Your Personal Information Was Revealed: What to Do Next

It is a bad moment. A letter arrives, an email warns of unusual activity, a friend reports a strange message from your account or a news story says a company you use has been breached. Your personal information has been revealed, and you are not sure what to do first. This guide is designed for that moment. It gives you an order of operations for the first day, the first week and the first month, explains why each step matters and shows how to reduce the chance that the same data is used again. It extends our general data breach response strategies.

1. Step zero: stay calm and verify

Panic leads to mistakes, and scammers exploit panic. Before acting on any notice, confirm that it is real. Do not click links or call numbers in the message. Visit the organization’s official website by typing the address yourself, or call the phone number printed on a card or statement. Fake breach notices are common, and they ask for passwords or payments. If you cannot verify the message, treat it as suspicious and still protect your accounts using the steps below.

2. What exposed information means

Different data requires different responses.

What was exposed	Main risk	Priority response
Email and password	Account takeover	Change password, add two-factor authentication
Card number	Fraudulent purchases	Call issuer, replace card
Government ID number	New-account and tax fraud	Freeze credit, monitor reports
Birth date, address, phone	Impersonation and scams	Verify callers, reduce public listings
Medical details	Insurance fraud, extortion	Review statements, protect portal
Login session or device data	Account hijack	Sign out everywhere, reset credentials

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

3. The first 24 hours

Change the passwords that matter most

Start with your email, because it controls password resets for everything else. Then bank and financial accounts, then any account that used the same password. Use a password manager to create unique ones.

Turn on two-factor authentication

Use an authenticator app or passkey rather than text messages wherever possible.

Sign out of all sessions

Most services allow you to log out of all devices. Do so after changing your password.

Contact affected institutions

If a card or account was exposed, call the number on the card. Ask about freezing, replacing and monitoring.

Freeze your credit

Place a freeze at each of the three credit bureaus. It is free and blocks most new-account fraud. See what a credit freeze is and the FTC’s guidance.

Check for obvious damage

Review recent transactions and login activity on your main accounts.

4. The first week

Report the incident

Visit IdentityTheft.gov if your information was used or you believe it will be. The site will generate a recovery plan. Our guide to how to report identity theft walks through each stage. Report scams at ReportFraud.ftc.gov and internet-enabled crime at ic3.gov.

Review credit reports

You are entitled to free reports. Look for accounts, inquiries and addresses you do not recognize.

Set up alerts

Turn on transaction and sign-in alerts on banks, cards and email.

Watch for phishing

Expect messages that mention the incident. Verify every request independently.

Document everything

Keep a log of calls, names, dates and reference numbers. Save emails and letters.

5. The first month

Reduce public exposure

Criminals combine stolen records with public listings. Remove your address, phone and relatives from people-search sites using official pages such as Spokeo, PeopleConnect and That’s Them. California residents can also use DROP, which opened to residents on January 1, 2026; registered brokers began processing requests on August 1, 2026 and repeat every 45 days. See our guide to removing your data from the internet.

Tighten account recovery

Update recovery email addresses and phone numbers, and remove old ones. Consider a carrier PIN to prevent SIM swaps.

Protect your mail

Use a locking mailbox, shred sensitive paper and opt out of prescreened offers at 1-888-5-OPT-OUT.

Re-check

Pull reports again and confirm there are no new items.

6. Which situations need extra steps

Government ID number exposed

Freeze credit, monitor for tax fraud and consider other agency protections if offered. Keep an eye out for rejected tax returns.

Medical data exposed

Review explanations of benefits. Learn your rights from the HHS Office for Civil Rights.

Business or employer data exposed

Report to your employer’s security team and follow their instructions. Change work credentials through official channels.

Children’s information exposed

Ask the credit bureaus about freezes for minors and monitor for unexpected mail in the child’s name.

Threats or extortion

Do not pay. Preserve the messages and report them to ic3.gov. If you feel unsafe, contact local law enforcement. For stalking-related concerns see the Office on Violence Against Women.

7. What not to do

Do not pay anyone who promises to erase your data from criminal markets.
Do not respond to messages that demand payment or secrecy.
Do not provide additional information to inbound callers.
Do not reuse the exposed password anywhere.
Do not ignore small unfamiliar charges.
Do not assume the problem is solved after one step.

