What to do if you're caught in a data breach

It’s an all too familiar feeling. You hear that a company you trust has suffered a data breach, and your sensitive information might be in the wrong hands. Unfortunately, large-scale breaches are becoming more common, affecting millions of people’s names, emails, addresses, frequent flyer information, and sometimes more sensitive details like medical records, account logins or credit card numbers.

If this happens to you, it might feel like there is nothing to do but wait, but there are a few things you can do to protect yourself or become more informed.

1. Find Out What Was Exposed

Start by confirming exactly what information may have been involved. Look for official communications from the company – if they have a good incident response team, they should be very transparent with what has happened. Check their website for a statement if no verified email has come through.  

Tip: Be cautious about follow-up scam emails pretending to be the company in order to get even more data from you. If you’re unsure, contact the company directly through their official contact channels.

2. Change Your Passwords Immediately

If login details were part of the breach, change your passwords straight away. Use strong, unique passphrases for each account. Don’t reuse the same password across multiple sites. If possible, enable multi-factor authentication (MFA) and a password manager.

3. Monitor Your Accounts and Credit

Keep an eye on your bank accounts, credit cards, and any affected services for suspicious activity. Many companies offer free credit monitoring or freezing services after a breach, which can be worth investigating if it’s confirmed that financial information was stolen. If you see something unusual, report it to your financial institution immediately.

4. Watch for Phishing Scams

Be extra cautious with emails, calls, or messages claiming to be from the breached company. Scammers often use breaches to trick people into giving away more information. Double-check the sender’s details, don’t click suspicious links, and never share passwords or codes. Don’t confirm or deny anything!

5. Consider a Fraud Alert or Credit Freeze

If sensitive details like your ID such as a license or credit card were stolen, consider placing a fraud alert or credit freeze with your local credit reporting agency. This makes it harder for criminals to open new accounts in your name.

6. Stay Informed

Follow updates from the company and reputable news sources so you know if there are new risks or actions you should take. Some breaches unfold over time as investigators discover more and a large breach will often be reported on in the news.

No one wants to be caught up in a data breach, but quick action can limit the damage. Stay alert, protect your accounts, and if you ever feel unsure  ask for help from your bank, a trusted source, or a security professional.

Want to strengthen your human risk management? Contact us today for a demo of our security awareness training platform.

‍