Got a data breach letter?

What to do in the first hour, the first week and the first month after a company says your data was exposed.

1. Read what was taken. The letter must say what kind of data was exposed (for example name, Social Security number, card numbers or medical records) and when. Keep the letter.
2. Freeze your credit, free. Place a free freeze with Equifax, Experian and TransUnion. It blocks new accounts in your name, and you can lift it anytime. Official source
3. Change passwords and turn on two-step login. Start with email and banking. Use a different password everywhere, especially for the breached company's account.
4. Sign up for the free monitoring offered. Accepting free credit monitoring usually doesn't waive your rights. Read the enrollment terms before you click.
5. Watch statements and your free credit reports. You can get free weekly reports at AnnualCreditReport.com. Report any account you don't recognize. Official source
6. If someone used your identity. Report it at IdentityTheft.gov to get a recovery plan and an official report. Official source
7. Keep a record of your time and costs. Write down hours spent and any money lost. In breach claims, out-of-pocket losses and time often matter.
8. See if others are affected. Search Advicey Pools for the company's name. If many people were hit, you can join together.