Gadget Daily News

Search
AI & Security Data breaches Checked October 2026

Got a data breach notice letter? What to do next

How to check the letter is real, what to do for each kind of exposed data, how to freeze your credit at all three bureaus, and whether the free monitoring is worth taking.

By Gadget Daily News · Published

Question: A company mailed me a letter saying my data was stolen. What do I actually do?
Answer: Don't panic, and don't call any number in the letter until you've checked it's real. A breach notice means your information was exposed, not that anyone has used it. Find the line that says what was taken, then follow the FTC's steps for that data type: a new card if it was a card number, new passwords if it was a login, and a free credit freeze at all three bureaus if your Social Security number was in it.

What the letter means, and how to check it’s real

The letter exists because the law makes the company send it. California passed the first breach-notice law in 2002, and Alabama became the last of the 50 states to pass one in 2018 (IAPP). Each state’s law sets its own rules, so letters vary. Expect a description of what happened, which of your details were involved and what the company is offering you.

Scammers copy these letters, so check before you act. Be wary of any letter, email or call that asks you to read out your full Social Security number or card number. IdentityTheft.gov’s rule applies here: don’t use the phone number or link in a message you weren’t expecting. Look the company up yourself, or use the number on a statement or card you already have.

California also publishes a searchable list of breach notices. The state requires any organization that notifies more than 500 Californians to send the Attorney General a sample copy, and the AG posts them online, with entries dated as recently as October 19, 2026. If the company that wrote to you is on that list, compare your letter with the posted sample. You can use the list even if you don’t live in California, though smaller breaches won’t appear on it.

One detail that confuses people: the sender isn’t always the company that was hacked. The California AG notes that a bank may write to you about a card number stolen from a store where you shopped.

Decode your letter by what was exposed

What you do depends on which details were taken. The table below follows the FTC’s IdentityTheft.gov steps for lost or exposed information, as of October 2026. Do every row that matches your letter.

What was exposed What a thief could try What to do
Email or username and password Sign in, buy things, send spam as you Change that password and anywhere you reused it. Turn on two-factor authentication
Credit or debit card number Make purchases Call the number on the back of the card, cancel it and get a new one. Update autopay
Bank or investment account number Withdraw money Tell the bank, close the account and open a new one
Social Security number Open credit, file taxes, get a job Freeze your credit at all three bureaus, check your reports, see the SSN section below
Driver’s license number Pose as you with fake ID Report it to your state DMV, which may flag the number or suggest you apply for a duplicate
Passport number Pose as you Report it to the State Department at travel.state.gov or 1-877-487-2778
Medicare, Medicaid or health insurance ID Get medical care in your name Call the insurer (Medicare: 1-800-633-4227) and ask for a new card if needed
Child’s details Open accounts in the child’s name Request a free freeze for children under 16 at each bureau

If only your name, email address or phone number leaked, there’s nothing to cancel. Expect more phishing, though. Scammers who know which company lost your data can write messages that look like they come from it. Our guide to what happens if you click a link in a scam text covers what to do if one gets through.

Freeze your credit at all three bureaus

A credit freeze is the strongest free step. While it’s on, nobody can open new credit in your name, you included, and it doesn’t affect your credit score (FTC, August 2025). It’s free to place and free to lift, and it lasts until you remove it. Federal law has made freezes free nationwide since September 21, 2018.

You have to contact each bureau separately. These are the contacts IdentityTheft.gov lists, as of October 2026:

Bureau Online Phone
Equifax equifax.com/personal/credit-report-services 800-685-1111
Experian experian.com/help 888-397-3742
TransUnion transunion.com/credit-help 888-909-8872

Equifax’s and Experian’s own freeze pages also say freezing and unfreezing is free (October 2026). A freeze requested online or by phone has to be in place within one business day. When you need credit, a lift requested the same way must happen within one hour (FTC). The FTC suggests asking the lender which bureau it uses and lifting the freeze at that one only.

Two things to watch. Bureaus also sell “locks”, which work in a similar way but may carry monthly fees. The freeze is the free one guaranteed by federal law, so ask for a freeze. And if you’d rather not freeze, you can place a free fraud alert by contacting just one bureau, which passes it to the other two. An alert lasts a year and makes lenders verify it’s you, but it doesn’t stop them seeing your report.

Should you take the free credit monitoring?

Yes, take it. IdentityTheft.gov tells people to accept free credit monitoring when the breached company offers it. Just don’t treat it as protection on its own. Monitoring tells you after something lands on your credit report. A freeze stops the new account from opening in the first place.

The FTC is specific about the gaps. Monitoring usually alerts you to a credit check, a new loan or card, a late payment report or a change to your personal details. It won’t alert you when someone withdraws money from your bank account, or when someone files a tax return with your Social Security number to steal your refund.

So, for example, if your SSN was exposed, the sensible combination is the free monitoring plus a freeze at all three bureaus. Before you enroll, note the enrollment deadline and code in the letter. If the sign-up asks for a payment card, find out what happens when the free period ends.

You can watch your reports yourself too. All three bureaus have permanently extended free weekly reports at AnnualCreditReport.com, the only site authorized for the free reports you’re entitled to by law (FTC, June 2026).

Extra steps if your Social Security number was exposed

An exposed SSN needs more than a freeze, because some misuse never shows up on a credit report. IdentityTheft.gov lists these steps, as of October 2026:

  • Create a my Social Security account at ssa.gov/myaccount and check your work history for jobs you didn’t do.
  • Consider locking your SSN for employment checks with E-Verify’s Self Lock at e-verify.gov/mye-verify. Employers that use E-Verify then need more information from anyone trying to use your number.
  • File your taxes early, before a scammer can, and answer any IRS letter right away.

The IRS also offers an Identity Protection PIN. It’s a six-digit number, known only to you and the IRS, that stops anyone else filing a return with your SSN. Anyone with an SSN or ITIN who can verify their identity can get one. The fastest route is your IRS online account, and the PIN changes every calendar year (IRS, updated August 2026). The IRS will never call, email or text to ask for it.

Don’t expect a new Social Security number. IdentityTheft.gov says you usually can’t get one without evidence that someone is already misusing yours.

Signs someone is using your information

Exposure doesn’t mean misuse will follow, but keep checking for these signs over the coming months. The FTC lists them: bills you expected that stop arriving, charges you didn’t make, bank withdrawals you don’t recognize, and accounts on your credit report you didn’t open.

If you see any of those, go to IdentityTheft.gov and report it. You’ll get a personal recovery plan, pre-filled letters for creditors and bureaus, and access to an extended fraud alert that lasts seven years. If the letter mentioned a hacked login, it’s worth checking your devices too: see how to check a laptop for a keylogger. If passwords were in the breach, passkeys remove the reused-password problem on sites that support them.

Watch for the follow-up scam as well. Someone may contact you claiming to be from the breached company or a settlement administrator and ask for a “verification code”. Never read a code to anyone who contacts you, which is the same trick behind the Google Voice code scam.

What to do next

  1. Check the letter is real: look the company up yourself, and compare it with the California AG’s posted samples if it’s listed there.
  2. Find the line listing what was exposed and work through the matching rows in the table above.
  3. Freeze your credit at Equifax, Experian and TransUnion. All three are free, and freezes placed online or by phone take effect within one business day.
  4. Accept the free monitoring, then pull your free weekly reports at AnnualCreditReport.com.
  5. If your SSN was exposed, get an IRS Identity Protection PIN and check your Social Security work history.

Sources

More from Gadget Daily News