Symptoms
- Email or letter stating your data was involved in a breach
- Notice mentions a company or service you actually use
- Offer of free credit monitoring included
- Uncertainty about whether the notice itself is genuine
Likely causes
- CommonGenuine company data breachCompanies are often legally required to notify affected users when customer data is exposed.
- PossiblePhishing disguised as a breach notificationScammers sometimes send fake breach notices to trick people into clicking a malicious link.
What to do
- Verify the notice by going directly to the company's official website rather than clicking any link in the email.
- Check the company's official breach notification page or press release to confirm it's real.
- Change your password for that specific account, and for any other account using the same password.
- Turn on two-factor authentication for the affected account if you haven't already.
- Sign up for the free credit monitoring if offered and it's confirmed genuine.
- Watch your email and accounts for follow-up phishing attempts referencing the breach.
- Consider a credit freeze if sensitive information like a social security number was involved.
When to call a pro
If the breach involved financial account numbers or a social security number, consider consulting a credit bureau or identity theft protection service.
Safety
Generally low risk
Generally low risk for a careful person. Stop if anything looks different from what this guide describes.