Privacy & Data

Exactly what to do after a data breach

November 10, 2026

11 min read

Copy Link

Step by step, sorted by the kind of data that got out

The right steps after a data breach depend on what leaked. A leaked password means changing that password everywhere you used it. A leaked Social Security number means freezing your credit with Equifax, Experian and TransUnion, which is free. A leaked card number means asking for a new card. Leaked contact details mean expecting better-written scams. Find out which of these you're dealing with first, then follow the steps for that kind of data below.

Most breach advice hands everyone the same list, and the list is long enough that people stop halfway. We think that's backwards. A breach of your email address and a breach of your Social Security number are different problems, and treating them the same way means doing too much for one and too little for the other.

There's also a step almost every guide leaves out, and it's the one we care about most. We'll get to it at the end.

Step 1: Find out what actually leaked

Before you change anything, figure out which kind of breach you're in. Everything after this depends on it.

If you got a notice, read it for the list of data types. Breach letters usually say what kinds of information were involved. Look for the specific words: name, email, password, phone, date of birth, Social Security number, driver's license, card number, bank account, medical or insurance details. That list is your to-do list.

Check that the notice is real before you click anything in it. Scammers send fake breach alerts precisely because people panic when they get them. Don't use links or phone numbers from an unexpected message. Go to the company's site the way you normally would, or look up the breach on the company's own newsroom or support page.

If you heard about it secondhand, check your address yourself. A free breach checker like Breach Beacon or Have I Been Pwned shows which known breaches included your email address. Run every address you've used, including the old ones.

If you're still unsure what was exposed, the FTC's IdentityTheft.gov/databreach page sorts its advice by data type too. Then jump to the section that matches.

If your email and password leaked

This is the breach with the clearest fix. The danger isn't really the breached site. It's every other site where you used the same password, because attackers try leaked email and password pairs across other services.

Change the password on the breached account. Make it one you've never used anywhere else.
Change it everywhere you reused it. Be honest here. If that password, or a close variation of it, protects your email or your bank, those come first. Your email account matters most, since it can reset all the others.
Turn on two-step verification. Start with your email account and anything holding money. An authenticator app or a passkey is stronger than a text message code, but any second step beats none.
Sign out other sessions. Most big services have a security page that lists where you're logged in. Sign out of anything you don't recognize.
Watch for password reset emails you didn't ask for. They mean someone is trying your address somewhere. Don't click them. Go to the site directly and check the account.

A password manager makes step 2 a one-time job instead of a recurring one. Once every account has its own password, a breach at one site stays at that site.

If your Social Security number or ID leaked

This is the breach to take most seriously, because you can't change the number the way you change a password. The goal is to make the number useless to anyone trying to open credit or file taxes as you.

Freeze your credit at all three bureaus. A freeze stops lenders from pulling your credit report, which stops most new accounts from being opened in your name. It's been free since 2018, and you place it separately with Equifax, Experian and TransUnion. You can lift it temporarily when you apply for credit yourself.
Consider a fraud alert too. A fraud alert asks businesses to verify it's you before opening new credit. It's free and lasts one year. You only have to contact one bureau, which notifies the other two. You can have a freeze and a fraud alert at the same time.
Pull your credit reports. Get them free at AnnualCreditReport.com and look for accounts or inquiries you don't recognize.
Protect your tax return. The FTC warns that scammers use stolen Social Security numbers to claim tax refunds. The IRS offers an Identity Protection PIN, a six-digit code that stops anyone else filing a federal return with your number. Anyone who can verify their identity can get one. The online tool is generally open from mid-January to mid-November, so if you've missed this year's window, put January on your calendar.
Check your Social Security record. The Social Security Administration suggests reviewing your earnings record in a my Social Security account. Income you didn't earn there can mean someone is working under your number.
Take the free monitoring if it's offered. The FTC says to accept free credit monitoring from the company that exposed your data. Just remember that monitoring tells you about fraud after it happens, and the freeze is what prevents it.

If you find accounts or tax filings that aren't yours, report it at IdentityTheft.gov. You'll get an official identity theft report and a recovery plan for the kind of misuse you found.

If your card or bank details leaked

A leaked card number is the easiest breach to recover from, because the number can simply be replaced. A leaked bank account number takes a little more work.

