Data breach: am I affected, and what should I do?

A breach notice is unsettling, but most of the fixes are free and take an evening.

The answer in 2 lines. Every state has a data breach notification law, but who must be told, and when, varies by state. If you get a breach notice, check it on the company's official website, without using the links in the message. Find out exactly what was exposed, then act on it: change that password and any that match it, and turn on two-factor authentication. If your Social Security number was exposed, consider a free credit freeze. Then be extra suspicious of calls, texts and emails in the weeks after: scammers use real stolen details to sound believable.

The first 4 steps

Confirm the breach on the company's official website or by calling a number you already know. Don't click the links in the notice.
Find out what was exposed: name, address, phone, email, password, card number, bank account, driver's license, Social Security number. The FTC's IdentityTheft.gov/databreach page lets you pick each type of information and shows the steps for it.
Change the exposed password, and change it everywhere you used the same one.
Expect follow-up scams: fake bank fraud departments, fake customer service, fake government agencies that already know your name.

What to do based on what was exposed

What was exposed	The risk	What you do
Password	Someone logs in to that account, then tries the same password elsewhere	Change it everywhere you used it, and turn on two-factor authentication
Email and phone number	Targeted phishing and scam texts	Don't click. Check things yourself. Forward scam texts to 7726 (SPAM)
Card number	Charges you didn't make	Call the issuer, ask for a new card, check your statements
Bank account	Unauthorized withdrawals; a fake banker who quotes your real details	Watch your statements and tell your bank right away about anything you don't recognize
Social Security number, date of birth, driver's license	Identity theft: new credit, tax refunds or accounts in your name	Consider a free credit freeze or fraud alert, check your credit reports, and consider an IRS IP PIN

What not to do

Clicking the link in a message about the breach: go to the official site yourself.
Keeping a leaked password "because it's easy to remember."
Giving a code you got by text to anyone who says they're "stopping fraud" on your account.
Paying for a service when the free steps (fraud alert, credit freeze, free credit reports) cover the basics. If the breached company offers free credit monitoring, the FTC says to consider accepting it.

Free tools after a breach

Fraud alert: businesses must verify it's you before opening new credit in your name. It lasts one year and is free to renew. Contact any one of the three nationwide credit bureaus, and that bureau must tell the other two. Identity theft victims can get an extended alert that lasts seven years.
Credit freeze: blocks access to your credit report, so most new credit can't be opened in your name. It's free to place and to lift, doesn't affect your credit score, and stays until you remove it. You must contact each of the three bureaus separately. The FTC's page Is a credit freeze or fraud alert right for you? links to each one.
Credit reports: get yours free at the official site, AnnualCreditReport.com, and look for accounts you don't recognize.
IRS IP PIN: anyone with a Social Security number or ITIN who can verify their identity can get an Identity Protection PIN, which helps stop someone else from filing a tax return in your name. Request it from your IRS online account (how to get an IP PIN). It changes every year.
If someone has already used your identity: report it at IdentityTheft.gov and answer the questions to get a personal recovery plan.

Scams that follow a breach

A "fraud specialist" calls who knows your name, address and bank. Hang up and call the number on the back of your card. See Fake bank call scam: will my bank refund me?
A text or email uses your real details to get you to click. See How to spot a scam text message.
A fake message about the breach itself, with a link to "secure your account."
Report scams at ReportFraud.ftc.gov, and forward scam texts to 7726.

In your state

Breach notice rules come from state law, and they differ on deadlines and on what counts as personal information. The NCSL summary lists each state's law.
Some state attorneys general publish breach notices you can search, for example California (search by company name) and Washington. If a company handled your data badly, you can file a complaint with your state attorney general's consumer protection office.

Good to know

According to NCSL, all 50 states, plus D.C., Guam, Puerto Rico and the U.S. Virgin Islands, have breach notification laws.
A breach that exposed only your email or phone number is less serious than one that exposed your Social Security number, but it still means more scam messages.
The IRS says it will never call, email, text or message you on social media to ask for your IP PIN.

Marcus gets an email from his gym: a breach exposed members' names, emails and phone numbers. He checks the notice on the gym's website, which he types in himself, then changes his gym password and his email password, which was the same. A week later, a text using his first name offers a "refund." He doesn't click, forwards it to 7726 and deletes it.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on November 5, 2026, for the United States. Confidence: high for the steps, fraud alerts and credit freezes (FTC, IRS); medium for state rules, which vary and change. This guide describes common cases and is not legal advice.