What to Do After a Data Breach

A data-breach notice often arrives with a long list of suggested precautions but little help deciding which one matters most. If information that can support new-account fraud — especially a Social Security number — was exposed, the choice between a credit freeze, a fraud alert, and a credit lock deserves prompt attention. These tools overlap, but they are not interchangeable.

Start With the Information That Was Exposed

A breach involving only an email address presents a different risk from one involving a Social Security number, date of birth, or financial-account credentials. Review the notice carefully and confirm it through a trusted channel, such as a company website or telephone number you find independently. Do not use links or phone numbers from a suspicious message until you have verified it.

The Federal Trade Commission directs consumers to tailor their response to the data involved. For example, when a Social Security number was exposed, the FTC recommends checking credit reports for unfamiliar accounts and considering a credit freeze or fraud alert. If passwords or login credentials were exposed, changing reused passwords and enabling multifactor authentication are separate, necessary steps; a credit-file tool will not secure an online account.

Credit Freeze vs. Fraud Alert vs. Credit Lock

What a Security Freeze Does

A security freeze — commonly called a credit freeze — limits a nationwide consumer reporting agency from releasing your credit file to a person requesting it. Because many lenders will not open a new credit account without reviewing a credit report, a freeze can make new-account identity theft substantially harder.

Federal law gives consumers the right to place and lift a freeze free of charge. For requests made by secure electronic means or toll-free telephone, a nationwide bureau generally must place the freeze within one business day. It generally must lift or remove the freeze within one hour after an authenticated electronic or telephone request. Mail requests have a three-business-day timetable.

A freeze does not lower your credit score, and you may still review your own credit reports. When you legitimately apply for credit, you can temporarily lift the freeze. If the lender tells you which bureau it will use, you may need to lift only that bureau’s freeze.

What a Security Freeze Does Not Do

• It does not stop a thief from making unauthorized charges on an existing credit card or bank account.
• It does not replace account monitoring, strong passwords, multifactor authentication, or prompt reports of unauthorized activity.
• It does not erase fraudulent information already on a credit report. Disputing or blocking identity-theft information is a separate process.
• The federal freeze rules are focused on consumer credit files. They do not necessarily prevent employment, tenant-screening, insurance, or specialty-report access.
• Existing creditors and certain other entities may retain access under statutory exceptions, including for account review or collection.

When an Initial Fraud Alert May Fit

An initial fraud alert is a lighter-touch option. It does not block access to the credit report. Instead, it tells prospective users that the consumer does not authorize specified new-credit activity unless the user follows reasonable identity-verification procedures. If you provide a verification telephone number, the statute directs the user to contact you at that number or take reasonable steps to verify your identity and confirm that the request is not identity theft.

An initial alert lasts at least one year and may be renewed. You need to contact only one of the three nationwide bureaus; that bureau must pass the alert to the other two. The alert also carries access to free report disclosures specified by the Fair Credit Reporting Act. A consumer who wants lenders to keep seeing the file — and who accepts the possibility of extra verification — may find this less disruptive than a freeze.

A confirmed identity-theft victim may qualify for an extended fraud alert lasting seven years. IdentityTheft.gov explains that an FTC Identity Theft Report can be used when requesting the extended alert. That process has additional documentation requirements and should not be confused with the one-year initial alert.

Why a Credit Lock Is Different

A “credit lock” is typically a commercial feature offered by a credit reporting company, sometimes through a paid monitoring bundle. Its operation, price, dispute terms, and cancellation rules depend on the provider’s agreement. By contrast, a security freeze is a right created by federal law and is free. The Consumer Financial Protection Bureau states that locks are no more effective than free security freezes. Review any product terms before paying for convenience features you may not need.

Seven Practical Steps After a Data Breach

1. Verify the notice and identify the exposed data. Use a trusted website or independently located contact number. Determine whether the breach involved login credentials, payment information, a driver’s license number, a Social Security number, or another identifier.
2. Secure affected online accounts. Change compromised or reused passwords, use unique credentials, review recovery email and phone settings, sign out other sessions, and enable multifactor authentication where available.
3. Consider freezing all three nationwide credit files. A freeze at one bureau does not automatically freeze the others. Keep your authentication details in a secure place so you can lift a freeze when needed.
4. Add an initial fraud alert if it suits your risk and credit needs. A freeze and fraud alert can coexist. One bureau contact is enough for an initial alert because it must notify the other two.
5. Review all three credit reports. Look for accounts, inquiries, addresses, and personal information you do not recognize. IdentityTheft.gov currently advises that consumers can check reports weekly for free through AnnualCreditReport.com.
6. Monitor existing financial and insurance accounts. A freeze does not stop existing-account misuse. Review statements and alerts, and contact the relevant institution promptly about activity you did not authorize.
7. Report actual identity theft and follow a recovery plan. IdentityTheft.gov can create an FTC Identity Theft Report and a tailored recovery plan. Depending on the facts, you may need to close fraudulent accounts, dispute report errors, request a block of identity-theft information, and preserve records.

Frequently Asked Questions

Will a credit freeze hurt my credit score?

No. FTC and CFPB guidance states that placing a freeze does not affect a credit score.

Can I apply for a loan while my credit is frozen?

Yes, but the lender may be unable to access the frozen file until you temporarily lift it. Ask which bureau the lender plans to use, and restore the freeze after the credit check if appropriate.

Can I freeze a child’s credit?

Federal law allows a representative to request a freeze for a protected consumer under age 16. If the bureau has no file, it must create a protected record for the freeze after receiving the required proof of identity and authority.

Should I pay for a lock or monitoring service?

A paid service may offer convenience or monitoring features, but it is not required to exercise the free federal freeze right. Evaluate the price, renewal terms, scope, and cancellation process. Monitoring alerts you to activity; it does not necessarily prevent it.

The Bottom Line

For many consumers whose Social Security number or other high-risk identifier was exposed, a free security freeze at all three nationwide bureaus is the strongest available credit-file control. An initial fraud alert offers a less restrictive alternative and can also be used alongside a freeze. A credit lock may be convenient, but it should be evaluated as a product, not mistaken for the statutory freeze right.

Data-breach response is broader than credit protection. Continue watching existing accounts, secure compromised credentials, keep copies of notices and reports, and act on unfamiliar activity. State identity-theft and data-breach laws may provide additional rights or remedies. A qualified attorney can assess deadlines, damages, reporting disputes, and claims based on the governing jurisdiction and specific facts.