Last updated: November 2, 2026 · By Sanket Goyal
Here is what to do after a data breach: first work out exactly what was exposed, then change the affected password, call your bank if card or account details leaked, and lock down your credit. In the US that means a free credit freeze. In India it means watching your bank alerts closely and pulling your free credit report. Do those in the first 48 hours and most of the real damage is off the table.
Breach emails have become so common that a lot of people now ignore them. I get why. But ignoring one is how a leaked password from a forgotten shopping account turns into a hijacked email inbox six months later. The fix is not complicated. It is a short, boring checklist, and boring is exactly what you want here.
First, check the notice is real
Scammers love breach news. When a big company makes headlines for a leak, fake “your data was exposed, click here to secure your account” messages often follow. So step zero is simple: do not click anything in the message.
Open the company’s app or type its website address yourself. If there really was a breach, it will be on their official site or in your account notifications. The US Federal Trade Commission gives the same advice: don’t respond to unexpected calls, texts or emails, and contact the company through a website or phone number you already know is genuine.
Picture a freelance graphic designer who gets a breach email from a stock-photo site she used once in 2021. The real move is to open that site in a fresh browser tab, sign in, and see what it says. Not to tap the big blue button in the email.
What was leaked decides what you do next
Every breach notice should say what data was involved. Read that part twice. It changes your plan more than anything else.
| What was exposed | What to do first | How urgent |
|---|---|---|
| Password or login | Change it, plus anywhere you reused it. Turn on two-step verification | Today |
| Debit or credit card number | Call the bank using the number on your card and ask for a replacement | Today |
| Bank account details | Tell your bank, watch every alert, report unknown debits at once | Today |
| US Social Security number | Freeze your credit at all three nationwide bureaus | Within 24 hours |
| Phone number or email | Expect targeted scam calls and messages; tighten your SIM security | This week |
| Name, address, date of birth | Watch for phishing that uses these details to sound legit | Ongoing |
If the notice is vague and just says “personal information”, assume the worst reasonable case and work down the table.
Hour 0 to 6: passwords and payment cards
Change the password, then hunt for reuse
Change the password on the breached account first. Then think hard about where else you used the same one. The FTC’s breach guidance says it plainly: if you used the same password anywhere else, change that too. This is the step people skip, and it is the one attackers count on, because they take leaked email and password pairs and try them on other sites.
Make the new password long. A short phrase of four or five random words is easier to remember and harder to guess than a jumble of eight characters. And switch on two-step verification wherever it is offered. An authenticator app is better than SMS codes if you can manage it.
Cards and bank accounts
If a card number leaked, call your bank or card issuer and ask them to cancel it and send a new one. Use the number on the back of the card or on your statement, never one from the breach message. Remember to update any automatic payments that used the old card.
For Indian readers, speed matters for a very specific reason. Under the Reserve Bank of India’s rules on unauthorised electronic transactions, when a fraud comes from a breach elsewhere in the system (not your bank’s fault, not yours) and you report it within three working days of getting the bank’s alert, your liability is zero. Report it in four to seven working days and your loss per transaction is capped. Wait longer and it depends on your bank’s own policy. Once you report it, the bank has to credit the disputed amount back to you within 10 working days while it investigates.
That is a strong reason to keep SMS alerts switched on for every account. A retired schoolteacher who checks her messages once a week could miss that three-day window without ever doing anything careless.
Hour 6 to 24: lock down your credit
In the US: freeze it
A credit freeze stops anyone, including you, from opening new credit in your name while it is in place. According to the FTC, it is free to place and free to lift, it lasts until you lift it, and it does not affect your credit score. You need to contact all three nationwide credit bureaus separately.
If you need to apply for a loan later, you can lift the freeze temporarily at the bureau the lender uses, then put it back.
You can also add a fraud alert. It is free, lasts one year and can be renewed, and you only need to contact one bureau because that bureau must pass it on to the other two. A fraud alert tells lenders to verify your identity before opening an account. A freeze is stronger. I would do the freeze first and treat the alert as a bonus.
If the breached company offers free credit monitoring, take it. It costs you nothing and it can flag a new account or a credit check you did not expect.
