A Data Breach Notice: What It Means for Your Next Step

Confirm the notice independently

Open the affected organization’s known website or app. An attacker can copy a breach announcement to create a phishing message, so do not use an unexpected notice as your sign-in route.

Sources: FTC: How to recognize and avoid phishing scams; FTC: IdentityTheft.gov data breach response

Match the action to the data

Names, passwords, payment information and government identifiers present different risks. A large record count does not tell you which of your own details were involved.

1. Replace exposed or reused passwords and review account recovery methods.
2. Contact your card issuer about unfamiliar transactions or exposed payment details.
3. Use IdentityTheft.gov for steps tied to identity information.
4. Keep the notice and a timeline of actions taken.

Sources: FTC: IdentityTheft.gov data breach response; FTC: What to know about identity theft

Expect follow-up impersonation

Accurate personal details can make a later call sound credible. Verify requests independently even when the caller knows information from the notice. A clean monitoring result cannot prove that data was never exposed.

Sources: FTC: How to recognize and avoid phishing scams; FTC: What to know about identity theft