The email usually has a bland subject line, something like “Notice of Data Security Incident,” and it is easy to file it with the spam until you read the second paragraph and realize your name, address and maybe your Social Security number are now in someone else’s hands. You are in large company: the Identity Theft Resource Center counted 3,158 data compromises in the US in 2024, and the number of breach notices sent to victims rose 211% from the year before, to more than 1.3 billion.
A breach notice is not the same thing as identity theft, and most people who receive one never suffer any fraud. What happens next depends largely on what you do in the first two days, so we start there, then look at why breaches happen and how to make the next one matter less.
The First 24 to 48 Hours After a Data Breach
Start with the notice itself, because the right reaction depends on what leaked. An email address and a password call for a few minutes of password changes. A Social Security number, a date of birth or a bank account number call for more, and the notice should say which of these were involved. If it is vague, the company’s breach page or its support line usually has the detail.
Next come the passwords. Change the one on the breached account first, then think honestly about where else you used the same password, because that is how a breach at a small online store turns into someone logging into your email. Criminals test leaked passwords on dozens of other sites within days, a practice known as credential stuffing, so this is the step not to postpone.
While you are in those accounts, turn on two-factor authentication, ideally through an authenticator app. With it in place, a stolen password alone is no longer enough to get in. Your email account comes first, since it can reset everything else, then your bank, then the rest.
Finally, go through your bank and card statements for the last couple of months, and switch on transaction alerts in your banking apps so that you hear about the next purchase as it happens. If card numbers were exposed, ask your bank for a new card, which most banks send without discussion. Many companies also offer free credit monitoring after a breach, and it is worth accepting, even if it is not a substitute for what follows.
Credit Freeze or Fraud Alert?
If your Social Security number or financial details were in the breach, this is the next decision, and people mix the two options up constantly.
| What Changes | Credit Freeze | Fraud Alert |
|---|---|---|
| What it does | Blocks new credit in your name | Asks lenders to verify your identity first |
| Cost | Free | Free |
| Duration | Until you lift it | One year, renewable |
| Where to set it | Separately with all three bureaus | With one bureau, which tells the other two |
| Effect on credit score | None | None |
The freeze is the stronger of the two, because it stops a new account from being opened at all, whereas a fraud alert depends on a lender actually making the extra check. The catch people miss is that a freeze has to be placed with Equifax, Experian and TransUnion one by one, on each bureau’s website or app, since a freeze at one does nothing at the other two. When you need credit yourself, you lift it online for a day or two.
If you only want something quick on the evening you get the notice, a fraud alert is a reasonable first move, and you can add the freeze over the weekend. In the long run, we would keep the freeze on permanently.
What Actually Causes Data Breaches
It helps to know how breaches happen, partly because some of the causes are on your side of the screen. The most common one is human error, and most of the time that means phishing, an email or a text that convinces an employee to type a password into a fake page or open a malicious file. Weak and reused passwords come right after, since a password leaked from one service will often open the door to another.
The other causes are technical. Companies run software they have not updated, which leaves known security holes open for months, and they misconfigure cloud storage so that databases end up readable by anyone who finds the address. You cannot fix those at a company you buy from, but you can decide how much you give them, which brings us to prevention.
Lowering the Odds of Next Time
The neat thing about the causes above is that each has a matching fix. Against phishing, two-factor authentication is the best protection, because a password typed into a fake page is useless without the second factor. Against weak and reused passwords, a password manager does the work, generating a different long password for every site so that one leak stays one leak. Against unpatched software, the answer on your own devices is simply to accept updates when they arrive, on your phone, your computer and your router.
The last cause, companies storing your data carelessly, is the one where your only lever is giving out less of it. That means skipping the optional fields on forms, using a secondary email address for shopping, keeping your birth date and your phone number off public social media profiles, and, less obviously, getting your details out of the hands of data brokers.
Why Data Brokers Make a Breach Worse
A breach rarely contains everything about you. One leak may hold your email and a password, another your name and address, a third your date of birth. The danger comes from combining them, and data brokers make that easy, since they sell profiles that fill in exactly the gaps a breach leaves: every address you have had, your phone numbers, your relatives and your age. With both together, a fraudster can write a phishing email that mentions your street and your bank, or answer the security questions of an account in your name.