In India: pull your free credit report
RBI rules require each credit information company to give individuals one free full credit report, including the credit score, once every calendar year (January to December). There are four such companies in India. So you can check up to four reports a year at no cost, and right after a breach is a sensible time to use one.
Look for loans or cards you never applied for and enquiries you do not recognise. If something is wrong, raise it with the credit bureau and the lender straight away.
Hour 24 to 48: report, record and watch
Where to report
- US: if someone has already used your information, report it at IdentityTheft.gov, the FTC’s site, which builds a personal recovery plan. Scams and fraud can also be reported to the FTC at ReportFraud.ftc.gov.
- India: victims of financial cyber fraud can call the national helpline 1930. Complaints can also be filed on the National Cyber Crime Reporting Portal (cybercrime.gov.in), run by the Ministry of Home Affairs.
Keep a simple record
Save the breach notice, note the date you got it, and jot down every call you make: who you spoke to, the date, and any reference number. It feels like overkill. It is not. If a dispute drags on, that little log is what gets your money back.
Keep checking
In the US, you can check your credit reports from all three bureaus every week for free at AnnualCreditReport.com, the only site authorised for the free reports. The FTC warns that lookalike sites exist, so type that address carefully.
The scam wave that comes after
Here is the part most guides underplay. The breach itself is often not the main threat. The follow-up is.
Once criminals have your name, phone number and the fact that you are a customer of a certain company, they can write a very convincing message. “Hi, this is the fraud team. We are calling about the recent breach. To secure your account, please read out the code we just sent.” That code is the key to your account.
My rule is blunt: never read out an OTP, PIN or password to anyone who calls you, whoever they say they are. Hang up and call back on the official number.
If your phone number was part of the leak, it is also worth reading my guide on how to prevent SIM swapping on Android and iPhone, because a leaked number plus a few personal details is exactly what a SIM swap attempt starts with.
What companies now owe you in India
India’s Digital Personal Data Protection Rules, 2025, notified in November 2025, require a company that suffers a personal data breach to tell each affected person without delay. The notice has to explain what happened and when, the likely consequences for you, what the company is doing about it, the steps you can take to protect yourself, and who you can contact with questions.
There is a catch on timing. As notified, that duty is part of an 18-month phase-in, so it takes full effect around May 2027. Until then, you may still hear about some breaches from the news before you hear from the company. One more reason to act on your own checklist rather than wait.
My quick 48-hour checklist
- Verify the notice through the official app or website, not the email link.
- Change the breached password and any reused copies. Turn on two-step verification.
- Call your bank if card or account details leaked, and keep SMS alerts on.
- US: freeze your credit at all three bureaus. India: pull a free credit report.
- Report actual fraud: IdentityTheft.gov in the US, 1930 or cybercrime.gov.in in India.
- Treat every “we’re calling about the breach” call as a scam until proven otherwise.
If the breach was at a crypto platform rather than a shop or app, the steps are a bit different, and I cover them in what happens if a crypto exchange gets hacked. And if a payments app you rely on is in trouble, my guide to Paytm Payments Bank alternatives shows how to move your money and bills calmly.
FAQ
What should I do first after a data breach?
Check the notice is genuine by going to the company’s official app or website yourself. Then change the affected password, and any other account where you used the same password, and turn on two-step verification.
Does a credit freeze hurt my credit score?
No. In the US, the FTC says a credit freeze does not affect your credit score. It is free to place and lift, and it lasts until you lift it.
Can I freeze my credit in India?
The credit freeze described here is a US system run through the three nationwide US credit bureaus. In India, the practical steps are to keep bank SMS alerts on, report unauthorised transactions fast, and check your free annual credit report from each credit information company.
How quickly should I report fraud to my bank in India?
As fast as you can. Under RBI rules, if a fraud comes from a third-party breach and you report it within three working days of the bank’s alert, your liability is zero. Delays of four to seven working days cap your loss, and after that your bank’s policy applies.
Where do I report identity theft?
In the US, report it at IdentityTheft.gov. In India, call the 1930 helpline for financial cyber fraud or file a complaint on the National Cyber Crime Reporting Portal.
