Your Data Was in a Breach: What to Do Next

If your data was in a breach, do three things first: change the password on the breached account and any account that shares it, turn on two-factor authentication, and place a free credit freeze at all three bureaus. Everything else — monitoring, removal requests, new cards — comes after those three. This guide walks you through the full list in the right order.

We're the editors at Getshure, a small American publisher based in Florida. We write plain-English books about scams and privacy, and we run a protection plan with the Getshure app that includes a breach check. We'll point out where our tools help, but every step below works whether you buy anything from us or not.

First, confirm the breach is real

Breach notices are also a favorite scam. Before you click anything, slow down for 60 seconds.

1. Check who sent it. A real breach notice usually comes from the company you already do business with. Look at the sender's full email address, not just the display name.
2. Don't click the link in the email. Open a new browser tab and type the company's website yourself, or use the app you already have installed. Log in there and look for a security notice.
3. Ignore urgent phone calls. If someone calls claiming your account was hacked and you must "move your money to a safe account," hang up. That's the scam, not the fix. See our guide on fake bank messages.

Once you've confirmed the breach is real — either through a letter, the company's own site, or a trusted news report — move on to the steps below.

Step 1: Change the password, the right way

Change the password on the breached account first. Then change it anywhere else you used the same password or a close variation. This is the single most important step, because password reuse is how one breach becomes ten.

• Use a long passphrase (four random words is stronger than "P@ssw0rd!").
• Never reuse a password across email, banking, or shopping accounts.
• If you can't remember them all, use a password manager — your phone or browser has one built in.

Our walkthrough on passwords and 2FA has the exact steps for iPhone, Android, and the main browsers.

Step 2: Turn on two-factor authentication

Two-factor authentication (2FA) means a thief needs more than your password to get in. Even if your login leaked, 2FA usually stops them cold.

1. Start with your email account — it's the master key to everything else.
2. Then your bank, retirement, and brokerage accounts.
3. Then social media (scammers love to impersonate you to your family).
4. Prefer an authenticator app or a security key over text messages when the option is offered.

Step 3: Freeze your credit at all three bureaus

A credit freeze stops new accounts from being opened in your name. It's free, it doesn't hurt your credit score, and you can lift it in minutes when you actually need credit. If your Social Security number, driver's license, or date of birth was exposed, do this today.

• equifax.com
• experian.com
• transunion.com

Create an account at each site, verify your identity, and place the freeze. Save the PINs they give you. For a longer walkthrough, see our credit freeze guide.

While you're at it, pull your free credit reports at annualcreditreport.com and look for accounts you don't recognize.

Step 4: Decide whether to replace the card or account

If the breach involved a credit card, debit card, or bank account number, call the number on the back of your card and ask for a new one. Don't use any phone number from the breach email.

For debit cards tied to your checking account, moving fast matters more — a thief with your debit card can drain real money before you notice. The Consumer Financial Protection Bureau has clear rules on your liability if you report quickly.

Step 5: Watch for the scams that always follow a breach

Once your data is out there, scammers combine it with other leaks to sound convincing. Expect a wave of:

• Phishing emails and texts that use your real name, address, or last four of a card.
• Phone calls claiming to be from "fraud protection" at your bank. Hang up and call the number on your card.
• Fake "account verification" pages that look exactly like the real site. Type the address yourself.
• AI voice calls that use a cloned voice of someone you know. Our guide on the family safe word is a 5-minute fix for this one.

You can report any scam attempt at reportfraud.ftc.gov and ic3.gov. See our reporting guide for what to include.

Step 6: If your SSN was exposed, add these extra steps

A leaked Social Security number is the worst case because it follows you for life. Beyond the credit freeze:

1. Create a my Social Security account before a thief does.
2. Create an IRS online account and request an Identity Protection PIN for your tax filings.
3. If you see signs of misuse, start a recovery plan at identitytheft.gov — it's the government's official step-by-step tool. We cover it in detail in our identity theft recovery guide.

Step 7: Remove your info from people-search sites

Data brokers scrape and sell your name, address, phone, relatives, and more. After a breach, that public profile makes it easier for a scammer to sound like they know you. You can file removal requests one site at a time (dozens of them) — or use a tool that does it in bulk.

Our data broker removal guide has the manual list. The Getshure app can do it for you continuously, which we'll explain below.

The Getshure app: built-in breach check

If you want to stop checking breach news by hand, the Getshure app (included with every Getshure protection plan) has a breach check built in. You enter the email addresses you use, and the app tells you whether your email or passwords appear in known data breaches — and keeps checking as new breaches get added.

In the same app you also get:

• Scam Shield — flags likely scam and spam calls and helps block robocalls.
• Data broker removal — sends opt-out requests to people-search sites on your behalf.
• Encrypted private vault — locks sensitive photos and documents behind Face ID or a passcode.
• Photo Guard — reverse-image search to see where your photos appear online.
• Tracker blocking and safer browsing on public Wi-Fi.
• Phone security score with specific steps to improve it.

No app can block every scam or leak — no honest company would claim that. What the Getshure app does is help you catch more, faster, and in one place. Read more about what it does and doesn't do in The Getshure App: What It Does and What It Can't Do.

To get it on Android, use the Getshure app on Google Play. On iPhone, use the download link in your Getshure order confirmation email. The activation guide walks through sign-in.

The book: Don't Get Screwed by AI

If you'd rather have the full playbook on paper — the kind you can hand to a parent or keep in a kitchen drawer — our hardcover Don't Get Screwed by AI ($29, free US shipping on orders $40+) covers data breaches, AI-powered scams, voice cloning, phishing, and recovery in plain English. It's the same practical approach as this article, with checklists you can actually use when you're stressed and short on time.

It ships from the US in 3–5 business days after the order ships, and like everything we sell, it's backed by our 30-day money-back guarantee.

A 10-point checklist you can save

1. Confirm the breach notice is real — don't click the email link.
2. Change the password on the breached account.
3. Change any password reused elsewhere.
4. Turn on 2FA for email, bank, and social accounts.
5. Freeze your credit at Equifax, Experian, and TransUnion.
6. Pull your free credit reports at annualcreditreport.com.
7. Replace any exposed card or account number.
8. Create SSA and IRS accounts if your SSN was exposed.
9. Remove yourself from data broker sites.
10. Install a breach check so you hear about the next one early.

Why trust Getshure to help

You're being careful — that's good. Here's what you can verify about us today, before you spend a cent:

• Getshure is a brand operated by MetaWise Enterprises, LLC, a Delaware limited liability company (file number 10336625). You can look it up on Delaware's public business search.
• Our address: 11772 W Sample Rd, Ste 103, Ofc 240, Coral Springs, FL 33065.
• Our phone: (754) 812-1679, Monday–Friday 9 AM – 6 PM ET. Email: contact@getshure.com.
• Clear pricing, written refund policy and subscription terms, and a 30-day money-back guarantee on every plan charge and add-on.
• One-step cancel at getshure.com/cancel — enter your order email, click the link, done. No phone call required.

Our website domain is new (2026), so you won't find years of third-party reviews yet. What you can check today — the company record, the address, the phone, the written policies — is what matters.

Your next step

If you've just gotten a breach notice, work the checklist above. Start with passwords and 2FA, then the credit freeze. Those three move you out of the danger zone fast.

If you want ongoing breach checks, data broker removal, and scam-call screening in one place, pick a Getshure protection plan and install the app. Prefer paper? Order Don't Get Screwed by AI and keep it where you'll actually use it. Questions first? Call (754) 812-1679 or email contact@getshure.com — a real person will answer during business hours.