Got a Data Breach Notice? What to Do Next (FTC Video Guide)

A letter or email says a company you use had a data breach and your information was exposed. It’s unsettling, but most breaches don’t lead to identity theft, especially if you take a few steps. This FTC video explains where to start. Our guide breaks the steps down by what was exposed.

From the Federal Trade Commission (FTC) · Part of our Online Safety Video Library

What the video shows

The video’s first advice is to take a deep breath. It then points to IdentityTheft.gov’s data breach page for specific steps based on what was exposed.

For example, if your Social Security number was exposed, it suggests checking your free credit reports for accounts you don’t recognize and taking advantage of any free credit monitoring the company offers. It also mentions placing a credit freeze or fraud alert to make it harder for a thief to open new accounts in your name.

Key takeaways

• A breach notice is not a reason to panic, but it is a reason to act.
• What you should do depends on what was exposed: passwords, card numbers, or Social Security numbers.
• A credit freeze is free and is one of the strongest protections against new accounts in your name.
• Accept free monitoring offered by the company, but don’t pay a stranger for ‘protection.’
• Expect follow-up scam emails and calls that mention the breach.

Steps by what was exposed

1. First, confirm the notice is real. Go to the company’s website or call a number you trust; don’t click links in the notice.
2. Password exposed: change it on that site and anywhere you reused it, and turn on two-step sign-in.
3. Credit or debit card exposed: watch your statements and ask your bank for a new card number.
4. Social Security number exposed: freeze your credit at all three bureaus (Equifax, Experian, and TransUnion) and check your credit reports free at AnnualCreditReport.com.
5. Children’s information exposed: consider a credit freeze for your child as well.
6. Signs of misuse: if you see accounts or charges you don’t recognize, go to IdentityTheft.gov for a recovery plan.

Watch for breach-related scams

After a big breach, scammers send emails and texts pretending to be the company, a law firm, or a settlement administrator. They may ask you to ‘verify’ your information or pay a fee to receive money. Real settlement notices never ask for a fee. See Refund and Settlement Scams.

Common questions

What’s the difference between a credit freeze and a fraud alert?

A freeze blocks most new credit from being opened in your name until you lift it. A fraud alert tells lenders to take extra steps to verify your identity. Both are free; a freeze is stronger.

Will a credit freeze hurt my credit score?

No. It doesn’t affect your score, and you can lift it temporarily when you apply for credit.

I get breach notices all the time. Do I need to do this every time?

Once your credit is frozen and you use unique passwords with two-step sign-in, most future notices only require a quick password change.

Related guides

• What to Do After a Data Breach: A Five-Step Checklist
• Credit Freeze Review
• How to Freeze a Child’s Credit
• How to Read a Security Alert Without Panicking

About this video

This video was produced by the Federal Trade Commission (FTC), a U.S. government agency, and plays from the agency’s own channel. Juggling Chaos wrote this summary and guide; we are not affiliated with or endorsed by the agency. Some details on screen, such as phone models or web addresses, may look dated, but the advice still applies. Checked October 7, 2026.

The FTC’s breach steps are at IdentityTheft.gov/databreach.