Checking a Data Breach: What the Notice Tells You and What to Do Next

A breach notice can tell you that an organization lost control of some personal information. It may not tell you whether someone has used your information, and there is no personal lookup tool among the resources covered here that can confirm your data was included. Start with the notice, check what it says, and use official sources to choose your next steps.

1. Look for a direct notice. Check letters, emails, or website statements from organizations that hold your information. Read the notice carefully, and contact the organization through a website or phone number you find independently if anything is unclear.
2. Separate a reported breach from a personal match. A breach database can show that an organization reported an incident. It does not necessarily establish that your specific information was involved.
3. Watch for signs of misuse. Unfamiliar accounts or activity can call for action even when you do not have a clear answer about which breach exposed the information.

1. If you find signs of identity theft, contact the affected financial institution's security or fraud department and ask about closing compromised accounts.
2. Report identity theft to local police and at IdentityTheft.gov. The site can provide an Identity Theft Report and a recovery plan for next steps.
3. Consider ways to restrict new credit access, such as a fraud alert or security freeze. Check official guidance for current details before relying on either option.

What a breach notice can, and cannot, tell you

A data breach means an organization that holds personal information lost control of some of it. That can happen through hacking, theft, or accidental exposure. A notice from the organization is a useful starting point because it connects the incident to a company or service you may recognize. Still, notices vary, and the sources reviewed here do not establish what every notice must include or how every organization handles follow-up questions. If the notice is unclear, contact the organization through its official site or a number you look up yourself.

The Federal Trade Commission has a data breach booklet that directs consumers to IdentityTheft.gov/databreach for next steps. The booklet was published in September 2016, so some details may be dated. Treat it as a starting point, not a substitute for current official information. Reporting requirements also vary by state. For state-specific information, check your state Attorney General's website.

The Privacy Rights Clearinghouse Data Breach Chronology can help you research reported incidents. It contains more than 75,000 reported breaches since 2005 and can be searched by organization, breach type, state, and data source. It is a research database, not a personal checker that confirms whether your information appeared in a particular breach. A listing can give context, but it cannot answer that personal question on its own.

What to do if you spot suspicious activity

A breach does not automatically mean that someone has misused your information. If you do see activity you do not recognize, the Consumer Financial Protection Bureau (CFPB) advises victims of identity theft to close compromised accounts, report the theft to local police and IdentityTheft.gov, and consider fraud alerts or security freezes. Contact the security or fraud department of the financial institution connected to the affected account. Acting promptly can also help create a record of what happened.

IdentityTheft.gov can produce an Identity Theft Report and a recovery plan that walks through steps for your situation. If you find an unfamiliar account or an error on a credit report, start by contacting the institution listed and consult the CFPB's official information on identity theft recovery. The sources covered here do not explain the full process for disputing every kind of fraudulent account or report error, so avoid assuming one notice or phone call resolves every issue.

How a security freeze works

A security freeze restricts prospective creditors from accessing your credit file. That generally stops new credit from being opened in your name while the freeze is in place. Federal law gives you the right to place a freeze for free at each of the three nationwide credit reporting companies, but you must contact each company separately. You can still request and review your own credit file while a freeze is active.

A freeze does not block every kind of access. Creditors for accounts you already hold, certain government entities such as child support agencies, and companies you hired to monitor your file may still see your information. Federal rules requiring free freezes also do not cover requests for employment, tenant screening, or insurance purposes. The available sources do not confirm how long it takes to place or lift a freeze, so check with each credit reporting company about timing.

You can request a free credit report from each nationwide credit reporting company once a week. Reviewing reports can help you look for accounts or inquiries you do not recognize. The CFPB explains what a credit freeze does and what it does not block.

Compare paid monitoring with free options

Credit monitoring services charge a fee, and prices vary. Some cost more than $15 a month. Most alert you after information has been stolen or used, rather than preventing the theft. That distinction matters when weighing a paid service: an alert can provide information, but it is not a guarantee that identity theft will be prevented or that a credit score will change in a particular way.

Credit locks offered by credit reporting companies also carry a fee and are no more effective than security freezes, which are free. Before paying for monitoring or accepting an offer described as free, check what it actually monitors, what fees may apply, and how cancellation works. You can also check with a state Attorney General or local consumer protection agency to see whether complaints have been filed. The CFPB's guide to credit monitoring services discusses their limits and free alternatives.

Pause before responding to breach-related messages

Scammers may use news of a breach to pose as government agencies, law enforcement, or financial institutions. The FTC says it never threatens people, asks them to transfer money to protect it, or tells them to withdraw cash or buy gold to hand to someone. Treat those requests as scams. An unexpected message that claims your information was used to open accounts is not proof that the sender is legitimate.

Phishing emails, texts, and webpages can imitate familiar organizations while trying to collect passwords, Social Security numbers, or card numbers, and some may install malware. The Cybersecurity and Infrastructure Security Agency says more than 90 percent of successful cyberattacks start with a phishing email. Do not use an unexpected message's link or phone number to verify its claim. Instead, go directly to the organization's official website or use contact information you find independently. You can also begin at the FTC's breach resource and follow its guidance rather than sharing sensitive information with an unsolicited caller.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.