Got a data breach letter? What to do next

1. If the breach involved a password, change it immediately on that site AND every other site where you reused the same password.

   haveibeenpwned.com
   More detail

   Why this matters: credential stuffing — attackers automatically trying breached email/password combos against thousands of other sites — is the single most common follow-on attack after a breach. If you reused that password anywhere (email, bank, shopping), assume those accounts are at risk too.

2. Enroll in any free credit monitoring or identity-theft protection the breached company is offering — even if you're skeptical, it costs nothing and gives you alerts.

1. 🇺🇸 US

   Place a security freeze on your credit at all three bureaus — free, and the single most effective protection against new-account fraud.

   EquifaxExperianTransUnion
2. 🇨🇦 CA

   Place a fraud alert at both Canadian credit bureaus (Canada doesn't offer a formal freeze, but alerts require lenders to verify identity).

   Equifax Canada · 1-800-465-7166TransUnion Canada · 1-800-663-9980
3. 🇮🇪 IE

   Ask the Central Credit Register for a Notice of Suspected Impersonation and request your free credit report — Ireland has no credit freeze.

   Central Credit Register · 01 224 5500

1. 🇮🇪 IE

   If the organisation was vague or slow, complain to the Data Protection Commission. It must notify the DPC within 72 hours and tell you without undue delay when the risk to you is high.

   DPC contact form

2. Watch your bank and credit-card statements closely for the next several months — look for small 'test' charges ($1–$5) that often precede larger fraud.

3. Enable 2FA (preferably an authenticator app, not SMS) on the breached account and any other account that shared the leaked password.

1. Use a password manager so every account has a unique password — one breach can't cascade into others.

2. Subscribe to Have I Been Pwned breach notifications for your email address.

Related situations