hold different information. Look for unfamiliar accounts, addresses or inquiries. If you find errors, the FTC says to contact both the credit bureau and the business that reported the information.

Data breach checklist

Where do I report identity theft?

The FTC calls IdentityTheft.gov the federal government's one-stop resource for reporting identity theft and getting a recovery plan. Other scams and fraud go to ReportFraud.ftc.gov.

Frequently asked questions

Does freezing my credit hurt my credit score?

No. The FTC and TransUnion both say a credit freeze does not affect your credit score. It only blocks new creditors from viewing your report until you lift it.

How much does a credit freeze cost?

Nothing. The FTC says freezes are free to place and lift, and Equifax, Experian and TransUnion each confirm there is no charge to freeze, temporarily lift or remove one.

Should I use a fraud alert or a credit freeze?

A freeze offers stronger protection because it blocks access to your report entirely, while a fraud alert only asks lenders to verify your identity. The FTC notes a basic fraud alert lasts one year and can be placed by contacting just one bureau.

Is free credit monitoring from the breached company worth it?

The FTC suggests enrolling in free monitoring when a company offers it after a Social Security number exposure. Monitoring alerts you to changes, but it does not stop new accounts the way a freeze does.

What is an IRS Identity Protection PIN?

It is a six-digit number from the IRS that must be included on your federal tax return, blocking anyone else from filing with your Social Security number. A new PIN is issued every calendar year.