The first hour after a data breach letter: what to do, in order

The envelope usually looks like junk mail. Plain white, a return address you half recognize, a first line that says "Notice of Data Security Incident" or something equally bland. Inside, a company you did business with explains that someone got into its systems and some of your information went with them.

The letter is not a reason to panic, and it is not a reason to file it under later either. Nobody can tell you when, or whether, the stolen data will be used, and most of the protective steps take minutes. Here is the hour I would spend, in the order I would spend it. Get a pen and a cup of coffee.

Minutes 0 to 10: read it for what was taken

Skip the apology paragraph and find three things.

• What was exposed. Look for the list: name, address, date of birth, Social Security number, driver's license number, account or card numbers, usernames and passwords, medical or insurance details. That list decides almost everything that follows.
• When it happened, and when the company found out. A breach from last autumn that was discovered last month means your details may have been out for a while.
• What the company is offering. Usually a period of free credit monitoring, with an enrollment code and a deadline.

Circle the items in the list. If the letter is vague ("certain personal information"), that is common and irritating. Assume the most sensitive item the company holds about you was included, and ask them later through their published contact details. Your bank holds your Social Security number; the shoe shop probably does not.

Minutes 10 to 15: make sure the letter is real

Scammers send fake breach notices, by post and far more often by email and text, because a frightened reader is easier to steer. A fake usually wants something from you right away: confirm your Social Security number, pay for "protection", call a number to verify your identity, or click a link to secure your account.

Two quick checks settle most cases.

1. Find the company's contact details yourself, from its official website or an old statement, never from the letter. Ask whether it sent breach notices. If the letter includes a monitoring enrollment code, use it only through the web address the company confirms.
2. Look the breach up. Many states require companies to report breaches to the state attorney general, and some publish those reports. California's attorney general keeps a searchable list of breach notices, with sample copies of the letters companies sent when more than 500 Californians were affected. If yours matches the sample line for line, it is real.

For a breach that involved email logins, Have I Been Pwned can tell you whether your address appears in known breach data. Type your own address directly into that site, never into a page that a message sent you to.

Minutes 15 to 30: passwords and two-step sign-in

If the letter mentions usernames, passwords or security questions, this is your first real job. If it doesn't, change the password at the breached company anyway; it costs two minutes.

• Change the password at the breached company to one you have never used anywhere else.
• Then change it on every other account where you used the same password or a close variation. This is the step people skip, and it is the one that matters, because stolen passwords get tried against email providers, banks and shops on the bet that people reuse them.
• Turn on two-step sign-in, starting with your email account, then your bank and the breached account. An authenticator app or a security key holds up better than a text message code. I walked through the options, and the order to set them up, in our piece on password managers, passkeys and two-step codes.
• If the breach included security question answers (a first pet, a first school), change those answers wherever you used them. Nothing says the answer has to be true. Store the made-up answers in your password manager.

Minutes 30 to 45: freeze your credit at all three bureaus

If your Social Security number was in the list, this is the most protective thing you can do all hour. Even if only your name, address and date of birth leaked, it is worth the fifteen minutes, because it is free and you can reverse it whenever you like.

A credit freeze stops lenders from pulling your credit report to open a new account, which makes it far harder for someone to open a card or a loan in your name. Since September 2018 federal law has made freezes free to place and free to lift. The FTC's guide to freezes and fraud alerts says a freeze doesn't affect your credit score, and the FTC has explained that a bureau must place a freeze within one business day of an online or phone request, and lift it within an hour when you ask.

You have to contact each bureau separately:

• Equifax: credit freeze page
• Experian: security freeze center
• TransUnion: credit freeze page

Each one will ask you to create an account and answer identity questions. Watch for upsells along the way: the bureaus also sell monitoring products and paid "lock" services, and the free freeze is the one you came for. Save the login for each bureau in your password manager, because you will need it to lift the freeze before you apply for a loan, a new card or, sometimes, an apartment.

Companies you already do business with can still see your file, so your existing cards and loans keep working as usual. The freeze is aimed at new credit.

