Data breach checklist: what to do, by what was exposedTell it what the notice says was exposed, and it lays out the steps in the order they matter.

A breach notice leaves you with one question: what do I actually have to do? The answer depends on what was taken. A leaked email address calls for some caution; a leaked Social Security number calls for a credit freeze the same day.

Using the checklist

Find the paragraph in the notice that lists what was exposed and tick the matching boxes above. There are eleven: password (or password hash), email address, Social Security number, driver's license or state ID number, passport number, card number, bank account number, phone number, date of birth or home address, medical or health insurance information, and tax return or W-2 information.

The plan appears under three headings: Today, This week and Over the next months. Steps are numbered, and many link to one of our pages or to an official site such as the IRS. Tick each step as you finish it; the counter and the bar show how far you have come. Print the plan gives you a paper copy, and Clear everything empties the boxes and your ticks.

How the plan is put together

Two steps always come first: check the notice is genuine by finding the company's contact details yourself, and keep the notice with the date you received it. After that, each type of data adds its own steps:

Within each heading, steps follow one order: Social Security number and tax first, because their damage lasts longest, then bank, card, password, phone, email, license, passport, date of birth or address, and medical. A step needed by two types appears once; the IRS PIN, for example, is listed a single time when you tick both Social Security number and tax. One combination adds a step of its own: a date of birth or address together with a driver's license number brings in the credit freeze even without a Social Security number, since those details cover much of a credit application. Whenever anything is ticked, the last step is to report any account, loan or tax return you did not open at IdentityTheft.gov, the FTC's site, for a recovery plan.

The freeze advice rests on federal law: since the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, the three nationwide bureaus must place and lift freezes for free, and the FTC notes that a freeze does not affect your credit score.

A worked example

A made-up retailer, Example Outfitters, writes to say that names, email addresses, password hashes, dates of birth and home addresses were taken. You tick password, email address, and date of birth or home address. The plan has ten steps:

• Today: check the notice is genuine; keep it; change the password everywhere you used it; turn on two-step sign-in, starting with your email.
• This week: move to a password manager; expect phishing that quotes the breach; look your email address up on Have I Been Pwned; expect calls that know your birthday.
• Over the next months: work through the opt-out checklist, because people-search sites join these details to your relatives and old addresses; report misuse at IdentityTheft.gov if any appears.

No Social Security or license number was involved, so there is no credit freeze in this plan, though you can still place one for free.

Where the checklist stops

• It only knows what you tick. Notices sometimes describe the data vaguely. If yours does, ask the company, or tick the wider option.
• It is built for the US. Social Security numbers, the IRS and the three bureaus are American. Elsewhere the same logic applies, but the agencies differ.
• It does not act for you. It places no freezes and contacts nobody.
• It is not a recovery plan for identity theft already under way. If someone has opened accounts in your name, start at IdentityTheft.gov.

Saved on this device

What you tick, both the types of data and the steps you have finished, is saved in your browser's local storage so you can come back next week. Nothing is sent to us. On a shared computer, press Clear everything when you are done, since the saved list shows which breach data concerned you.

Questions

How do I know the notice is real?

Scam letters that copy breach notices exist. Do not call the number or follow the link in the letter; find the company's contact details on its website or a card you already hold. Our piece on the first hour after a breach letter walks through the checks.

What is an IRS Identity Protection PIN?

A six-digit number you enter on your tax return, so nobody else can file one with your Social Security number. The IRS issues a new one each year, and anyone with a Social Security number or ITIN who can verify their identity can get one.

Should I take the free credit monitoring the company offers?

It can help, but monitoring tells you about a problem after it starts, while a freeze stops most new accounts from being opened. You can do both. Sign up through the company's own website rather than a link in an email.

Why change a password if only a hash was stolen?

Hashes of weak or common passwords can often be cracked. Our password strength check shows how quickly a stolen file with a fast hash gets through a guessable password.

Will my ticks still be here next week?

Yes, in the same browser on the same device, unless you clear your browsing data or use a private window.