What to Do After a Data Breach: Response Checklist

What to do after a data breach depends on whether you're responding as an individual or a business, but the first moves matter either way. If it's your personal account, change the password on the breached account immediately, then check every other account for the same or a similar password, and turn on multi-factor authentication (MFA) wherever it's offered. If your Social Security number was exposed, place a credit freeze with all three credit bureaus.

If you run a business, your first priority is containment, not notification. Isolate affected systems, preserve forensic evidence, and loop in your cyber insurer and breach counsel within the first 24 hours, since state and federal notification deadlines, some as short as 30 days, start running from the moment you discover the incident.

According to the Identity Theft Resource Center (ITRC), a nonprofit that tracks data breaches and compromises across the United States, U.S. organizations reported more than 3,200 data compromises in 2023, the highest annual total the organization has tracked. Stolen credentials often surface for sale on criminal marketplaces within hours of a breach, so what you do in the first day or two often decides whether the incident stays contained or turns into months of fraud cleanup.

Immediate Response for Individuals (First 24 to 48 Hours)

If you received a breach notification letter or found out your information was exposed some other way, treat the first day as the most important one. The FBI's Internet Crime Complaint Center (IC3), the federal government's central hub for reporting cybercrime, notes that acting quickly narrows the window attackers have to use stolen credentials.

Start with the breached account, then check every other account where you used the same or a similar password. Password reuse is one of the most common ways a single breach turns into account takeovers across multiple services. A password manager generates and stores a unique, complex password for every account, which removes this risk going forward.

Check HaveIBeenPwned.com, a free tool that checks whether your email address or password has appeared in a known breach, so you know the scope of what was exposed. Then enable MFA on every account that offers it, starting with email, banking, and work accounts, since email is usually the account attackers use to reset everything else.

If financial account numbers were exposed, call your bank or card issuer; most institutions can issue new account numbers immediately once they confirm the breach. Sign up for any free credit monitoring the breached organization offers.

Credit Freeze vs. Fraud Alert: Which Do You Need?

If the breach exposed a Social Security number, password changes aren't enough on their own. Identity thieves can use a stolen Social Security number to open credit accounts, file false tax returns, or get medical services in your name, sometimes months or years after the original breach.

A fraud alert is a free notice on your credit file that requires lenders to verify your identity before issuing new credit. You only need to contact one bureau, and federal law requires it to notify the other two. A credit freeze, also called a security freeze, blocks anyone, including you, from opening new credit in your name until you lift it, but you have to contact all three bureaus separately: Equifax at 1-800-349-9960, Experian at 1-888-397-3742, and TransUnion at 1-888-909-8872.

A credit freeze is the stronger protection after a confirmed Social Security number exposure, since it blocks the main path to new-account fraud. Request your free credit report at AnnualCreditReport.com, the only source authorized under federal law to provide free reports from all three bureaus, to check for accounts you did not open.

Business Response: What to Do in the First 24 Hours

If your organization experienced a data breach, the first 24 hours decide whether you contain the damage or face compounding regulatory penalties, lawsuits, and reputational harm. Business response differs from individual response because legal obligations, regulatory deadlines, and a forensic investigation all have to be managed at the same time.

Contain first: isolate affected systems, revoke compromised credentials, and block the attack vector you identified. Don't wipe or rebuild systems right away. Preserving forensic evidence matters for understanding what happened, meeting legal obligations, and supporting an insurance claim or litigation. The FBI recommends preserving evidence before cleaning infected systems, since it supports root cause analysis and possible law enforcement involvement through IC3.

Activate your incident response plan immediately. If you don't have a documented plan, this incident is the reason to build one, but respond with whatever structure you have right now. Engage breach counsel and a forensic cybersecurity firm in parallel, not sequentially: counsel protects you from regulatory missteps, and forensic investigators identify the root cause and scope.

Notify your cyber insurance provider as early as possible. Most policies have strict notification requirements, and your insurer may have preferred vendors that reduce your out-of-pocket cost. Waiting on this notification is one of the most common and expensive mistakes organizations make in the early hours of a breach.

Legal and Regulatory Notification Requirements

Every U.S. state has a data breach notification law, and requirements vary in timing, scope, and penalties. Your obligation is based on where affected individuals live, not where your business is located, so a breach touching customers in multiple states can trigger several different notification requirements at once.

Federal Requirements by Industry

Healthcare (HIPAA): Covered entities and business associates under the Health Insurance Portability and Accountability Act must notify affected individuals within 60 days, report to the Department of Health and Human Services within 60 days for breaches affecting 500 or more people, and notify local media when 500 or more residents of a single state are affected. According to IBM's Cost of a Data Breach Report 2024, the average healthcare breach cost $9.77 million, well above the all-industry average. For more on covered entity obligations, see our guide to building a healthcare data security plan.

Financial services (FTC Safeguards Rule): The FTC Safeguards Rule requires non-bank financial institutions, including many tax preparers, mortgage brokers, and accountants, to notify the Federal Trade Commission within 30 days if a breach affects 500 or more consumers. Our guide on the FTC Safeguards Rule's qualified individual requirement covers how the rule applies to tax and accounting firms. Noncompliance can expose a firm to FTC enforcement action, which can include fines and mandated security audits.

Public companies (SEC): Publicly traded companies must evaluate whether a breach is material under the SEC's 2023 cybersecurity disclosure rules. If it is material, the company must file a Form 8-K, a report disclosing significant events to investors, within 4 business days of that determination.

State Notification Laws

State breach laws vary widely. California requires disclosure "in the most expedient time possible." New York's SHIELD Act requires notification "without unreasonable delay." Florida and Colorado set fixed deadlines of 30 days or fewer. Because state laws can overlap and conflict in a multi-state incident, legal counsel should be involved early for any business with customers across state lines. Tax and accounting firms should also review our guide to state-by-state breach notification requirements for tax preparers.

What Your Breach Notification Must Include

Regulators, class action attorneys, and reporters read breach notification letters closely. At minimum, yours should explain what happened and when, which data types were exposed, what you have done in response, what recipients should do to protect themselves, and how to reach you with questions. Avoid minimizing language such as "limited incident" or "no evidence of misuse." For breaches involving Social Security numbers, financial account numbers, or medical records, plan to offer at least 12 to 24 months of credit monitoring and identity restoration at no cost to those affected.

Preventing Future Data Breaches

A data breach should push you to fix the gaps that allowed it, not just clean up the immediate damage. The same vulnerabilities that enabled one breach often enable a second one if you leave them unresolved.

For individuals, that means using a password manager for unique passwords, turning on MFA everywhere it's offered, and watching for phishing attempts that use details from the breach to look more convincing than a generic scam email. Keep your operating system, browser, and apps updated, since many breaches exploit known vulnerabilities that a security patch would have closed, and review which third-party apps have access to your accounts.

For organizations, work with your forensic firm to identify the root cause and any related vulnerabilities still present in your environment. Put mandatory security awareness training in place for all employees, especially if the breach involved phishing or social engineering, and review third-party vendor access at least once a year, since a vendor with access to your systems is a risk surface that's easy to overlook until a breach traces back to a supplier.