Minutes 45 to 50: add a fraud alert, if you want a second layer

A fraud alert is not the same as a freeze. It tells lenders to take extra steps to confirm your identity before they open new credit. It is free, it lasts one year, and you only need to contact one bureau, which must pass the alert to the other two. If you become a victim of identity theft, you can get an extended alert that lasts seven years. A freeze is the stronger tool. An alert makes sense as an extra layer on top, or if you are about to apply for credit and don't want to keep lifting freezes.

Minutes 50 to 60: the tax side and the paper side

If your Social Security number was exposed, get an Identity Protection PIN from the IRS. An IP PIN is a six-digit number that has to appear on your federal tax return, which stops a thief with your Social Security number from filing a return in your name and collecting the refund. Anyone who can verify their identity can get one, and the quickest route is through your IRS online account. A new one is issued every year, so make a note to fetch next year's before you file. The IRS says it will never call, email or text to ask for your IP PIN, which makes any message that does an obvious scam.

Then the paper. Put the breach letter in a folder with a note of what you did and when: the date of each freeze, which passwords you changed, any reference numbers. If something goes wrong later, that folder is your timeline.

While you are at it, look at the drawer of old statements and pre-approved credit offers. Those carry account numbers and personal details too, and a cross-cut shredder cuts them into pieces small enough that nobody is going to tape them back together. That pick comes from its specifications and from published reviews rather than any testing on our part. You can also stop most pre-approved credit offers through OptOutPrescreen.com, the official opt-out site run by the consumer credit bureaus.

Privacy kit

• 12-sheet cross-cut paper shredderOld statements, pre-approved credit offers and medical bills stop being readable trash.On Amazon
• Identity-blocking roller stamp (3 pack)Hides your name and address on labels and letters before they go in the bin.On Amazon
• Fire-resistant document bag (two pockets)Keeps the documents you need after identity theft together and away from casual view.On Amazon
• Wall-mount locking mailboxKeeps bank letters, new cards and tax forms out of reach of mail thieves.On Amazon

Chosen from specifications, policies and published reviews; we have not tested these ourselves.

What to do for each type of exposed data

The FTC's IdentityTheft.gov data breach page has fuller steps for each of these, and our breach checklist turns them into a list you can tick off in your browser, sorted by the kind of data involved.

The weeks after

The hour takes care of the urgent part. The follow-up is slower and mostly watching.

• Pull your credit reports. AnnualCreditReport.com is the official site for free reports, and the three bureaus now let you get one from each of them every week. Look for accounts, addresses and inquiries you don't recognize.
• Turn on transaction alerts with your bank and card issuers, so every charge sends a text or an app notification.
• Decide about the free monitoring. It is worth enrolling through the address the company confirmed, because it can flag new activity sooner than you would spot it yourself. It doesn't prevent anything, which is why the freeze comes first.
• If you find an account you didn't open, or a tax notice about a return you didn't file, report it at IdentityTheft.gov. The site walks you through a recovery plan and produces an identity theft report you can send to creditors.

Questions people ask after the letter

Should I freeze my credit if only my email address was exposed?

It does no harm, but it is not urgent. Email-only breaches mainly lead to more phishing. Change the password if one was involved, and read your inbox with a skeptical eye for a few months.

What about my kids?

You can freeze credit for children under 16 too, for free, by contacting each bureau. Expect to send proof of your identity and of your relationship to the child. A child's file is attractive to thieves precisely because nobody looks at it for years.

Will a freeze stop someone from using my existing card?

No. A freeze blocks new credit. For an exposed card number, the card issuer is the right call, and a replacement card with a new number is the fix.

Should I keep the letter or shred it?

Keep it. It names the company, the dates and what was exposed, and you may need all three if you have to dispute an account or a tax return later.

Is there anything else I can lock?

Two optional extras, if your Social Security number was exposed. E-Verify's Self Lock, a free federal feature, makes the E-Verify system flag a mismatch if an employer enters your number, which helps against someone using it to get a job; it lasts a year, and you can lift it before you start a new job yourself. Your mobile carrier account deserves a PIN as well, because a scammer with your personal details may try to move your number to their own phone and catch your sign-in codes.

The one thing to remember

If you only do one thing today, freeze your credit at all three bureaus. It is free, it usually takes about fifteen minutes in total, and it shuts the main door a stolen Social Security number opens: new credit in your name.