Match the response to the data
Breach letters are written by lawyers and bury the useful sentence, which is the list of what was taken. Find it, because the right response depends entirely on it.
- An exposed password means you change it there and on every site where you reused it.
- An exposed card number means you ask the issuer for a replacement card with a new number.
- An exposed bank account number means you call the bank and ask about a new account number and added monitoring.
- An exposed Social Security number, birth date or driver's license number means you freeze your credit, because those cannot be reissued the way a card can.
The credit freeze
A credit freeze blocks lenders from pulling your credit report, which stops most new accounts from being opened in your name. Federal law has made it free since 2018. You have to place it separately with each of the three national credit bureaus, whose contact details are listed on the Federal Trade Commission's consumer site, and each gives you a login or PIN for lifting it. A freeze does not affect your score, your existing cards or your ability to check your own report. When you apply for a loan or an apartment, you lift it for a few days, and an online request takes effect within an hour.
A fraud alert is the lighter version. It lasts one year, asks lenders to verify your identity before opening credit, and one bureau is required to pass it to the other two.
The free monitoring offer
Most breached companies offer a year or two of credit monitoring. Take it, since it costs nothing, but understand that monitoring only tells you after something has happened. The freeze is what prevents it. Check your own reports at annualcreditreport.com, which is the official free source, and look for accounts and inquiries you do not recognize.
The second wave
Criminals use breach data to write convincing messages, so expect emails and calls in the following months that know your name, your address and the company involved. Treat any message about the breach as suspect and go to the company's site on your own. If your Social Security number was exposed, request an Identity Protection PIN from the IRS, which stops someone else from filing a tax return in your name.
Note A freeze placed for yourself does not cover your children. Parents can freeze a minor's credit file with each bureau, and a child's clean, unwatched record is exactly what thieves look for.