Ask your card issuer for a new card. The FTC's breach advice is to contact the card company, cancel the exposed card and request a new one. If the breach happened at your own bank, it may send a replacement without being asked.
For a bank account, ask about a new account number. The Identity Theft Resource Center suggests asking the bank to close the exposed account and open a new one with a different number, with a note on file that it was closed because of a breach.
Read your statements line by line. Look for any charge you don't recognize, including the small ones that are easy to skim past.
Update the card everywhere it auto-pays. Some merchants receive a replacement card number automatically and some don't. Go through what's billed to that card and only update the ones you'd actually miss. Anything you don't bother updating is something you didn't need to be paying for.
Turn on transaction alerts. Most banking apps can notify you of every charge, which catches misuse in minutes instead of at the end of the month.

If you find charges you didn't make, report them to the card issuer right away. Unauthorized charges are much easier to reverse the sooner you report them.

If it was "just" your name, phone, birthday or address

Companies love to say no passwords or financial data were involved. That's true and it's misleading. Your name, phone number, birthday and home address are exactly what a scammer needs to sound like your bank or the company that just got breached. There's nothing to reset here, so the steps are about not falling for what comes next.

Expect messages that mention the breach. Fake "breach settlement" emails and "verify your account" texts tend to follow the real news. Any message that knows details about you is more convincing, not more trustworthy.
Never act on a link or number in an unexpected message. If your bank texts you, close the text and open the bank's app yourself. If someone calls, hang up and call the number on the back of your card.
Stop using your birthday as an answer. If any account uses your date of birth or old address as a security question, switch the answer to something that isn't public, and store it in your password manager.
Lock down your phone number. Ask your mobile carrier about a port-out PIN or number lock, so someone with your details can't move your number to their phone and receive your security codes.

Leaked contact details don't expire. A birthday from a 2019 breach works just as well for a scammer today, which is why this kind of breach deserves more attention than the notices give it.

The last step: ask whether you still need the account

Here's the step we promised. Every breach guide treats the breached account as something to repair. You change the password and move on. Almost none of them ask whether you should still have the account at all.

So ask. When did you last use it? If the answer is "I forgot I had it until the notice arrived," the safest fix isn't a stronger password. It's closing the account, so the next breach at that company has one less record of you in it.

This is the part of breach advice we think matters most over time. You can't get breached at a company you've left. Every account you close is one fewer place your data sits, and one fewer notice in your future.

Two practical notes. Closing an account doesn't always mean the company erases everything it holds, and we've explained what actually happens when you delete an account. And while you're thinking about it, the breached account is rarely the only forgotten one. The same welcome emails that prove you signed up there are sitting next to dozens of others in your inbox.

Where Yorba fits

Yorba doesn't freeze your credit or replace your card. Those steps are yours, and they're free. Where Yorba helps is the part after: finding the accounts you forgot and closing the ones you don't need.

Breach Beacon checks whether your address shows up in known breaches, free and without an account. Yorba scans your inbox for the signup confirmations and automated emails that show you have an account somewhere, then scans again every week, so new accounts show up without you going looking. Breach monitoring flags accounts that turn up in breaches.

For the accounts you decide to close, Delete Desk has free deletion instructions for more than 10,000 services. On Premium, Yorba sends deletion requests and cancels subscriptions for you.

The limits: the inbox scan connects to Google and Microsoft mailboxes, so Yahoo and iCloud Mail aren't supported. The first scan covers two years of mail and reads header data rather than message content.

FAQ

What should I do first after a data breach? Find out what was exposed. The breach notice usually lists the types of data involved. A leaked password means changing it everywhere you reused it. A leaked Social Security number means freezing your credit with all three bureaus.

Should I freeze my credit after a data breach? If your Social Security number was exposed, yes. A credit freeze is free and stops most new accounts from being opened in your name. If only your email or password leaked, a freeze doesn't do much, and changing your passwords matters more.

Is a fraud alert the same as a credit freeze? No. A fraud alert asks lenders to verify it's you before opening new credit, and it lasts one year. A freeze blocks access to your credit report until you lift it, and you place it with each bureau separately. You can have both.

Can I change my Social Security number after a breach? A breach on its own usually isn't enough. Focus on the credit freeze and an IRS Identity Protection PIN instead.

How do I know if a breach notice is real? Don't use the links or phone numbers in the message. Go to the company's website or app directly, or look the breach up on the company's own site. A real notice won't ask you to send your password or full Social Security number.

Should I take the free credit monitoring a company offers? The FTC says yes. Monitoring alerts you after something happens, though, so pair it with a freeze if your Social Security number was involved.

Should I delete my account after a data breach? If you don't use it, yes. Closing an account you no longer need means the next breach at that company won't include you. Check what the company keeps after deletion, since closing an account and erasing the data aren't always the same thing.