You Got a Data Breach Letter. Here Are the First Five Things to Do

A data breach notification letter rarely arrives at a convenient time. It shows up between bills and junk mail, written in dense corporate language, and it leaves most people with the same two questions: how bad is this, and what am I supposed to do now?

The good news is that receiving a letter does not mean your identity has already been stolen. It means a company that held your information lost control of it, and the law in most states requires them to tell you. What you do over the next few days matters far more than what you do in the next few minutes.

First, keep the letter. It is the single most useful document you have. It names the company, the date of the breach, and usually the specific categories of information involved. If you later want a free case review, that letter answers most of the questions an attorney would otherwise have to chase down.

Second, read what was actually exposed. A leaked email address is a nuisance. An exposed Social Security number, driver's license, or financial account is a different level of risk and calls for stronger steps like a credit freeze. Match your response to the data, not to your anxiety.

Third, place a fraud alert or a credit freeze with the three major bureaus. A freeze is free, reversible, and stops new accounts from being opened in your name. It is the most effective single action most people can take, and it takes about fifteen minutes.

Fourth, watch the accounts that matter rather than obsessively checking everything. Turn on transaction alerts for your bank and card accounts, and change passwords on anything that shared a password with the breached service.

Finally, take your time deciding whether you want someone to review your options. You generally have a window to act, and a rushed decision helps no one. If you would like us to look at your letter and explain in plain English what, if anything, you may be entitled to, that review is free and comes with no obligation.