Data Breach? Don't Panic: How to Scrub Your Exposure Afterward

The letter arrives, or the email, or the news alert: your information was involved in a data breach. The first reaction is usually a flash of fear followed by confusion. What was taken? Who has it? Are you about to be robbed? Take a breath. Most breaches do not lead to catastrophe, and a calm, methodical response reduces the risk further. What matters is acting in the right order and understanding that leaked data does not disappear. This guide gives a plan you can follow in the first hour, the first week and the following months. It also explains the step many people miss: scrubbing the public exposure that criminals combine with leaked data. For the basics of breaches, see what is a data breach.

1. Step 0: Confirm the notice is real

Scammers send fake breach notices. Before you click anything, verify that the message is genuine. Go to the company’s official website by typing the address yourself, and look for an announcement. Call the number printed on a statement or card. Never use links or phone numbers in an unexpected message. Report fake notices at reportfraud.ftc.gov.

2. Step 1: Understand what was exposed

Notices usually list the categories of data. Your response depends on them.

Exposed data	Main risk	Priority actions
Email and password	Account takeover	Change passwords, enable two-factor authentication
Name, address, phone	Phishing, impersonation	Remove listings, be alert to scams
Birth date, government ID	Identity theft	Freeze credit, consider fraud alert
Payment card	Fraud charges	Cancel or replace card, monitor statements
Bank account	Fraud, unauthorized debits	Contact bank, set alerts
Medical or insurance data	Medical identity theft	Review explanations of benefits, contact insurer

3. Step 2: Secure your accounts

Change the affected password

Change it immediately, using a unique password from a password manager. Change any other account where you reused it.

Turn on two-factor authentication

Prefer an authenticator app or passkey over text messages. Enable it on email, banking and other key accounts.

Review account recovery options

Check recovery emails and phone numbers. Remove anything that is outdated or unfamiliar.

Check for unauthorized access

Look at recent logins and connected devices. Sign out of all sessions and remove unknown devices.

Watch for forwarding rules

Attackers sometimes add email forwarding rules. Check your email settings.

4. Step 3: Protect your credit

If identifiers were exposed, protect against new-account fraud.

Freeze your credit with each credit bureau. It is free and you can lift it when you need credit. See what is a credit freeze.
Consider a fraud alert if you prefer a lighter measure.
Use the credit monitoring offered, if any, as an extra alert, not as a replacement for a freeze. Our article beyond credit monitoring explains why.
Check your credit reports for unfamiliar accounts.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

5. Step 4: Watch for scams

Criminals know that breach victims are anxious. Expect messages that:

Claim to be from the breached company and ask you to “verify” details.
Offer “free protection” through a link.
Pose as your bank or card issuer reporting suspicious activity.
Threaten legal action or account closure.

Do not click links. Open the official site or app yourself and use the number on the back of your card. Never read verification codes to anyone. Report scams at reportfraud.ftc.gov and internet crime at ic3.gov.

6. Step 5: Scrub the public exposure

This is the step that most breach guides skip. Leaked data becomes more dangerous when combined with public data. A criminal who has your email and password from a breach, plus your address, relatives and birth year from a people-search site, can answer security questions, impersonate you convincingly and find you in person. Removing the public layer reduces that combination.

Search your name, phone number and address.
Opt out of people-search sites that show your details. Verified pages include Spokeo, the PeopleConnect suppression center and That’s Them.
California residents can use the state’s DROP platform at privacy.ca.gov/drop. Registered brokers began processing requests on August 1, 2026 and repeat every 45 days.
Request removal of search results that expose sensitive information.
Tighten social media privacy and remove public birth dates and family details.
Replace weak security answers with random ones.

7. Step 6: Monitor over time

Leaked data can be used months or years later. Review statements monthly, credit reports at least yearly, and your search results quarterly. Read how long data leaks can affect you for the long view.

8. If you become a victim of identity theft

Report it at identitytheft.gov to get a personalized recovery plan, then follow the steps in how to report identity theft. Contact the creditor or bank involved, freeze credit if you have not already, and keep a record of every call and letter.

9. What companies should do, and what they often do

Responsible companies investigate quickly, notify affected people, offer remediation and explain what changed. In practice, quality varies. Our analysis of how companies respond to data breaches discusses common patterns. You cannot control the company’s response, but you can control yours.

