Data Breach Response

What to Do After a Data Breach — Your 7-Step Action Plan

You just got a breach notification email. Maybe it's from a company you barely remember signing up for. Don't ignore it. The next 72 hours are critical. Here are the 7 steps to take right now to minimize the damage.

First: Understand What Was Exposed

Not all breaches are equal. The severity of your response should match the type of data that was compromised. Before taking action, read the breach notification carefully and identify what was exposed:

Now, let's walk through the 7 steps in order.

Step 1: Change Your Passwords (Within 1 Hour)

Start with the breached account, then work through every account that shares the same password. This is where most people fail — they change the password on the breached service but forget the dozen other sites where they used the same credential.

How to do this effectively:

Key Insight: After the 2024 National Public Data breach that exposed 2.9 billion records, credential stuffing attacks increased 312% in the following 30 days, according to Cloudflare's threat intelligence. Attackers move fast. You should too.

Step 2: Enable Two-Factor Authentication (Within 2 Hours)

Two-factor authentication ensures that even if an attacker has your password, they can't access your account without a second verification factor.

Enable 2FA on these accounts first (in priority order):

  1. Primary email
  2. Banking and financial accounts
  3. The breached service
  4. Social media accounts
  5. Cloud storage (Google Drive, Dropbox, iCloud)
  6. Shopping accounts (Amazon, PayPal)

Step 3: Freeze Your Credit (Within 24 Hours)

If the breach exposed your Social Security number, date of birth, or address, freeze your credit immediately. A credit freeze prevents anyone from opening new credit accounts in your name — including credit cards, loans, and mortgages.

Freeze at all three bureaus:

Also freeze your report at the lesser-known bureaus: Innovis (1-800-540-2505) and NCTUE (National Consumer Telecom & Utilities Exchange) to prevent fraudulent utility accounts.

Save your freeze PINs in your password manager. You'll need them to temporarily lift the freeze when applying for legitimate credit.

Key Insight: Credit freezes are free under federal law and do not affect your credit score. They only block new account applications — your existing credit cards and loans continue to work normally. There is no reason not to freeze your credit if your SSN was exposed.

Get 24/7 Breach Monitoring

Aura continuously monitors your credit, SSN, and the dark web — and alerts you within minutes of suspicious activity.

See Our #1 Pick: Aura Compare Identity Protection Services

Step 4: Check Your Financial Accounts (Within 24 Hours)

Even if the breach didn't directly expose financial data, review all of your financial accounts for unauthorized activity:

Set up real-time transaction alerts on all financial accounts if you haven't already. Most banks let you configure alerts for any transaction over $0.01.

Step 5: Scan for Malware (Within 48 Hours)

Some breaches originate from malware on your device — keyloggers, info-stealers, or remote access trojans that captured your credentials before they were transmitted. Even if the breach was on the company's end, this is a good time to verify your devices are clean.

Step 6: File Official Reports (Within 1 Week)

If you've suffered financial loss or identity theft, document everything and file official reports:

Step 7: Set Up Long-Term Monitoring (Ongoing)

The danger from a data breach doesn't end after a week. Stolen data can surface months or years later. Set up continuous monitoring to catch delayed exploitation:

Credit Monitoring

Monitor all three bureaus (not just one) for new inquiries, new accounts, and score changes. Services like Aura provide triple-bureau monitoring with near real-time alerts.

Dark Web Scanning

Your stolen data often appears on dark web marketplaces months after a breach. Continuous dark web scanning alerts you when your email, SSN, or credentials are found for sale.

SSN Monitoring

Services that track your SSN across public records, credit applications, and government databases can catch synthetic identity fraud — where criminals combine your real SSN with a fake identity.

Financial Account Monitoring

Link your bank accounts and credit cards to an identity monitoring service that watches for unauthorized transactions and suspicious activity patterns across all your accounts.

How Aura and Norton Catch Breaches Early

The best defense against data breaches is early detection. Here's how the leading security tools help:

Aura

Norton 360

Key Insight: The 2025 Javelin Identity Fraud study found that victims who discovered identity theft through a monitoring service alert lost an average of $400, compared to $1,700 for those who discovered it through other means (like a denied loan or collection call). Early detection reduces financial damage by 76%.

Data Breach Response Checklist

Bookmark this page. Here's your complete action checklist:

Frequently Asked Questions

How long after a data breach should I be worried?

Stolen data can be exploited months or even years after a breach. Criminals often stockpile credentials and personal information, using them when targets are least vigilant. You should maintain heightened monitoring for at least 12-24 months after a breach, and ideally use a continuous monitoring service like Aura that watches indefinitely.

Should I accept the free credit monitoring offered after a breach?

Yes, always accept free credit monitoring after a breach — it's better than nothing. However, these free offerings are typically limited to single-bureau monitoring for 12-24 months. For comprehensive protection, consider a dedicated service like Aura that monitors all three bureaus, scans the dark web, and provides identity theft insurance, covering you continuously rather than just for a limited period.

Can I sue a company after a data breach?

In many cases, yes. Class action lawsuits are common after major breaches, and some result in significant settlements (Equifax: $700M, T-Mobile: $350M). You typically need to demonstrate that you were affected by the breach and suffered harm. Check if a class action has been filed by searching the company name plus "data breach lawsuit." However, joining a class action usually yields modest per-person payouts, and the better priority is protecting yourself from further damage.

Don't Wait for the Next Breach

The average person's data has already been exposed in multiple breaches. Proactive monitoring catches threats before they become crises.

Try Aura — #1 Identity Protection Get Norton 360 with LifeLock