What to Do After a Data Breach: A Step-by-Step Checklist

In short: If a company tells you your data was exposed, work through it in order: confirm what was taken, change the affected password, turn on two-factor authentication, freeze your credit if a Social Security number or financial account was involved, and watch for scams built around that specific breach. The FTC's guidance at IdentityTheft.gov is the starting point for all of it.

A breach notice in your inbox or mailbox is alarming, but what you do in the days after matters more than the headline itself. Two recent breaches — one at data center operator CyrusOne, one at Indian brokerage Angel One — show how differently a breach can hit you depending on whether it leaked your email address or your bank account number. The checklist below follows what the Federal Trade Commission recommends, plus what California law requires companies to tell you when your information is exposed.

How do I confirm my data was in a breach?

Start with the notice itself, not a headline or a rumor. "Did you get a notice that says your personal information was exposed in a data breach? Visit IdentityTheft.gov/databreach to learn what you can do to protect your identity," the FTC's consumer advice page says. If you're not sure whether you're affected, search your email address on a breach-lookup tool such as Have I Been Pwned, which maintains public records of individual incidents, including the CyrusOne breach and the Angel One breach. Don't click links in an email claiming to be the breach notice — go to the company's own site or the lookup tool directly.

Once you know you're affected, figure out exactly what kind of data was exposed before deciding how hard to react. The FTC ties the response to the data type: "For example, if your social security number was exposed, you'll want to order your free credit reports, and check for accounts you don't recognize." An exposed email address calls for a password change. An exposed Social Security number or bank account number calls for credit-side protection. Mixing those up means either overreacting to a minor leak or underreacting to a serious one.

The checklist

1. Confirm the breach. Check the company's official notice or a lookup tool such as Have I Been Pwned before doing anything else, as described above.
2. Change the affected password immediately — and any other account where you reused it. Reused passwords are what let one leaked credential turn into several compromised accounts.
3. Turn on two-factor authentication for email, banking, and any account tied to the breached service. If you want authentication that doesn't rely on a password at all, see Privacy Unpacked's explainer on how passkeys work.
4. Place a fraud alert or credit freeze if the breach involved a Social Security number, driver's license number, or financial account — both work by making it harder for a thief to open new accounts in your name, and either is worth placing in that situation; neither does much if only an email address leaked.
5. Order your free credit reports and scan them for accounts you don't recognize, which the FTC specifically recommends when a Social Security number is exposed.
6. Take the company's free monitoring offer. The agency's advice is simple: when a breached company offers free credit monitoring or identity theft insurance, use it.
7. Watch for phishing tied to the specific breach for weeks afterward. Scammers who buy leaked data often send messages pretending to be the breached company itself, asking you to "verify your account" or referencing details from the leak to look credible — treat any unsolicited message mentioning a breach as suspicious, even if it carries the company's logo.
8. Report identity theft if it happens. IdentityTheft.gov "can help you report that, too," according to the FTC, for cases where someone uses your stolen information to commit fraud.

What are my rights under state breach-notification laws?

It depends on the state, but California's law is a useful baseline. Under California Civil Code § 1798.82, a business must tell affected California residents "within 30 calendar days of discovery or notification of the data breach." The notice itself has a required format: it must be "titled 'Notice of Data Breach,' and shall present the information described in paragraph (2) under the following headings: 'What Happened?' 'What Information Was Involved?' 'What We Are Doing,' 'What You Can Do,' and 'For More Information.'" When a single breach hits more than 500 California residents, the law also requires the company to send the state Attorney General a sample copy of that notice, with personal details stripped out, within 15 calendar days of telling affected consumers. And if the breach exposed a Social Security number or ID number, the statute requires the company that caused the breach to offer at least 12 months of free identity-theft protection services. Other states have their own notification laws with different deadlines, so check your state attorney general's consumer-protection page once you get a notice.

How recent breaches show the difference data type makes

Three breaches illustrate why the first step — figuring out what was actually exposed — changes everything else on this checklist.

Breach	What happened	Data exposed	Priority action
CyrusOne	In August 2026, the data center operator was hit by a ShinyHunters "pay or leak" extortion attempt that published data allegedly taken from the company, according to Have I Been Pwned.	Roughly 373,500 unique email addresses plus names, physical addresses, phone numbers, job titles, and support tickets tied to users, sales leads, and employees.	Change any password reused with that email, and watch for phishing referencing CyrusOne support tickets.
Angel One	The Indian brokerage confirmed in July 2024 that data from an April 2023 breach had leaked online, per Have I Been Pwned.	7.9 million user records, including 6.8 million unique email addresses, names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs), and portfolio holdings.	Fraud alert or credit freeze, given the bank account and PAN exposure — though Angel One stated the breach "has no impact on client securities, funds, or credentials."
Sharecare	In August 2026, the digital health company was hit by the same ShinyHunters "pay or leak" extortion campaign that targeted CyrusOne, according to Have I Been Pwned.	318,185 unique email addresses, mostly B2B sales and marketing records with names, physical addresses, phone numbers, job titles, and employers — plus a small number of Brazilian health insurance plan members whose dates of birth, genders, marital statuses, and CPF numbers (Brazilian taxpayer IDs) were also exposed.	Most affected people only need a password change, but anyone in the smaller group whose CPF number or date of birth was included should treat that exposure like a government-ID breach and watch for identity-theft attempts tied to that number.

The CyrusOne leak is mostly contact information — serious for phishing risk, but not the kind of exposure that calls for a credit freeze on its own. The Angel One leak includes bank account numbers and tax ID numbers, exactly the category the FTC and California law treat as requiring credit-side protection. The Sharecare breach shows a third pattern: a single incident where most people's exposure is low-risk contact data, but a smaller subset had a government ID number exposed alongside it, so the same breach notice can call for different responses depending on which records were yours.

What should I do with accounts tied to the breached company?

Beyond changing the password on the breached account and anywhere you reused it, close or lock any dormant account tied to the breached service — an account you no longer use is the one you won't notice being taken over. Once you've cleaned up the accounts directly tied to the breach, it's worth checking what else data brokers have collected about you, since breached contact details often end up resold; Privacy Unpacked's guide on getting data brokers to delete your data walks through that process.

Updated 23 October 2026: Added a third breach example, Sharecare, where a Have I Been Pwned listing shows most of the 318,185 exposed emails were low-risk contact data but a smaller group also had a government ID number exposed, illustrating that one breach can call for different responses depending on which records were yours.