What should you do when you receive a data breach notice?

Data breach notices tell us that our personal data has been compromised. In 2024 alone, major data breaches occurred at National Public Data, Change Healthcare, and Ticketmaster, putting millions of consumers at risk of financial fraud and identity theft.

“On average, we have seen between eight and nine data breach incidents each day,” he said weiqing sundirector of the master’s degree in cybersecurity at the University of Toledo. “There will be more frequent and larger data breaches that will continue to affect all of us.”

If you receive a data breach letter in the mail, don’t ignore it. It will inform you that an unauthorized party has gained access to internal company data and may possess your personally identifiable information, such as your name, phone number, Social Security number, and more.

Here’s everything you need to know about data breach notices.

What’s in a data breach notice?

Data breach notices typically include the following information:

• Details about how and when the violation occurred
• A list of your personal data that could have been leaked to hackers
• An explanation of what the company is doing to protect your data after
• Tips to help you keep your identity secure

Companies will periodically pay for free credit monitoring or identity theft services for affected customers. Activation codes are provided in the letter, but you must create the account yourself to take advantage of the offer. Depending on the severity of the breach, free coverage lasts up to two years in most cases.

Identity theft protection services help monitor your sensitive data on the dark web. Sometimes these services can alert you that your data has been compromised before you even receive a notice. Most importantly, they come with identity restoration services if your identity is stolen.

“Try to take advantage of those services to get protection,” Sun said.

When and how will a company send me a data breach notice?

All states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands have laws passed require companies to notify customers about data breaches. The time period varies by state, but notices are typically sent within 60 days of discovery of the data breach.

Data breach notices arrive by mail. If you receive a notice for email, text message or phone callIt’s probably a scam. If you have any doubts about the legitimacy of a notice claiming your sensitive data has been compromised, contact the company directly or search online for coverage of the breach, Sun said.

In addition to affected customers, businesses that suffer a cyber attack can alert state attorney general offices, law enforcement, the three major credit bureaus, and the Securities and Exchange Commissiondepending on the severity of the violation or state regulations.

What should I do if I receive a letter in the mail?

If you receive a notice of a data breach in the mail, follow the advice in the letter and take it seriously. You should be alert for phishing attacks and regularly check your Experian, TransUnion, and Equifax credit reports for unauthorized accounts opened in your name.

If the company offers free identity theft protection, sign up. Once your membership expires, you’ll need to decide whether to pay to continue the service or subscribe to another provider.

If your data is involved in another data breach in the future, you can register to receive additional free services that will be offered to you later.

What are some steps I can take to protect my data?

Even if you’re not using an identity theft protection service, here are four things you can do for free to protect yourself:

1. Change your password on the breached account, along with any other accounts with the same login credentials.

2. Review your credit and debit card statements at least once a month and look for any anomalies.

3. Freeze your credit so that no one can apply for a line of credit in your name (you will have to unfreeze it yourself if you want to open a new account)

4. Be on the lookout for phishing attacks by cybercriminals who use your leaked information to trick you into sharing your financial account information or other sensitive data.