What to Do After a Data Breach: A Step-by-Step Guide

The email lands in your inbox. “[Company] Security Notice: Your account may have been affected.” Or you typed your email into HaveIBeenPwned and got the red banner back. Either way, you’re now staring at the screen wondering what, exactly, you’re supposed to do.

Most guides tell you to change your password and move on. That advice is incomplete, and for some breach types it’s dangerously insufficient. What you need to do in the next 24 to 72 hours depends entirely on what kind of data was exposed. A credential breach and a national ID breach require completely different responses. This is the triage playbook.

The short answer: After a data breach, first confirm the notification is real (go to the company’s site, not the email link, and check Have I Been Pwned). Then act based on what was exposed. Passwords: change them everywhere you reused them and turn on two-factor authentication. PII: monitor credit and remove yourself from broker sites. National ID: freeze your credit (US) or lock your Aadhaar (India). Card data: request a new card now. Medical data: request and review your records. You have the most control in the first 24 to 72 hours.

In this article:

You received the notification. Now what?

Don’t click anything inside the notification email. Don’t call any phone number listed in it. Don’t log in through any link it contains.

Breach notification emails are a known phishing vector. Attackers watch for high-profile breaches, then send fake notifications to millions of people. These fakes come complete with logos, legal language, and urgent CTAs. They’re designed to harvest your credentials the moment you try to “secure your account.” Before you take any action at all, your first job is confirming the notification is real.

The next 24 to 72 hours are the window where you have the most control. After that, your data is circulating, credential stuffing attacks are running, and fraud operations are using whatever was exposed. Act fast, but act correctly.

Step 1: Confirm it’s real

Go directly to the company’s website. Type the URL into your browser — do not click the email link. Look for an official breach announcement on their homepage, newsroom, or security page.

Search for the company’s name plus “data breach” on Google News. Check their official social media accounts (the verified ones). If the breach is real, there’s almost always independent press coverage within 24–48 hours of a public announcement.

Then check HaveIBeenPwned (haveibeenpwned.com) directly. Enter your email address. If the breach appears there, it’s confirmed independently of the company’s notification. HIBP receives breach data from security researchers and aggregates it — it doesn’t rely on the company’s self-reporting.

If you cannot independently verify the breach through any of these methods, treat the notification as phishing and report it. Do not act on it.

Step 2: Identify what was exposed

Once you’ve confirmed the breach is real, find the official breach notice — on the company’s site, not in the email — and look for the data inventory. Most reputable companies list exactly what categories of data were affected. If they don’t, look for their breach FAQ page; regulators in the EU and US often require companies to publish one.

The categories that determine your entire response:

Passwords / credentials
Email address only
Name, address, phone number (PII)
Payment card data
National ID numbers (SSN, Aadhaar, NI number, TFN)
Medical or health data
Financial account data (bank account numbers, routing numbers)

Each one requires a different playbook. Read the section below that matches your situation. If multiple data types were exposed — which is common — work through each section.

If passwords were exposed

Change the compromised password on the affected site immediately. Use something unique — a random string from a password manager, not a variation of your existing password.

Then: every other account where you used the same password is now compromised too. This is the part most people skip. Attackers run credential stuffing — automated tools that take the username/password pair from the breach and try it against hundreds of other sites. Banking, email, social media, shopping. They run millions of attempts per hour.

If you use a password manager, go to its breach-check feature and find every account with a duplicate password. Change them all. If you don’t use a password manager, this breach is your reason to start — read our guide at /blog/password-manager-guide/.

Enable two-factor authentication on the affected account and on every account where you changed a duplicate password. The options and setup process are covered in /blog/two-factor-authentication-guide/. Do not use SMS-based 2FA if you can avoid it; an authenticator app (Google Authenticator, Authy, Aegis) generates codes locally and can’t be intercepted by a SIM swap.

Check the account’s login history. Most email providers and social platforms show recent logins with timestamps and locations. Look for anything you don’t recognize. If an attacker got in before you changed the password, they’ve already had access — which means checking connected apps, forwarding rules, and any settings they might have changed.

If PII was exposed (name, address, phone, email)

PII doesn’t expire. A password you change becomes useless within minutes of changing it. Your home address and phone number are still accurate years from now.

What happens with exposed PII: it gets absorbed into data broker databases and sold into people-search sites. Within weeks of a breach, your details are queryable on sites like Spokeo, Whitepages, and their international equivalents. That’s how spam calls, targeted phishing, and social engineering attacks get fueled. Attackers buy bulk lists or look you up directly.

The immediate steps:

Monitor your credit reports. In the US, request free weekly reports at annualcreditreport.com (all three bureaus). In the UK, check via Experian or Equifax (free basic access). In India, check your CIBIL score at cibil.com — free once per year, or via apps like OneScore or BankBazaar more frequently.
Place a fraud alert. In the US, a fraud alert at one bureau (Equifax, Experian, or TransUnion) automatically notifies the other two. It tells creditors to take extra steps to verify identity before opening new accounts in your name. It lasts one year and is free.
Check if your data has spread to data broker sites. Our guides on removing data from US brokers (/blog/remove-yourself-from-us-data-brokers/) and the Indian internet (/blog/removing-your-data-from-indian-internet/) walk through the removal process.
Raise your phishing awareness. With your name, address, and employer in their hands, attackers can craft convincing spear-phishing emails. The next suspicious email you get could reference real details about you. Treat any unexpected request — even one that sounds plausible — with extra skepticism.

If national ID was exposed (SSN, Aadhaar, NI number)

This is the most serious category, and the response is different in each jurisdiction. A national ID number is the key to your financial identity in most countries. Exposed national ID data is used for new account fraud, loan applications, tax fraud, and benefit claims in your name — sometimes for years after the breach.

If you’re in the US (SSN exposed):

Place a credit freeze at all three bureaus: Equifax, Experian, and TransUnion. Do this before anything else. A credit freeze — not a fraud alert, a freeze — prevents new credit from being opened in your name. It’s free, it’s immediate, and it’s the strongest protection available. A fraud alert asks creditors to verify identity; a credit freeze prevents them from checking your credit at all without your explicit authorization.

Get an IRS Identity Protection PIN at irs.gov/identity-theft-central. An IP PIN is a six-digit number that must accompany any tax return filed using your SSN. Without it, a fraudulent return using your SSN gets rejected. Tax fraud is one of the most common uses of exposed SSNs, and most victims don’t discover it until they try to file their own return.

File a report at identitytheft.gov — the FTC’s dedicated identity theft tool. It generates a personalized recovery plan.

If you’re in India (Aadhaar exposed):

Lock your Aadhaar biometric authentication immediately at uidai.gov.in/my-aadhaar/offline-kyc/lock-unlock-biometrics.html. This prevents anyone from using your fingerprint or iris scan to authenticate as you. You can unlock it temporarily when you genuinely need biometric authentication, then lock it again.

Check your linked mobile number on UIDAI — go to resident.uidai.gov.in and verify the mobile number linked to your Aadhaar is your current number and hasn’t been changed.

Install or open the mAadhaar app and monitor authentication requests. UIDAI sends an OTP to your linked mobile number for every authentication attempt — any request you didn’t initiate is a red flag.

Alert your bank if your Aadhaar is linked to your account (as required for many Indian accounts under PMLA). Banks have fraud teams specifically for Aadhaar-related identity fraud.

If you’re in the UK (NI number exposed):

Place a CIFAS protective registration at cifas.org.uk. This is a fraud prevention measure that flags your identity in the UK’s fraud prevention database — any creditor checking your identity sees the flag and applies additional verification steps. It costs a small fee (currently £25 for two years) and is the closest UK equivalent to a US credit freeze.

Contact HMRC if you have reason to believe someone is using your NI number for employment or tax purposes. HMRC has a dedicated line for NI number fraud.

Notify your bank and check your credit file via Experian, Equifax, or TransUnion UK. All three offer free basic access to your statutory credit report.

If payment card data was exposed

Call your bank or card issuer. Don’t wait for fraud to appear — request a proactive card replacement now. New card number, new CVV, same account. This takes one phone call and is always the right move. Disputing fraudulent charges after the fact is slower and more stressful than replacing the card before the fraud happens.

Review the last 90 days of statements. Specifically look for small transactions — £1, $2, ₹50 — from merchants you don’t recognize. Attackers test stolen cards with micro-transactions before attempting larger purchases. A test transaction you didn’t catch confirms the card is active; a failed transaction tells them the card is already flagged.

Update any recurring payments linked to the old card number. Subscriptions, utilities, and insurance payments will fail after the card number changes — the sooner you update them, the fewer disruptions.

If your card was a debit card linked directly to a bank account, apply more scrutiny to the account itself. Debit fraud can directly empty a bank account in a way that credit card fraud doesn’t.

If medical data was exposed

Medical identity theft is the hardest type to detect and the hardest to resolve. It doesn’t show up on your credit report the way new account fraud does. Instead, it embeds false information inside medical systems — incorrect diagnoses, prescriptions written in your name for drugs you never took, procedures billed to your insurer that you never had.

Doctors rely on those records. If a fraudster has received care under your identity, your medical history now includes their conditions and their treatments.

Request your medical records from every healthcare provider you’ve used in the past two to three years. In the US, you have the right to do this under HIPAA at no cost (or minimal cost). In the UK, you can request your NHS records. In India, most private hospitals provide records on request; government hospital records access is less standardized.

Read through them. Look for any procedure, prescription, diagnosis, or consultation you don’t recognize.

If you find discrepancies:

Report to the healthcare provider that the records contain fraudulent entries.
Report to your health insurer — they have fraud units for exactly this.
In the US, file a report with the FTC at identitytheft.gov and contact the HHS Office for Civil Rights at hhs.gov/ocr (they handle HIPAA violations).
In the UK, contact the Information Commissioner’s Office at ico.org.uk.

Keep copies of everything. Correcting fraudulent medical records can take months and requires documentation at every step.

The ongoing monitoring setup

After you’ve completed the immediate response for your data type, set up the infrastructure that catches future exposure.

HIBP email notifications. Go to haveibeenpwned.com and register your email addresses for free breach alerts. You’ll get an email the moment your address appears in a new breach database. Takes two minutes to set up.

Credit report checks on a schedule. Not once — quarterly. Set a calendar reminder. In the US, rotate through the three bureaus (Equifax, Experian, TransUnion) so you’re checking a different one every month at annualcreditreport.com. In India, pull your CIBIL report every 90 days.

Account login alerts on your major accounts. Gmail, your bank, Apple ID, and any social media accounts should all be configured to email or push-notify you on new logins. These are usually in the account’s security settings. A login alert from a city you’re not in is your warning that an account is compromised — before the attacker has fully exploited it.

Data broker scans. Your PII spreads from breach databases into people-search sites automatically over time. Running a periodic check shows you where your information has surfaced and lets you submit removal requests before it becomes a source for targeted attacks.

If your national ID was exposed, consider maintaining the credit freeze indefinitely (in the US) rather than lifting it. The freeze doesn’t prevent you from applying for credit — you unfreeze temporarily when you need it and refreeze afterward. The minor inconvenience is worth it.

The breach notification you might not get

Here’s the uncomfortable reality: most breaches are not disclosed to individuals promptly — and many are never disclosed at all.

Under GDPR, companies must notify the relevant supervisory authority within 72 hours of discovering a breach. They must notify affected individuals “without undue delay” when the breach is likely to result in a high risk to those individuals’ rights and freedoms. But “undue delay” has been interpreted flexibly, and enforcement is uneven.

In the US, breach notification laws vary by state. There’s no single federal standard. Some states require notification within 72 hours; others give companies 30, 45, or 90 days. Some carve out exceptions for encrypted data that may have already been exposed.

In India, CERT-In (Computer Emergency Response Team) mandates breach notification within 6 hours of becoming aware. That’s one of the shortest timelines globally, established under CERT-In’s 2022 directions. The DPDPA 2023 adds notification provisions for the Data Protection Board. Its rules were notified in November 2025, but as of mid-2026 the Board isn’t fully operational and enforcement is still phasing in. Neither framework yet requires direct individual notification the way GDPR does.

HIBP often surfaces breach data before the breached company makes any public announcement. It’s why checking HIBP independently — rather than waiting for a notification — is standard practice for anyone monitoring their exposure.

What this means for you: don’t wait to be told. Check HIBP regularly. Run scans periodically. The breach you haven’t been notified about may already be circulating.

Frequently asked questions

What’s the first thing to do after a data breach? Confirm the notification is real before acting. Go to the company’s website directly (not the email link) and check Have I Been Pwned. Breach emails are a common phishing lure.

Do I really need to change more than one password? Yes. If you reused the breached password anywhere, every one of those accounts is now exposed to credential stuffing. Change them all and enable app-based two-factor authentication.

What if my Social Security number or Aadhaar was exposed? This is the most serious category. In the US, freeze your credit at all three bureaus and get an IRS Identity Protection PIN. In India, lock your Aadhaar biometric and verify your linked mobile number.

How long do I have to act? The first 24 to 72 hours give you the most control, before credential stuffing and fraud operations use the data. Act fast, but confirm the breach is real first.

How do I stop the spam and scam calls a breach causes? Remove yourself from the people-search sites that resell breach data. See our guide on how to check if your data was leaked to find where you’re exposed.

What you can do right now

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.