Data Breach Response Planner: What to Do in the First 30 Days

Most advice about data breaches is a list. A planner is different: it tells you when to do what, so you do not spend the first night after a breach wondering whether you have done enough. This planner is organized by time. It starts with the first hour, which is about stopping the bleeding, and runs through the first thirty days, which are about closing the gaps and watching for the aftershocks. It also includes a worksheet you can copy. Use it with the shorter explanations in what is a data breach and beyond credit monitoring.

1. Why a plan matters

Breaches are common and their effects are long. The FBI’s Internet Crime Complaint Center received 67,456 personal data breach complaints in 2025, with reported losses of about $1.31 billion, and 31,675 identity theft complaints with reported losses of $185.8 million (FBI IC3). The FTC received about 3 million fraud reports in 2025, with reported losses of $15.9 billion (FTC). The harm often arrives months later, when stolen data is used or sold. A plan helps you act early and keep acting.

2. Before anything else: three rules

Do not click links in the notice. Scammers imitate breach notices. Go to the company’s website by typing the address.
Do not pay anyone who contacts you about the breach. Real companies do not ask for payment to protect you.
Write things down. Keep a log with dates, names and reference numbers.

3. Hour 1: Understand and contain

Step 1: Read the notice carefully

Find out what was exposed. Was it an email and password, a Social Security number, a driver’s license, financial account numbers, health information or something else? The exposed data type determines the rest of your plan.

Step 2: Change passwords

Change the password for the affected account and any other account where you used the same or a similar password. Start with email, because it controls resets. Use a password manager to create unique passwords.

Step 3: Turn on two-factor authentication

Enable it on the affected account, email and financial accounts. Prefer an authenticator app or security key over text messages.

Step 4: Sign out other sessions

Most services have an option to sign out of all devices. Use it after changing the password.

4. Day 1: Block new fraud

Step 5: Freeze your credit

If your Social Security number, birth date or other identifiers were exposed, freeze your credit at each bureau. It is free under federal law and takes about half an hour. See what is a credit freeze.

Step 6: Consider a fraud alert

A fraud alert asks lenders to verify your identity. It can complement a freeze but is less protective on its own.

Step 7: Tell your bank and card issuers if financial data was exposed

Ask about replacing cards, adding alerts and new account numbers. Set up transaction alerts.

Step 8: Secure email recovery

Check forwarding rules, recovery phone numbers and connected apps on your email account. Attackers who get in often add forwarding rules.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

5. Week 1: Review and watch

Step 9: Review every important account

Check banking, payment apps, shopping accounts and cloud storage for unfamiliar activity. Download recent statements.

Step 10: Check your credit reports

You are entitled to free reports through the official channel described by the Federal Trade Commission at consumer.ftc.gov. Look for accounts, addresses and inquiries you do not recognize.

Step 11: Protect your tax identity

If your Social Security number was exposed, consider an IRS Identity Protection PIN, which prevents others from filing a return in your name. Check the IRS’s official pages for how to enroll.

Step 12: Prepare for phishing

Expect messages that use leaked details. Treat unexpected calls, texts and emails with suspicion. Verify through independent channels. See phishing for personal info and report scams at reportfraud.ftc.gov.

6. Weeks 2 to 4: Reduce the follow-on risk

Step 13: Remove broker listings that complete the profile

Stolen data becomes more dangerous when combined with public information like your address, phone number and relatives. Opt out of people-search sites. Official pages include Spokeo, the PeopleConnect suppression center and That’s Them. See data breach? don’t panic, scrub and how to opt out of the most popular people search sites.

Step 14: Update recovery information

Replace security questions with random answers stored in your password manager. Update recovery emails and phone numbers.

Step 15: Close or minimize accounts you do not need

Delete old accounts that hold your data. Each one is a future breach.

Step 16: Decide about paid protection

If you want more than a freeze, compare identity protection services on what they actually monitor and what recovery help they provide. See data breach: beyond credit monitoring.

7. If you find fraud

Contact the affected company’s fraud department and ask for the account to be closed or corrected.
Report identity theft at identitytheft.gov to get a personalized recovery plan and letters you can send.
Dispute fraudulent accounts with each credit bureau in writing.
File a police report if a creditor or the plan requires it.
Place an extended fraud alert if appropriate.
Keep a log and copies of every letter.

