If the letter mentions a Social Security number, financial account, or government ID, start with the free credit-freeze path: how to freeze your credit.

Step 1: Triage – what kind of data?

Find the “what information was involved” paragraph in the letter. It puts you on one of two tracks:

• Password/email track: credentials, email addresses, account data → Steps 2 and 5.
• SSN/financial track: Social Security numbers, bank or card details, government IDs → everything below, starting with Step 3 today.

Step 2: The first hour (password track)

Step 3: If SSN or financial data was exposed – freeze your credit

A credit freeze blocks anyone from opening new credit in your name. It’s free by law, takes about 20 minutes for all three bureaus, and doesn’t affect your score or existing cards. Do all three – fraudsters apply wherever you didn’t freeze: Equifax, Experian, and TransUnion, online or by phone. You can unfreeze (“thaw”) temporarily whenever you legitimately apply for credit. A fraud alert (one call, the bureau notifies the others) is a lighter-weight option, but the freeze is the one that actually blocks accounts.

Step 4: That “free credit monitoring” offer in the letter

Take it – it costs nothing and you gain alerts. But know what it isn’t: it typically monitors one bureau, it expires in 12-24 months, and it detects fraud rather than preventing it. The freeze prevents; the monitoring notices. Accepting the offer also rarely waives your legal rights anymore, but skim the terms for arbitration clauses before enrolling.

Step 5: The 12-month watch-list

Every publicized breach is followed by a phishing wave impersonating the breached company – “click here to claim your protection.” Expect it, and go to websites directly rather than through email links. Also watch for: unfamiliar charges (even tiny “test” ones), mail about accounts you didn’t open, tax returns rejected as duplicates, and debt collectors calling about unknown debts.

Step 6: When paid monitoring makes sense

If your household has been through more than one breach, has children whose records may go unchecked for years, or wants restoration help handled by someone else, paid monitoring can be useful. Start with the free steps first: freeze credit where relevant, replace reused passwords, enable two-factor authentication, and keep the breach letter.

How to read the letter without getting pulled into a scam

Real breach letters are often followed by fake breach emails. Treat every link as suspect until you verify it. Type the company address yourself, use the phone number on the back of a card or an official statement, and avoid logging in from an email button. If the letter offers free monitoring, start from the company’s official breach notice or the provider’s official enrollment page, not from a forwarded message.

Keep the letter. Save a PDF or photo, note the date received, the data involved, the monitoring deadline, and any case or enrollment code. If fraud appears later, that record helps you explain the timeline to banks, credit bureaus, insurers, employers, or law enforcement.

Family triage: who needs action?

Do not only check the person who opened the letter. A workplace, school, health provider, or service account may expose spouses, children, dependants, beneficiaries, or emergency contacts. Children are easy to overlook because they usually have no credit file activity to monitor. If a child’s Social Security number was involved, read the FTC and bureau guidance for a child credit freeze and expect extra identity paperwork.

If the breach involved a shared email address, a family phone plan, a password reused across household accounts, or a cloud account used by several people, treat it as a household cleanup. Change reused passwords, protect the email account first, then work through bank, mobile provider, Apple, Google, Microsoft, and password-manager recovery settings.

The checklist

Recover accounts from a network you trust

If you are changing email, bank, cloud storage, or identity-recovery passwords after a breach, do it from your home network, mobile data, or a reputable VPN on shared Wi-Fi. The VPN does not fix the breach or stop follow-up phishing. It only reduces the risk of doing sensitive recovery work over a network you do not control.