You open an email that looks like every other security email you’ve ignored for the last decade. A company you’ve forgotten you ever used wants to tell you your name, Social Security number, and password were caught up in a data breach. The email helpfully offers 12 to 24 months of “free” credit monitoring, an apology, and a link to “stay vigilant.”
Most people do one of two things: they click “accept the monitoring,” close the tab, and go back to their day, or they panic briefly, do nothing, and assume the company will handle it. Both responses leave you exposed. Here is what actually matters when you get a breach letter, and what to do in the next seven days.
First, Figure out what was actually exposed
Not all data is equal, and breach notices bury the lede in legal language. Pull out the actual categories of data the company says were involved. You’re looking for four buckets, ranked by damage potential:
- Authentication credentials – email, password, security questions. If your password was reused anywhere else, treat every account using that password as compromised today.
- Financial data – card numbers, bank account info, payment history. Card numbers usually come with a fresh card from your issuer, so the real exposure window is days, not years.
- Personal identifiers – full name, address, date of birth, Social Security number, driver’s license, passport. This is the category that quietly ruins people, because it doesn’t expire and it can power new-account fraud for years.
- Behavioral data – purchase history, browsing, location. Lower direct fraud risk, but it fuels convincing phishing later.
If Social Security, driver’s license, or passport data was exposed, treat this as a long-term identity risk, not a one-week problem. If only an old password and username were leaked and you never reused the password, the practical risk is low.
The free credit monitoring trap
Every breach response includes an offer of 12 to 24 months of credit monitoring, usually through a third party like Experian or Kroll. Signing up is not harmful, but it is also not the protection the company is implying. Credit monitoring tells you after someone opens a new account in your name. It does not prevent the account from being opened.
What you actually want is a credit freeze, which is free in every U.S. state, lasts until you lift it, and blocks new credit entirely at the bureau level. A freeze is stronger than a fraud alert (which just asks lenders to verify identity) and stronger than monitoring. If your Social Security number was exposed, freeze all three bureaus – Equifax, Experian, and TransUnion – directly through their websites, not through a link the breach letter sends you to.
If the breached data included a password you still use anywhere, the monitoring is irrelevant. Password reuse is what turns one breach into ten.
The seven-day playbook, in order
Skip the offer of monitoring for now and start with the moves that change your actual risk.
Day 1: Lock down the account at the breached company
Log in directly – type the URL yourself, do not click the email link. Change the password to something unique. Turn on two-factor authentication using an authenticator app rather than SMS, since SMS codes can be hijacked through SIM swap fraud. If you can’t log in, contact the company’s real support line (from their website, not the email) and ask them to lock the account.
Day 1-2: Sweep for password reuse
Open your email password manager and search for the breached password. Every account using the same password or a close variant needs a new, generated password today. Most people discover they have five to twenty accounts using the same password. That is the real blast radius of a single breach.
Day 2-3: Freeze your credit at all three bureaus
This takes about ten minutes per bureau. You will need your Social Security number, current address, and a way to receive a confirmation letter. Save the PIN or account you create at each bureau – you will need it later to lift the freeze when you actually apply for credit.
Day 3-7: File your IRS Identity Protection PIN if SSN was exposed
If your Social Security number was part of the breach, request an IRS Identity Protection PIN through the IRS website. This is a six-digit number that prevents anyone from filing a tax return in your name without it. Without the IP PIN, identity thieves sometimes file a fake return early in the year to claim your refund. The PIN locks that down.
Day 7 and beyond: Set up ongoing monitoring that actually works
Most breach-monitoring offers expire after one to two years. Your exposure from an SSN leak doesn’t. A few real, ongoing habits:
- Pull your free credit reports weekly through AnnualCreditReport.com (now offering weekly reports) and scan for unfamiliar accounts or hard inquiries.
- Set transaction alerts on every bank and credit card account so you see new charges in real time, not at the end of the month.
- Watch your Explanation of Benefits from your health insurer for services you didn’t receive – medical identity theft is one of the most common slow-burn consequences of an SSN breach.
What you should NOT do
Do not pay for the “premium” tier of the breached company’s monitoring. The free tier covers credit monitoring; the paid tier usually adds identity-restoration insurance, which is rarely worth more than a few hundred dollars in value, and is redundant with the actual protection from a credit freeze.
Do not click any link in the breach notification email without verifying the sender’s domain. Phishing campaigns typically spike within 48 hours of a real breach announcement because the timing makes the email plausible. The real letter is also usually available by logging into your account on the company’s actual domain.
Do not assume the breach notification itself is a scam just because it appeared suddenly. The fastest way to verify is to log into the company directly and check for a banner or email copy matching what you received.
The real long-term cost
The reason identity theft cleanup is so much work is that exposed identifiers don’t expire. A password gets changed and it’s done. A Social Security number, once leaked, is leaked for life. That single fact is why a credit freeze, a tax PIN, and a habit of freezing new credit when you don’t need it are worth far more than any monitoring product a breached company will offer you as penance.
One breach doesn’t ruin anyone. Ignoring one is what tends to.
Featured image: “Biometric Data Slave” by Crusty De Kolster via Flickr, used under CC0 1.0.
