Steps To Take After A Data Breach

Confirm the breach and what was stolen

Online scammers sometimes claim a data breach has occurred in the hope of extracting passwords, bank account numbers, or other key info. Don’t respond directly to a suspicious email about a data breach. Instead, go to the company’s website or phone them to confirm that a breach has occurred and try to determine exactly what was stolen. This is crucial to figuring out what steps to take next; if the breach only involved credit card account numbers, those accounts are easy to cancel or change. But a breach involving your Social Security number, driver’s license, or other personally identifiable information (PPI) will require more extensive action on your part.

Change and strengthen your login data

After confirming that there really was a breach, you should immediately change and beef up your passwords, security questions, and other login information for any breached accounts (or other accounts using similar passwords). There are several resources that can make it more difficult for intruders to access your information, such as two-factor authentication. If you’ve been putting off enhancing your data privacy, now’s the time to get busy.

Notify credit reporting agencies and others

Federal law allows you to request one free credit report a year, and access to the reports has become even easier during the pandemic. Check for any suspicious activity on your report, but don’t stop there. You should notify at least one of the big three reporting agencies (Equifax, Experian, TransUnion) if you believe you have experienced a breach of financial data. You may want to put a credit freeze on your report, which prevents any new accounts, loans, or services being opened in you name, or a fraud alert, which can last from 90 days to up to seven years. You should also consider filing a local police report, to document the situation before the fraudsters get busy. Other responses will depend on what sort of information was stolen; contact Medicare if that data was breached, or the DMV about your driver’s license, and so on.

What can the breached company do for you?

Often companies that have experienced a data breach will offer their customers some form of assistance in dealing with the fallout from the breach, such as a free credit monitoring service for a year. While you should definitely consider offers to help, you should also be careful that you’re not waiving any claims or signing away your rights by accepting such offers. You may want to consult a lawyer before agreeing to accept the company’s assistance, especially if you have reason to believe the company has not been transparent about the scope of the breach or timely in notifying its customers of the incident.

Remain vigilant

When your personal info is at stake, it’s not enough to simply cancel or change a few accounts. Personal data is traded on the dark web and may not surface in a fraud plot, such as a phony income tax return or unemployment claim, until months or years after the breach occurred. It’s important to continue to monitor your credit card statements, healthcare savings accounts, credit reports, or other pertinent records for unusual charges or activity, so you can respond quickly if a threat emerges.

Keep track of your time and damages

If the data breach turns out to be a major one, requiring you to devote considerable time and expense to monitoring your accounts, repairing your credit, replacing your identification, and so on, you may want to consider consulting a class-action lawyer experienced in data breach claims. While the hackers typically remain elusive, in some cases the victims of a breach have successfully banded together to battle companies that have been negligent in protecting their personal data, holding them accountable for losses the customers have suffered as a result of inadequate cybersecurity measures.