7 Steps to Take Right After a Data Breach

Image

When I heard the news of the credit reporting agency data breach in September 2017, my first question was whether I was one of the ...


When an organization that holds your personal information suffers a breach, you as a consumer need to know what steps to take—and quickly. The steps will vary, depending on the circumstances of the breach and the sensitivity of the stolen data. First, consider your specific situation:

  • Confirm a breach occurred, affecting your information
  • What type of data breach occurred?
  • Was my information exposed in the breach?
  • Has my Social Security number and other sensitive personally identifiable information (PII) been stolen, or is the exposed data more limited?
  • Are the hackers doing anything with my PII yet, such as using it to commit identity fraud?


We’ve created a 7-step checklist to use in the case of a data breach. Depending on the severity of the breach and the information exposed, you’ll need to apply some or all of these steps to varying degree:

Your Data Breach Response Checklist


1. Confirm the breach and if your information was exposed.

The first step is to confirm that a breach actually occurred. When a data breach occurs, scammers may reach out to you posing as the breached company to try to obtain more of your personal information. Don't fall for fake emails. Go to the company's secure website and/or call the company to confirm the breach and whether your information was involved.

2. Find out what type of data was stolen.

Why does the type of information exposed matter? While stolen credit cards and the like can be canceled and replaced, it's quite difficult to obtain a new Social Security number. And fraudsters can do a lot more with your SSN and other unique, sensitive PII than they can accomplish with an email or credit card account.

3. Accept the breached company's offer(s) to help.

If the breached company offers to help repair the damage and protect you for a certain amount of time, unless there have been issues with their offer, take them up on it.

4. Change and strengthen your online logins, passwords and security Q&A.

It's important to immediately change your online login information, passwords, and security questions-and-answers for the breached account(s)—along with your other accounts if they have similar passwords and security Q&A—to limit the reach of the hackers' arms. This step was especially important for victims with stolen email accounts.

5. Contact the right people and take additional action.

This is where the type of data stolen really comes into play. If your credit and/or debit card information was stolen, you should reach out immediately to the financial institution(s) to cancel your card and request a new one. However, if personal information like your Social Security number was stolen, it may be easier for you to become a victim of identity theft. The FTC recommends:

  • Taking advantage of free credit monitoring that may be offered by the company responsible for exposing your information
  • Obtaining your free credit reports from AnnualCreditReport.com to look for activity you don't recognize
  • Considering a credit freeze for your accounts with the three major credit report agencies so it’s more difficult for someone to open a new account in your name.

6. Stay alert; monitor your accounts closely.

It's important to watch for signs of new activity. In cases where Social Security numbers were stolen, the hackers and others who put their hands on the numbers may use them now or wait years when victims may be less suspecting. Follow the breach-related steps noted above when your Social Security number is exposed.

7. File your taxes early.

If your Social Security number has been stolen or you just want to take precautionary measures, you may be able to beat fraudsters to the IRS, making it less likely they'll commit tax-refund identity theft.

Bottom Line: Be Alert and at the Ready

In the wake of a data breach, remember that the breach alone doesn't mean you're immediately a victim. That could possibly come much later. The important thing is to stay alert and know what to look for. If you see any red flags, be ready to take action.

For more details, visit the FTC's identity theft website.

Cyber threats have evolved, and so have we.

Norton 360™ with LifeLock™, all-in-one, comprehensive protection against viruses, malware, identity theft, online tracking and much, much more.

Try Norton 360 with Lifelock.

Norton logo
  • Norton
Norton empowers people and families around the world to feel safer in their digital lives

Editorial note: Our articles provide educational information for you. Our offerings may not cover or protect against every type of crime, fraud, or threat we write about. Our goal is to increase awareness about Cyber Safety. Please review complete Terms during enrollment or setup. Remember that no one can prevent all identity theft or cybercrime, and that LifeLock does not monitor all transactions at all businesses. The Norton and LifeLock brands are part of Gen Digital Inc. 

Contents

    Want more?

    Follow us for all the latest news, tips and updates.