Data Breach Checklist: What to Do Based on What Was Exposed

A breach notice should list what was exposed. Tick each item and you'll get the official steps for it, from the federal government's identity theft site, with the most urgent first.

Private: this runs in your browser. Nothing you tick is sent anywhere.

Not sure the notice is real? Check it first: how to tell if a breach letter is real and what it means.

What was exposed? Check your breach notice and tick everything it lists.

My Social Security number A password or account login (email, social media, phone, shopping, utility) A debit or credit card number Bank or investment account information My driver's license information My passport information Medicare, Medicaid or health insurance information My SNAP (EBT) benefit card My child's personal information Other details only (name, address, email, phone number, date of birth)

Has anyone already used it?

Yes: someone opened an account, made a purchase, filed taxes or got a job or benefits with my information

Show my plan Start over

How this checklist works

Each step comes from an official U.S. government page, linked under the step, mostly the Federal Trade Commission's IdentityTheft.gov steps for lost or exposed information. We group the steps by urgency and remove duplicates. We don't add anything the official sources don't say.

A breach doesn't mean someone has used your information. If someone already has, for example to open an account or file taxes, tick the last option: reporting it at IdentityTheft.gov comes first.

Want to freeze your credit everywhere it matters and keep track? Use the credit freeze tracker.

General information, not legal or financial advice. Phone numbers and procedures come from the official pages linked with each step, checked on September 24, 2026. If a number has changed, the official page wins.