Data Breach: What to Do Step by Step (2026 Checklist)

Why the first hour matters

A breach is stolen or unauthorised access to data an organisation holds about you. According to the UK NCSC, criminals can use that information to build phishing messages that seem personal, when in reality they are sending millions. They also exploit well-known breaches while the news is fresh, even when your details were not taken.

Fraud losses show why speed is worth it. The FTC told Congress that in 2025 consumers submitted 3 million fraud reports and reported $15.9 billion in losses, and that this is only a fraction of the real total because many victims never report. Most of the steps below close a door before anyone has tried it.

The ten steps

1. Confirm the notice is real. Do not use links or phone numbers in the message. Go to the organisation’s official website or app, or its verified social media account, and look for a breach notice there. The UK NCSC advises contacting the organisation this way to confirm whether a breach occurred, how you are affected, and what you need to do.
2. Find out what was exposed. The notice should say which details were involved: email, password, phone number, card number, bank account, Social Security number, or ID. The FTC’s IdentityTheft.gov/databreach page gives steps based on the type of information exposed. Your next moves depend on this list.
3. Change the exposed password, and everywhere you reused it. Start with your main email account, because it can reset all the others. Use a long, unique password for each account, ideally from a password manager. If a passkey is offered, use it instead.
4. Turn on passkeys or two-step verification. The NCSC calls two-step verification the first and most important step and recommends passkeys as a first choice where offered. CISA treats passkeys and security keys as phishing-resistant. Authenticator-app codes are better than text-message codes.
5. Freeze your credit, or the equivalent where you live. In the US, place a free freeze with Equifax, Experian, and TransUnion. In the UK, consider Cifas Protective Registration. In Australia, request a free credit ban. A freeze stops new credit being opened in your name.
6. Check your accounts and credit reports. Look at bank and card statements, and at your free credit reports at AnnualCreditReport.com. Dispute any charge or account you do not recognise at once.
7. Expect breach-themed phishing and do not click. Criminals may send messages that pretend to come from the breached company, or from your bank, weeks later. Real organisations do not ask you to confirm a password or card by link. Go to the site yourself.
8. Lock down your phone number against SIM swapping. If your phone number or account details were exposed, ask your mobile carrier to add a PIN or port-out lock, and move important accounts from text-message codes to an authenticator app or passkey.
9. Ignore fee-based “settlement” offers. If a message says you are owed a payout from the breach but must pay a fee, share your bank login, or act today, it is a scam. Check any real class action through the court or the company’s own notice, found by you.
10. Report identity theft if it happens. If someone uses your details, report it at IdentityTheft.gov in the US and get a recovery plan. In the UK, tell your bank and report to Action Fraud. In Australia, contact IDCARE and report through ReportCyber.

What to do depending on what leaked

The ten steps above apply to most breaches. The order of priority changes with the type of data.

• Email and password only: change that password and any reused ones, then add two-step verification. A credit freeze is optional, but harmless.
• Phone number: expect scam calls and texts, and do steps 7 and 8. Be ready to hang up on anyone who says they are from the breached company and asks for a code.
• Card number: call the card issuer using the number on the card, and ask for a replacement. Review your statements for charges you do not recognise.
• Bank account number: tell your bank, ask about extra account monitoring, and watch for unauthorised debits.
• Social Security number, date of birth, or government ID: freeze your credit at all three bureaus, order your free credit reports, and check them for accounts you do not recognise. This is the FTC’s advice for a Social Security number breach.
• A child’s details: the FTC says you can ask for a free credit freeze for a child under 16, which makes it harder for someone to open accounts in their name.

If the notice does not say what was taken, assume the worst for the data you gave that company, then work down this list. The NCSC makes the same point about high-profile breaches in general: even when your details were not stolen, scammers use the news to try to trick people.

Keep a record

Write down the date of the notice, the company’s name, what it said was exposed, and each step you took. Save the notice from the company’s real website, not just the email. If your identity is misused later, a clear timeline makes disputes with banks and lenders faster. If the company offers free credit monitoring, the FTC advises accepting it, but read the offer on the company’s own site before you enrol.

Passwords, passkeys, and codes in more detail

The NCSC’s advice on strong passwords is to join three random words into a long, easy-to-remember password, and to avoid anything guessable from social media such as pet names or dates. A password manager can generate and store a unique password for every account, so one breach does not open the others.

For the second layer, CISA’s guidance describes passkeys and security keys as phishing-resistant. It says text-message codes are not, and authenticator codes are better than text codes but can still be phished. If you must use a code, never read it out to anyone who calls or texts you, even someone who sounds like your bank.

Credit freezes by country

United States

The FTC says placing or lifting a freeze is free and does not affect your credit score. Contact all three bureaus: Equifax, Experian, and TransUnion. A freeze at one is not shared with the others. Equifax says you can place a freeze online with a free account or by phone, and Experian offers online, phone, and mail options. To apply for credit later, lift the freeze only at the bureau the lender will use.

A fraud alert is a separate free tool. It does not block access to your report. It asks businesses to check with you before opening an account. Children under 16 can also have a freeze placed on their behalf, which matters if a breach exposed a child’s details.

United Kingdom

There is no direct freeze. Cifas Protective Registration adds a warning flag against your details in the National Fraud Database for two years and prompts lenders to run extra checks. It does not block applications outright. Cifas lists the fee as £30 for two years, though some older guides still say £25. The ICO advises people affected by a breach to consider it, and some companies pay for it after a breach, so ask.

Australia

You can apply for a free credit ban with a credit reporting body. According to IDCARE, the initial ban lasts 21 days, and you can ask for an extension of up to 12 months if you believe you are a victim or at risk. The body you contact must tell the others, but check each one confirms it. Request the extension before the first ban expires. IDCARE, the national identity and cyber support service, offers free help on 1800 595 160.

Scams that follow a breach

The NCSC describes a typical scam as a message that claims to be from the breached organisation and asks you to log in and verify your account because of “fraudulent activity”. The link leads to a site that looks right and stores what you type. If the stolen data included your phone number, expect calls too. The NCSC lists lures such as password resets, compensation, device scans, and missed deliveries.

That last one links to toll and delivery text scams. For emails and texts in general, use the phishing message checklist. If a caller says your account is in danger and you must move money, stop and read urgent payment requests. Fake shops that use stolen details are covered in online shopping scams.

Do not pay for “breach settlement” claims. If a message offers a payout but wants an upfront fee, your bank login, or a copy of your ID, it is a scam. Look for the official claim process on the company’s own site, which you reach yourself.

Where to report and get help

• US: IdentityTheft.gov for a free recovery plan, and ReportFraud.ftc.gov for scams.
• UK: report suspicious texts to 7726 and emails to report@phishing.gov.uk, per the NCSC. Report fraud through Action Fraud.
• Australia: IDCARE, Scamwatch, and ReportCyber.

Want to know whether a specific company has had a breach? See the latest breaches we are tracking.

Official sources

• FTC IdentityTheft.gov: Data breach
• FTC: Get a credit freeze to stop identity thieves
• UK NCSC: Data breaches, guidance for individuals and families
• Equifax: Credit freeze and Experian: Security freeze
• CISA: Implementing Phishing-Resistant MFA and Secure Our World
• IDCARE: Credit bans in Australia

Scambaba is an independent educational project and this guide is general information, not legal or financial advice. How these guides are researched is on the editorial policy.

Frequently asked questions