8. How long to stay alert

Stolen identity numbers and birth dates remain risky for years. Keep your credit frozen, review reports at least yearly and watch statements. Our article on how long data leaks can affect you explains why, and how stolen information derails life describes recovery over time.

9. Timeline: a response schedule

When	Action
Hour 1	Verify the notice, change email password
Day 1	Two-factor authentication, credit freeze, contact institutions
Week 1	Report, review reports, set alerts
Month 1	Remove public listings, tighten recovery
Month 3	Re-check reports
Yearly	Annual review

10. A short script for calling a fraud department

Calling a fraud department is easier with a plan. Have your account number and a pen ready. Say: “I need to report fraud on my account and I would like to speak to the fraud department.” Ask for the case number, the name of the representative and the time. Ask what the company will do: freeze or close the account, issue replacements, remove fraudulent charges and send written confirmation. Ask whether they need a copy of your report from IdentityTheft.gov. Write down the answers. If you reach a general line, politely ask to be transferred. Persistence is part of the process.

11. Protecting people close to you

An exposure often affects more than one person. If the data included a spouse, parent or child, tell them. Help them freeze credit, change passwords and watch for scams. Scammers sometimes target relatives, using real details to impersonate the person who was exposed. Agree on a family rule: no one sends money or shares codes in response to a message unless they have called back on a known number. The Consumer Financial Protection Bureau has tools for older relatives.

12. When the exposure came from a public listing

Not every exposure is a breach. Sometimes you discover that your details are on a website anyone can read. The response is similar but lighter: tighten account security, freeze credit and remove the listing through the site’s opt-out. Our guide to reducing identity theft risk by removing personal information from the web explains the process, and the FTC offers more general tips.

13. A final reminder about patience

Responding to exposed information is a marathon with a fast start. The first day matters most, but the follow-up over weeks and months is what finishes the job. Put reminders in your calendar for checking reports, reviewing statements and re-testing your public listings. Small, regular checks keep a bad week from turning into a bad year, and they let you notice trouble while it is still easy to fix.

14. Three scenarios and what to do

Scenario 1: Your email appears in a breach. Change the password everywhere it was used and enable two-factor authentication.

Scenario 2: Your card number was exposed. Call the issuer, replace the card and monitor charges.

Scenario 3: You get a call claiming your government ID number is compromised and asking you to confirm it. Hang up. Contact the agency using an official number.

15. Myths and facts

Myth	Fact
I must wait for proof of fraud before acting	Early action prevents damage
Credit monitoring is enough	A freeze is stronger prevention
Only one password needs changing	Reused passwords expose others
Reports don’t matter	They create records and recovery plans
Exposed data can be recalled	Usually not

16. Common mistakes

Acting on unverified notices.
Changing only one password.
Skipping the credit freeze.
Forgetting to document actions.
Ignoring public listings.
Believing the problem is over after a week.

17. Questions to ask yourself

Which accounts share the exposed password? Is my credit frozen? Can a stranger find my address and phone number online? Do I know where to report fraud? Fix the weakest answer first.

18. How Wiperts fits

You cannot undo a leak, but you can take away the public details that make it dangerous. Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. Start with the free diagnosis.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

19. Key takeaways

Verify the notice, then secure email, passwords and two-factor authentication.
Freeze credit and report at IdentityTheft.gov.
Document everything and watch for phishing.
Remove public listings so stolen data is less useful.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

20. Frequently Asked Questions

What should I do first when my information is exposed?

Identify what was exposed, then change affected passwords, enable two-factor authentication and freeze your credit.

Do I need to call the police?

Not always, but a police report can help with disputes in some cases. Report to the FTC at identitytheft.gov and file with law enforcement if creditors or agencies require it.

Should I place a fraud alert or a credit freeze?

A freeze blocks access to your credit file for new accounts and is stronger for long-term protection. A fraud alert asks lenders to verify your identity. Many people use a freeze.

How do I know if my information is being used?

Watch for unfamiliar accounts, statements, collection calls, rejected tax returns and password reset emails, and review credit reports regularly.

Can I get the stolen information removed?

Usually you cannot recall stolen data, but you can make it less useful by changing credentials, freezing credit and removing public listings.

Where do I report?

Use identitytheft.gov for identity theft, reportfraud.ftc.gov for scams and ic3.gov for internet-enabled crime.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing