My Data Was in a Breach — What Should I Actually Do?

You got the email. "We regret to inform you that your personal information may have been involved in a data breach." Maybe it was a company you barely remember signing up for. Maybe it was your health insurer or a retailer you used once in 2019. Either way, your data is out there now.

Before you panic: not all breaches are equal. The difference between a leaked email address and a leaked Social Security number is enormous. What you need to do next depends entirely on what type of data was exposed — and most breach notifications are frustratingly vague about that.1

Not all exposed data carries the same risk. Here's how to assess what you're dealing with:

Risk level: Moderate. Your email and hashed (or sometimes plaintext) password from one service is now in a database that criminals share and sell. The primary risk is credential stuffing — automated attacks that try your leaked email/password combo on hundreds of other sites. If you reuse passwords, this is more dangerous than it sounds. One leaked password from a forgotten forum can unlock your bank account.

Risk level: Elevated. This data is used for social engineering, SIM swapping, and building more complete identity profiles. On its own, it won't empty your bank account — but combined with other leaked data, it gives criminals enough to impersonate you convincingly to customer service reps and phone carriers.

Risk level: Critical. This is identity theft territory. Exposed Social Security numbers, bank account details, or medical records can be used for financial fraud, tax fraud, and medical identity theft. This tier requires immediate, aggressive action.2

Credit Freeze: Legally regulated under federal law. Completely blocks access to your credit report for new applications. Free to place and lift. This is what you want.

Credit Lock: A product offered by credit bureaus (often paid). Functionally similar but governed by a service agreement, not federal law. Don't pay for what you can get free with a freeze.

Fraud Alert: A note on your credit file asking creditors to verify your identity. Lasts 1 year. Creditors are supposed to honor it but are not strictly required to. Significantly weaker than a freeze.3

Have I Been Pwned (haveibeenpwned.com) is a free service run by security researcher Troy Hunt. Enter your email address and it shows you every known breach that included that email. Most people appear in 5-10 breaches. HIBP also lets you check if specific passwords have been exposed using a clever partial-hash system.4

After a breach, the responsible company almost always offers 12-24 months of free credit monitoring. Take it. But understand what it is. Credit monitoring alerts you AFTER the damage is done. It's a smoke detector, not a fire extinguisher. A credit freeze prevents the fire in the first place. Also: the "free" monitoring often auto-enrolls you in a paid subscription. Set a calendar reminder to cancel.