See how to report identity theft and responding to personal data theft.

8. What was exposed and what to do

Data exposed	Priority actions
Email and password	Change passwords everywhere reused, enable two-factor, expect phishing
Name, address, phone	Opt out of broker sites, expect scam calls
Social Security number	Credit freeze, IRS PIN, monitor reports, broker removal
Driver’s license number	Credit freeze, watch for fraud, contact the motor vehicle agency if advised
Bank or card numbers	Replace cards, set alerts, review statements
Health information	Review benefits statements, watch for medical identity theft
Children’s information	Freeze child’s credit, watch for misuse

9. Your personal breach worksheet

Copy this into a note.

Item	Detail
Company and breach date
Notice received on
Data exposed
Passwords changed (list accounts)
Two-factor enabled (list accounts)
Credit freezes placed (bureau, date)
Reports pulled (date)
Phishing received (date, type)
Broker opt-outs submitted
Fraud found (details, report numbers)

10. How companies respond, and what to expect

Companies vary. Some notify quickly and offer meaningful help. Others delay and offer minimal remedies. You may receive a letter weeks or months after the event. Do not wait for a company to protect you. See an inefficient cycle: how companies respond to data breaches and information on data breach. If a company handled a breach poorly, you can complain to your state attorney general or the FTC.

11. How long the risk lasts

Stolen data is not tied to a short expiration date. Email addresses, birth dates and Social Security numbers remain valuable for years. Criminals trade and reuse them, and fraud may appear long after the breach. See how long can data leaks affect you. Keep your freeze in place, check reports once or twice a year and stay alert to scams.

12. Three scenarios and what to do

Scenario 1: A retailer you shop at was breached. Change that password and any reused ones, review card statements and watch for phishing that mentions the retailer.

Scenario 2: A healthcare provider was breached. Review benefits statements, ask for an accounting of disclosures where allowed, freeze credit and watch for medical identity theft. See what happens to your health data online.

Scenario 3: Your employer’s records were breached. Freeze credit, ask your employer what is being offered, watch for tax fraud and consider an IRS PIN.

13. Common mistakes

Clicking links in a breach notice.
Changing only one password.
Believing free monitoring is enough.
Forgetting email recovery settings.
Not freezing a child’s credit.
Stopping vigilance after a month.

14. Small business note

If you run a business, a breach has legal and customer notification duties that vary by state and industry. Contact your IT provider, insurer and a lawyer promptly, preserve logs, notify affected parties as required and review security afterward. The Federal Trade Commission publishes guidance for businesses at ftc.gov.

15. How Wiperts fits

The part of a breach response that lasts is the broker side: stolen data meets public data. Wiperts scans more than 100 data brokers and people-search sites for your name, address and phone numbers, submits removal requests, removes your personal results from Google and Bing, blurs your home on maps and monitors continuously so profiles that return are removed again.

See what is public about you with the free diagnosis.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

16. Key takeaways

Work by the clock: contain in the first hour, block fraud on day one, review in week one and reduce follow-on risk over the month.
Freeze credit, secure accounts, protect your tax identity and expect phishing.
Remove broker listings so stolen data cannot be combined with public data.
Keep watching for years, because breach data does not expire.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

17. Frequently Asked Questions

What should I do first after a data breach?

Read the notice to learn what was exposed, change the passwords for affected accounts and any account that reused them, and turn on two-factor authentication. Then freeze your credit if identifiers like your Social Security number were involved.

How do I know if a breach notice is real?

Do not click links in the notice. Go to the company’s official website by typing the address yourself, or call a number you find independently, and look for the same announcement.

How long should I watch for problems?

Plan on at least a year of close attention and years of periodic checks, because stolen data can be used or resold long after a breach.

Should I accept the free credit monitoring?

It is fine to accept, but treat it as one layer. A credit freeze prevents new accounts, and account security prevents takeovers.

What if I find fraud?

Contact the affected company, report at identitytheft.gov to get a recovery plan, dispute fraudulent items with credit bureaus and keep a log of every contact.

What can a company do wrong in its response?

Delay notice, minimize what was exposed or offer limited remedies. You can complain to your state attorney general or the FTC.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing