After a data breach

A company you use got hacked, or you got a breach letter. Here is what to do, in order. Most of it is free.

1. See what leaked. Check your email address at Have I Been Pwned. It is a free site that shows which known breaches included your email.
2. Change that password, and any other account where you used the same one. A password manager makes this easy.
3. Turn on two-step login (MFA), starting with email and bank. CISA explains how: Turn on MFA. See app vs text codes.
4. If your Social Security number leaked, freeze your credit at all three bureaus. It is free.
5. Check your credit reports at AnnualCreditReport.com.
6. Follow the official checklist. IdentityTheft.gov/databreach has steps by type of data leaked.
7. Watch for follow-up scams. After breaches, scammers often send emails that use the leaked info. Use our scam email checklist.

If someone already used your info

Report it and get a recovery plan at IdentityTheft.gov.

General information only. Not legal, financial, or security advice, and not a guarantee. Check with the company or agency involved.