You cannot take your data back from a company that was breached, but you can ask brokers to delete theirs. It is possible to do by hand, broker by broker, as our guide to removing your personal information from the internet explains, though there are hundreds of them and most put your details back after a few months.
This is the part we would leave to a removal service, and the one we recommend, at the top of our ranking of the best data removal services, is Incogni. You enter your name and address, add up to three email addresses, home addresses and phone numbers, and sign an authorization form. Incogni then sends deletion requests to more than 420 data brokers, including the private-database brokers that hold financial information you could not check yourself, and, according to a limited assurance report by Deloitte, it repeats them at least every 60 days for people-search sites and every 90 days for the others.
On our own profile, over almost four months, it sent 107 requests to 44 brokers, closed 102 of them and got us onto 17 suppression lists, meaning those brokers should not rebuild the file. The Standard plan costs $95.88 per year, or $7.99 a month, and every plan has a 30-day money-back guarantee. Our Incogni review goes through the full test.
Remove Your Data From Brokers With Incogni
For US residents, Incogni also sells a plan called Protect, at $248.88 per year, or $20.74 a month, which answers two of the questions people ask most after a breach. To the first, how to know whether your data has leaked again, it responds with dark web monitoring that alerts you when your email, Social Security number, phone number or card numbers show up, along with credit monitoring. To the second, what happens if a breach does turn into identity theft, it responds with an identity restoration case manager and up to $1 million in identity theft insurance, except for residents of New York and Washington. Everything in the Unlimited plan is included.
Your Legal Rights and What Compensation Looks Like
Large breaches are usually followed by a class action, and if you are part of the affected group you will generally receive a notice inviting you to file a claim. Joining costs nothing. The payouts, however, are modest unless you can show a loss. People without documented harm often receive a fixed amount or a share of a fund that ends up between a few dollars and a hundred or so, while those with receipts for fraud losses or time spent can claim much more. In the AT&T settlement, for instance, documented losses could be reimbursed up to $7,500.
Some state laws add their own remedies. California’s privacy law, for example, sets statutory damages of $100 to $750 per incident for certain breaches caused by poor security, without having to prove a loss. Suing on your own rarely makes sense for an ordinary breach, but keeping a folder with the notice, your statements and a note of the hours spent dealing with it costs nothing and is what a claim will ask for. If fraud has already happened, report it at IdentityTheft.gov, which builds a recovery plan and the letters you need.
How Do You Know If You Were Affected?
The breach notice is the usual way, since companies are required to send one, but notices arrive late and some go to old addresses. You can check for yourself by entering your email address on Have I Been Pwned, which lists the known breaches that included it. The password managers built into Chrome and the iPhone (you can also get the one from NordVPN or ExpressVPN) also warn you when a saved password appears in a leak, and dark web monitoring services do the same for your Social Security number and card numbers.
If the leak was only your email address, the main risk is phishing, since full identity theft usually requires more, such as your Social Security number, your date of birth and your address. Securing your accounts takes a day or two. If a breach does turn into identity theft, the cleanup can take months, which is the best argument for the steps in the first section.
Start Reducing Your Exposure With Incogni
FAQ
What Is the Most Appropriate Action to Take After a Data Breach?
Find out exactly which data was exposed, then change the password of the affected account and of every account that uses the same one, and turn on two-factor authentication. If your Social Security number or financial details were included, freeze your credit with Equifax, Experian and TransUnion.
What Is the Leading Cause of a Data Breach?
Human error, most often a successful phishing message or a weak or reused password. Unpatched software and badly configured cloud storage account for many of the remaining cases.
How Do I Know If My Information Was in a Data Breach?
Companies have to send a breach notice by email or letter. You can also enter your email address on Have I Been Pwned, check the password alerts in your browser or phone, and use a dark web monitoring service.
Can Someone Steal Your Identity With Just an Email Address?
Rarely. An email address alone mostly exposes you to phishing and spam. Opening credit in your name usually requires more, such as your Social Security number, your date of birth and your address.
How Long Does It Take to Recover From a Data Breach?
Securing your accounts takes a day or two. If the breach leads to identity theft, cleaning up the fraudulent accounts and correcting your credit reports can take several months.
Is It Worth Suing Over a Data Breach?
Joining a class action costs nothing and takes a claim form, but payouts are small unless you can document losses. In most cases, keeping receipts and records of time spent is more useful than filing your own lawsuit.