What To Do Immediately After a Data Breach (2026 Guide)

You Got the Email. Now What?

"We are writing to inform you that your personal information may have been involved in a security incident."

If you have an inbox, you have probably read some version of that sentence. In 2026 it is no longer a rare event — it is a Tuesday. Mega-breaches keep landing (insurers, hospitals, retailers, schools), and the data they leak is the raw fuel for identity theft, scams, and account takeovers.

The good news: the first 48 hours matter most, and almost everything that protects you is free. Here is exactly what to do, in order.

Step 1 — Confirm It's Real (Don't Click the Email)

Scammers love breach panic. A fake "breach notification" with a "secure your account here" button is one of the most effective phishing lures there is.

• Never click links in the notification email. Open a browser and type the company's address yourself.
• Verify the breach is real by searching the company name plus "data breach" in the news.
• Check whether your email or phone appears in known breaches at haveibeenpwned.com — it is free and run by a respected security researcher.

Step 2 — Change the Password (and Every Reuse of It)

Change the password on the breached account immediately. Then change it everywhere you reused that same password — this is how one breach becomes five.

• Use a unique, long password for every account. A password manager generates and stores them so you don't have to remember any.
• Turn on two-factor authentication (2FA) — ideally an authenticator app or a passkey, not SMS, which can be intercepted.

If the breach exposed passwords in plain text or weak hashes, assume the password is already public.

Step 3 — Freeze Your Credit (Free, and the Single Best Move)

If your Social Security number, date of birth, or financial data was exposed, a credit freeze is the most powerful thing you can do. It blocks anyone — including you — from opening new credit in your name until you lift it.

• It is completely free at all three US bureaus: Equifax, Experian, and TransUnion.
• It does not affect your credit score or existing accounts.
• Freeze all three. Unfreeze temporarily (also free) only when you apply for new credit.

A freeze is stronger than a fraud alert, because it stops new accounts by default rather than just flagging them.

Step 4 — Watch the Money

• Turn on transaction alerts in your banking and card apps so every charge pings your phone.
• Review statements for small "test" charges — fraudsters verify a stolen card with a tiny purchase before the big one.
• Consider a credit/identity monitoring service if sensitive data (SSN, medical, financial) leaked. Many breached companies offer it free for a year — take it, but set a calendar reminder for when it expires.

Step 5 — Lock Down the Exposed Channel

What you do next depends on what leaked:

• Email address → expect a wave of phishing and spam. Be ruthless about unverified links.
• Phone number → expect smishing (scam texts) and SIM-swap risk. Add a PIN to your mobile carrier account.
• Health or medical data → watch for medical identity theft; review insurance "explanation of benefits" statements for care you never received.
• Government ID / passport number → report it; in some cases you can request a replacement number.

Step 6 — Report It (It Actually Helps)

• In the US, file at IdentityTheft.gov — it generates a personalized recovery plan and an official affidavit.
• Report fraud to the FTC (ReportFraud.ftc.gov) and, for online crime, the FBI's IC3.gov.
• Reporting feeds the data that gets scam infrastructure taken down — non-reporting lets the same kit be reused on the next person.

What You Don't Need to Do

• Don't pay for "breach removal" services that cold-call you. That call is itself usually a scam.
• Don't ignore it because "it's just my email." Email is the master key to password resets everywhere.
• Don't panic-delete the account before you've secured the login and checked for fraudulent activity.

The 10-Minute Version

1. Don't click the email — verify independently.
2. Change the password + everywhere you reused it.
3. Turn on 2FA.
4. Freeze your credit at all three bureaus (free).
5. Turn on bank/card alerts.
6. Report at IdentityTheft.gov.

Breaches are now a permanent feature of digital life. You can't stop companies from losing your data — but a few free moves turn "my data was leaked" from a crisis into a checklist.