What to Do After a Data Breach: Your Step-by-Step Action Plan (2026)

If you've received a data breach notification — an email or letter telling you your information was exposed in a company's breach — you're not alone. These notices have become routine, and most people aren't sure what, if anything, they actually need to do.

Here's the real action plan, in order of priority.

---

Step 1: Figure Out What Was Actually Exposed

Not all breaches are equal. The notice you received should say what categories of data were involved — and that determines everything else:

What Was Exposed	Why It Matters
Email address only	Low risk on its own, but useful for phishing
Email + password	High risk if you reused that password elsewhere
Name, address, phone	Useful for scammers' social engineering and phishing
Social Security number	Highest risk — can enable new-account and tax fraud
Financial account numbers	Risk to existing accounts; contact your bank
Medical information	Risk of medical identity theft

Don't skip this step — it tells you which of the steps below actually apply to you.

---

Step 2: Change Your Password — Everywhere You Reused It

If your password was exposed (even hashed), change it on the breached site immediately. Then think about every other account where you used the same or a similar password — attackers run breached email/password combinations against other popular sites, a technique called credential stuffing.

A password manager makes this far less painful by generating and storing unique passwords per site, so one breach can't cascade into others.

---

Step 3: Turn On Two-Factor Authentication

If the breached account (or any account using the same credentials) doesn't already have two-factor authentication (2FA) enabled, turn it on now. Even if your password is compromised, 2FA blocks most automated login attempts.

---

---

Step 4: If Your SSN or Financial Data Was Exposed — Act Fast

This is where the stakes go up significantly. If the breach involved your Social Security number, follow our full guide:

What to Do If Your Social Security Number Is Stolen

At minimum, that means placing a fraud alert and freezing your credit at all three bureaus:

How to Freeze Your Credit at All 3 Bureaus

If financial account numbers were exposed, contact your bank or card issuer directly — they can often reissue account numbers or flag the account for extra monitoring.

---

Step 5: Watch for Breach-Themed Phishing

After any major breach, scammers send fake "security alert" emails referencing the breach to trick people into clicking malicious links or "verifying" their information. These often look more convincing right after a real breach because the topic feels timely and credible.

Be especially skeptical of any email or text that:

• References the breach by name and asks you to "verify your account"
• Asks you to log in via a link rather than going to the site directly
• Creates urgency ("your account will be suspended")

---

Step 6: Use the Free Credit Monitoring — But Don't Rely On It Long-Term

Companies that experience a breach often offer free credit monitoring for a year or two. It's worth activating since it costs nothing — but be aware of its limits:

• It usually expires after 1-2 years, while exposed data (especially SSNs) doesn't expire
• It typically covers credit monitoring only — not dark web monitoring, SSN misuse alerts, or identity theft insurance
• Enrollment often requires action on your part — it's rarely automatic

---

---

How Long Should You Stay Vigilant?

This is the part most people get wrong: they take the steps above right after the notification, then stop thinking about it once the free monitoring period ends.

But stolen data — especially an SSN — doesn't expire. It can sit in a dark web marketplace for years before being used. This is exactly the gap that ongoing identity monitoring fills: instead of a one-time response to one breach, it continuously watches for your information showing up in new breaches and for misuse of your identity going forward.

If you're not sure whether your information has shown up in other breaches beyond the one you were notified about, see our guide: Has My Personal Information Been Leaked?

For details on what's included in continuous identity and credit monitoring, see our Aura pricing guide or full Aura review.

---

Bottom Line

When you get a data breach notification:

1. Read the notice to find out exactly what was exposed
2. Change passwords — everywhere you reused them
3. Enable 2FA on affected accounts
4. If your SSN was exposed, freeze your credit and follow the full SSN guide
5. Watch for breach-themed phishing in the weeks after
6. Use free credit monitoring if offered, but don't treat it as a permanent solution

The companies involved move on quickly. Your exposed data doesn't — which is why the response that matters most is the one that continues after the headlines fade.