What to do after a data breach notice

Breach letters are required by law, and scammers imitate them. All 50 states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have laws requiring private businesses to notify people when a security breach involves their personal information, according to the National Conference of State Legislatures. That means real notices are common, and so are fakes.

Signs a notice is legitimate:

• It names the company, describes the incident, and gives dates.
• It lists the specific types of data involved.
• It offers a phone number or website you can verify independently, for example on the company's own site or a state attorney general's breach list.
• It does not ask you to pay, to give your full Social Security number, or to click a link to "verify" your identity.

If you are unsure, do not call the number in the letter. Look up the company's official contact information yourself. See class action settlement scams for more red flags.

An IRS Identity Protection PIN is a six-digit number that prevents anyone else from filing a tax return using your Social Security number, and anyone who can verify their identity can request one from the IRS as a preventive step.

If your email or phone number was exposed, be extra careful with messages that mention the breach. Scammers use real breach news to make their messages convincing.

If your Social Security number, date of birth, or other identity information was exposed, a credit freeze is the single most effective step. According to the FTC, a credit freeze is free, lasts until you lift it, and must be requested separately from Equifax, Experian, and TransUnion. While it is in place, lenders generally cannot pull your credit to open a new account, which blocks most new-account fraud. You can lift it temporarily when you apply for credit.

A fraud alert is a lighter option. An initial fraud alert is also free and lasts one year, and you only need to contact one of the three bureaus, which must notify the other two. It tells lenders to verify your identity before opening credit, but it does not stop them from seeing your report. People who have already been victims of identity theft can get an extended fraud alert.

Also check your credit reports for accounts you do not recognize. If you find errors, see how to dispute a credit report error, and if identity theft has already happened, report it at IdentityTheft.gov to get a recovery plan.

Most breach victims who get paid do so through a class action settlement, and settlements pay more to people who can show losses. Start a simple file now:

1. The notice itself, including the envelope or email. It often includes a notice ID that settlement websites ask for.
2. Time you spend responding: freezing credit, calling banks, changing passwords. Some settlements reimburse lost time, and a written log is the easiest way to support that claim.
3. Out-of-pocket costs: credit monitoring you paid for, postage, bank fees, and fraud losses, with receipts.
4. Fraud evidence: alerts, police or FTC reports, and letters from creditors.

Data breach settlements commonly pay a flat cash amount to anyone in the class and a higher, documented-loss payment that can reach thousands of dollars for people with proof, such as the Highlands Oncology settlement, which offers up to $4,250 per person. See how much a data breach settlement is worth for real figures.

Often, yes, and fast. Large breaches regularly draw class action lawsuits within days of the notice going out. The Identity Theft Resource Center reported a record 3,322 data compromises in 2025, and many of them produced lawsuits. These suits usually allege the company failed to use reasonable security. Those are allegations until a court rules or the company settles, and companies typically deny wrongdoing when they settle.

Data breach settlements open for claims as of September 2026 include:

• ABC Legal data breach, claim deadline September 28, 2026.
• Highlands Oncology data breach, claim deadline October 22, 2026.
• Equinox data breach, claim deadline October 23, 2026, with a final approval hearing on November 12, 2026.

You file only on the official settlement website named in the notice. See the full list of open settlements and our data breach lawsuit page for cases still being investigated.

For most people with no fraud losses, filing a claim in the eventual settlement is enough. It makes more sense to get individual advice if:

• Someone opened accounts, filed a tax return, or took out loans in your name after the breach.
• You lost significant money, or your credit damage cost you a loan, apartment, or job.
• Highly sensitive data, such as medical records or information about your children, was exposed.
• You live in a state with strong privacy laws. For example, California's Consumer Privacy Act allows $100 to $750 per consumer per incident when a business's failure to maintain reasonable security exposes nonencrypted personal information. See California class action settlements.

If you want to keep the right to sue on your own, you must opt out of any settlement by its deadline. If you think a breach caused you real losses, a free case review takes about two minutes.