Personal data incident guide: breach notices, account takeover, phishing, identity theft, containment, and recovery

What to take away

Verify an alert through a known route before clicking its links or calling its numbers.
Match the response to the exposed data and observed misuse.
Secure the email, phone number, password manager, and recovery routes that can reset other accounts.
Preserve a narrow factual record before changing settings or deleting messages.
Account takeover, payment fraud, identity theft, malware, and personal-safety exposure need different responders.
Keep a dated recovery log and continue monitoring after the first password change.

A breach notice says an organization lost control of data. It does not prove that every listed field belonged to you, that a named person used it, or that all your accounts were entered. Treat the notice as a prompt to verify scope and reduce plausible harm.

Start with immediate safety

If the incident includes threats, stalking, intimate material, physical access, a missing device, or exposed home details, decide whether to move to a safer place and contact suitable local help. Do not confront a suspected person or remove access if that step could increase danger.

For a work, school, health, financial, or government account, notify the responsible security or privacy team through a known channel. Its incident process may require evidence preservation or administrator action before a user resets anything.

Verify the notice

Open the organization's app or type its known address. Look for a matching notice, date, incident description, exposed fields, affected period, recommended actions, and contact route. Confirm it against the organization's own notice page, your state attorney general's data-breach listing, or — for health data — the U.S. Department of Health and Human Services breach portal. Compare sender domains carefully. Do not supply credentials, verification codes, payment, remote access, or identity documents to an inbound caller.

Record the original message and headers when available. Note how it arrived and whether it contains a deadline. A legitimate incident can attract phishing and copycat scams, so the truth of the breach does not make every related message safe.

Handle phishing

Phishing is a message, call, or site that impersonates a trusted sender to make you click a link, open an attachment, or hand over a password or one-time code. A real breach often triggers fake notices that copy the organization's branding, so treat every related message as phishing until you confirm it through a known route.

Do not use the link or attachment, and never enter a password, one-time code, or card number on a page you reached from a message. If you already entered credentials, change that password from a trusted device, sign out active sessions, and review forwarding, filters, delegates, and app passwords.

Report the attempt. Forward it to the abuse or security address of the company being impersonated, use your email provider's report-phishing button, and file a report with the FTC at ReportFraud.ftc.gov. Report internet crime — including phishing, spoofed domains, and business email compromise — to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.

Classify what was exposed

Create an evidence-based list:

Exposed Data and Follow-Up Risks

Data or control

Password or password hash: Login attempts and reuse
Email account access: Resets, forwarding, impersonation
Phone number or carrier account: Porting, SIM change, reset interception
Card or bank details: Unauthorized payment
Government identifier: New-account and benefit fraud
Address or family details: Harassment or targeting
Health or employment record: Discrimination, fraud, confidentiality harm

Plausible follow-up risk

Password or password hash: Affected and reused accounts
Email account access: Sessions, recovery, rules, sent mail
Phone number or carrier account: Carrier account and service status
Card or bank details: Issuer or bank records
Government identifier: Official identity-recovery route
Address or family details: Personal-safety plan and public exposure
Health or employment record: Named provider or employer process

First review

Password or password hash
Email account access
Phone number or carrier account
Card or bank details
Government identifier
Address or family details
Health or employment record

Data or control	Plausible follow-up risk	First review
Password or password hash	Login attempts and reuse	Affected and reused accounts
Email account access	Resets, forwarding, impersonation	Sessions, recovery, rules, sent mail
Phone number or carrier account	Porting, SIM change, reset interception	Carrier account and service status
Card or bank details	Unauthorized payment	Issuer or bank records
Government identifier	New-account and benefit fraud	Official identity-recovery route
Address or family details	Harassment or targeting	Personal-safety plan and public exposure
Health or employment record	Discrimination, fraud, confidentiality harm	Named provider or employer process

Do not claim that a risk occurred merely because it is possible. Mark observed activity separately from anticipated activity.

Protect control accounts first

Use a trusted, updated device. Secure the primary email, password manager, mobile carrier, and recovery email. At the carrier, set an account passcode, ask for a port freeze or port-out PIN, and turn on number-transfer alerts. If your number is ported without your consent, report it to the carrier at once and file a complaint with the Federal Communications Commission (FCC). Review recovery phone numbers, passkeys, security keys, authorized apps, active sessions, app passwords, forwarding, filters, delegates, and recent security changes.

