Your data was in a breach? The free moves that actually protect you
A breach notice does not mean you are powerless. A free credit freeze, two-factor authentication, and an IRS Identity Protection PIN shut down the most damaging fraud. Here is exactly what to do, in order.
A breach notification feels like the damage is already done — but most of the real harm comes later, when someone uses your leaked details to open credit or file a tax return in your name. The good news: the moves that block that are free, fast, and within your control. Here’s what to do, in order.
Why this matters after a breach
Leaked data — names, Social Security numbers, logins — gets bought, sold, and tried over time. The goal isn’t to “undo” the breach; it’s to lock the doors it left open before anyone walks through them. A few free steps close the most damaging ones.
The free moves that actually protect you
In rough priority order:
- Freeze your credit at all three bureaus. A free security freeze at Equifax, Experian, and TransUnion stops new accounts being opened in your name — and, per the CFPB, it doesn’t affect your credit score. Lift it temporarily (also free) when you need to apply for credit.
- Turn on two-factor authentication, and stop reusing passwords. If you can only do one thing, enable MFA — it blocks logins even when your password leaks. A password manager makes unique passwords effortless.
- Get an IRS Identity Protection PIN (IP PIN). This six-digit code blocks anyone else from filing a tax return with your SSN, and the IRS issues it at no cost through your online account.
- Watch your statements and credit reports. Check for accounts, charges, or inquiries you don’t recognize, and act on anything unfamiliar.
If your information is already being misused
If you spot fraud — unfamiliar accounts, a rejected tax return, charges you didn’t make — report it and get a step-by-step recovery plan at IdentityTheft.gov, and contact the affected companies. The single highest-impact habit here is Freeze and Report. For the deepest dive on one of these moves, see the free credit freeze; and because leaked details power phone-number takeovers, pair this with SIM-swap protection. For more, see our defense moves and the 60-second quiz.
- You received a data-breach notification, or a password you reused has turned up in a known leak.
- Accounts, bills, or credit inquiries you don't recognize — or a tax return rejected because one was "already filed" in your name.
- Mail, calls, or login codes for services you never signed up for.
- Freeze your credit for free at all three bureaus (Equifax, Experian, TransUnion). It stops new accounts being opened in your name and does not affect your credit score.
- Turn on two-factor authentication and change any reused passwords. If you do only one thing, enable MFA.
- Get an IRS Identity Protection PIN (IP PIN) — a six-digit code, issued at no cost, that blocks anyone else from filing a tax return using your SSN.
- If something is already misused, get a recovery plan at IdentityTheft.gov and watch your statements and credit report for accounts you did not open.
Breach letters used to make me feel helpless — the horse has bolted, what's the point? But that's the wrong frame. Most of the real damage happens later, when someone opens credit or files a tax return in your name, and those are exactly the doors you can bolt shut for free in an afternoon. I think of it less as 'fixing the breach' and more as locking the doors the leak left open.
Sources
Frequently asked
A breach exposed my info but nothing bad has happened yet — do I still need to act?
Yes. Leaked data can sit unused for months before it's sold or tried. The strongest preventive moves are free and take minutes: freeze your credit at all three bureaus, turn on two-factor authentication, and change any reused passwords. Doing them now is far easier than cleaning up fraud later.
Does a credit freeze cost money or hurt my credit score?
Neither. As the CFPB states, you can freeze and unfreeze your credit records for free at the three nationwide credit reporting companies, and a security freeze does not affect your credit scores. You simply lift it temporarily (also free) when you want to apply for new credit.
What is an IRS Identity Protection PIN, and do I need one?
It's a six-digit number that, in the IRS's words, "prevents someone else from filing a tax return using your Social Security number". Tax-related identity theft is common after a breach, so an IP PIN is a strong, no-cost lock. You can request one through your IRS online account.