guides / privacy
I received a data breach notification
What it means, what's actually at risk, and exactly what to do — in the right order.
What kind of data was exposed?
Phishing emails disguised as breach notifications are common. Before doing anything else, confirm the breach actually happened.
If you can't verify it
Treat the email as suspicious — don't click any links in it. If the breach is confirmed, keep reading.
This is what most breach guides don't tell you. If an attacker got into any of your accounts, they may have set up mechanisms to stay in — even after you change your password.
In Gmail:
On your phone carrier:
If you discover actual fraud — not just exposure — document everything. You'll need it.
A breach isn't a single event. The data is out there, and fraud can emerge weeks or months later.
quick reference
| Exposed | First thing | Most important step | Don't forget |
|---|---|---|---|
| Password | Change it on breached site | Find everywhere you reused it | Check email for forwarding rules |
| Email only | No urgent action needed | Turn on 2FA everywhere | Watch for phishing |
| Financial | Call your bank | Credit freeze at all 3 bureaus | Review linked accounts |
| SSN | Credit freeze at all 3 bureaus | IRS Identity Protection PIN | SSA account lockdown |
| Medical | Review recent insurance claims | Request your medical records | File HHS complaint if HIPAA breach |