Secure Control Accounts First

Use a trusted, updated device
Secure primary email, password manager, mobile carrier, recovery email
Review recovery phone numbers, passkeys, security keys
Review authorized apps, active sessions, app passwords
Check forwarding, filters, delegates, recent security changes
Replace exposed or reused passwords with unique values
Turn on strong authentication and save recovery material

Replace exposed or reused passwords with unique values. Use the service's sign-out controls. Turn on strong authentication and save recovery material away from the signed-in device. A password change may not invalidate every token, app password, linked account, or mail rule.

Recover a hijacked account

Account takeover means someone else is signed in and can lock you out. Report it through the provider's official account-recovery or account-hacked page — for example, Google's account recovery or Microsoft's account recovery form — and never through a link in a message. Work from a trusted device on a network the attacker does not use.

If you cannot get back in, check whether the recovery address or phone number was changed, dispute the change through the provider's recovery form, and ask the provider to review recent logins, active sessions, and any forwarding or mail rules that were added. If the account held money, health records, or government services, tell the provider in writing and keep the case number.

Respond according to the data

The FTC's IdentityTheft.gov — the agency's lost or exposed information tool — branches by whether information was misused and by data type. It covers credit reports, freezes, fraud alerts, monitoring, online logins, financial details, government identifiers, and other records, and it builds a personal recovery plan with pre-filled dispute letters and an official FTC Identity Theft Report. It supports a tailored response, not a conclusion that identity theft occurred.

For payments, contact the card issuer, bank, transfer service, gift-card company, cryptocurrency platform, or delivery carrier through its verified fraud route as quickly as possible. Preserve transaction identifiers and communications.

For identity misuse, use the official reporting and recovery process for the relevant country and document type. In the United States, that means an identity theft report from the FTC at IdentityTheft.gov plus a police report from your local department; both are the records companies ask for when you dispute fraudulent accounts. Report a misused Social Security number to the Social Security Administration and request an IRS Identity Protection PIN to block tax-return fraud. Contact the company where the fraudulent account or transaction appeared.

The three nationwide credit bureaus — Equifax, Experian, and TransUnion — hold the credit-file protections. Under the Fair Credit Reporting Act (FCRA) you can place a free one-year fraud alert through one bureau, which must notify the other two; with an identity theft report it becomes an extended seven-year alert. You can also place a free credit freeze with each bureau, and order your free credit reports through AnnualCreditReport.com. A credit freeze affects access to a credit file; it does not secure email, stop existing-account charges, or erase public data.

For malware or remote access, stop entering secrets on the affected device. Disconnect it when safe, preserve evidence needed by an employer or investigator, and use trusted technical support. Change important credentials from a different trusted device after the affected system is contained.

Warn affected contacts narrowly

If an account sent fraudulent messages, tell recipients through another known route. State the account, approximate period, and action to avoid. Do not repeat sensitive exposed information or speculate about an attacker.

If files or messages were accessed, identify whose information appears in them. An organization may have legal notice duties. Get qualified advice rather than sending an improvised mass disclosure.

In the United States there is no single federal breach-notification law; each state has a data-breach notification statute, usually with its own deadline, content rules, and attorney general filing. Health data adds the HIPAA Breach Notification Rule, which requires notice to affected people within 60 days of discovery, and the HHS breach portal publishes reported breaches. If people in the EU or UK are affected, the GDPR requires notifying the supervisory authority within 72 hours of learning of a breach that risks their rights.

Keep a recovery log

Record dates, case numbers, people contacted, URLs used, accounts changed, sessions removed, evidence saved, reports filed, monitoring dates, and unresolved questions. Store the log securely. Redact sensitive identifiers before sharing it.

Recovery Log Checklist

Record dates, case numbers, people contacted
Note URLs used, accounts changed, sessions removed
Save evidence, reports filed, monitoring dates
Store the log securely and redact sensitive identifiers
Set follow-up reminders for later fraud
Close incident only when containment, recovery, notification, monitoring have owners

Set follow-up reminders. New-account fraud, tax issues, impersonation, and reused-password attempts can appear later. Close the incident only when immediate containment, recovery, notification, and scheduled monitoring have owners.

Common questions

Should I click a breach notice to reset my password?

Use the organization's known app or type its address. Verify the notice before acting.

Does exposed personal information mean my identity was stolen?

No. Exposure creates risk. Identity theft involves unauthorized use of identifying information.

Which password should be changed first?

Prioritize the account that was exposed and control accounts that can reset others, especially primary email and password management.

How long should evidence be kept?

Keep what a provider, insurer, employer, regulator, court, or recovery process may require, then apply a secure retention rule. Avoid collecting unrelated private material.