The FBI’s Internet Crime Complaint Center received 67,456 personal data breach complaints in 2025 with reported losses of $1.31 billion, and the Federal Trade Commission received about 3 million fraud reports with roughly $15.9 billion in reported losses (ic3.gov, ftc.gov). These figures are a reminder that a calm but thorough response is worth the time.

10. Timeline: the first 90 days

When	Action
First hour	Verify the notice, change passwords, enable two-factor authentication
First day	Freeze credit, review statements
First week	Remove public listings, replace security answers
First month	Re-check reports, watch for follow-up scams
Months 2 to 3	Verify removals, review search results
Ongoing	Monthly statements, yearly reports, quarterly search

11. Special cases: businesses, families and shared accounts

If the breach affects your employer. Follow the company’s guidance, change work passwords and be alert to phishing that mimics internal messages. Report anything unusual to your security team promptly. Do not use personal accounts for work data.

If a child’s data was exposed. Children’s identities are valuable because misuse can go unnoticed for years. Consider placing a credit freeze for the minor, which parents can usually do through the credit bureaus, and monitor for pre-approved offers or notices addressed to the child. See the FTC’s guidance at consumer.ftc.gov.

If you share accounts with family. Change shared passwords, remove unneeded users and make sure each person has their own login and two-factor authentication. Shared streaming, cloud and shopping accounts are frequent weak points.

If your medical information was exposed. Review explanations of benefits for services you did not receive, ask your insurer to flag your account and request an accounting of disclosures from the provider. Medical identity theft can affect your records, so check for incorrect entries. Visit hhs.gov/hipaa to learn about your rights and how to file a complaint.

12. Keeping calm and keeping records

Fear drives mistakes. Create a simple folder, digital or paper, for the incident. Save the breach notice, note the date you received it, record each step you take and keep confirmation numbers from the credit bureaus. If you ever need to dispute a fraudulent account, this record shows what you knew and when you acted. It also helps you avoid repeating steps and lets you hand off the file to a family member if you are traveling or unavailable.

A short checklist helps: notice verified, passwords changed, two-factor authentication on, credit frozen, public listings removed, scam alerts set, calendar reminders created. When all boxes are checked you have done what can be done, and you can return to normal life with sensible vigilance rather than dread.

13. Three scenarios and what to do

Scenario 1: Only your email and password were exposed. Change the password, enable two-factor authentication and watch for phishing. Credit action is optional.

Scenario 2: Your Social Security or national ID number was exposed. Freeze credit, consider a fraud alert and an IRS Identity Protection PIN if you file U.S. taxes, and monitor closely.

Scenario 3: Your card number was exposed. Cancel the card, dispute unauthorized charges and set alerts.

14. Myths and facts

Myth	Fact
A breach means my identity is stolen	It raises risk but is not certain
Credit monitoring prevents fraud	It alerts after the fact
Changing one password is enough	Reused passwords need changing too
Nothing can be done afterward	Many steps reduce harm
The company will fix it all	Your own steps matter

15. Common mistakes

Clicking links in a breach email.
Not freezing credit when ID numbers were exposed.
Ignoring follow-up scams.
Leaving public listings in place.
Forgetting about the incident after a few weeks.

16. Questions to ask yourself

What exactly was exposed? Which accounts share the same password? What public details could someone pair with this leak? Who should I warn in my household? Write down the answers and work through the steps.

17. How Wiperts fits

Step five is where Wiperts helps. It scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles, which reduces what criminals can combine with leaked data. Start with the free diagnosis.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

18. Key takeaways

Verify the notice, secure accounts and freeze credit based on what was exposed.
Expect follow-up scams and verify any contact through official channels.
Scrub public listings so criminals cannot combine them with leaked data.
Monitor for years, because leaked data lasts.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

19. Frequently Asked Questions

What should I do first after a data breach?

Read the notice carefully, change the password for the affected account and any account using the same password, and enable two-factor authentication.

Should I freeze my credit after a breach?

If identifiers such as birth date or ID numbers were exposed, yes. A freeze blocks new accounts and is free in the United States.

Is credit monitoring offered after a breach enough?

It helps detect problems but does not prevent new accounts. Combine it with a freeze.

Why am I getting more scam messages after a breach?

Criminals target breach victims with messages that reference the incident. Verify any contact through official channels.

How does removing public listings help after a breach?

Leaked data is often combined with broker data. Removing listings gives criminals fewer facts to pair with the leak.

How long should I stay alert?

For years. Leaked data can be used long after the incident.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing