A breach notification email is designed to get your attention, but panic isn't a strategy. Here's the actual sequence worth following, in order of how much each step reduces your real risk.
Step 1: Confirm what was actually exposed
Read the notice carefully for the specific data types involved: passwords, email addresses, partial or full payment card numbers, Social Security numbers, and account details all carry different levels of risk and call for different responses. A breach limited to email addresses and names is a much lower-stakes event than one involving Social Security numbers or financial account numbers; don't apply the same response to both.
Step 2: Change the password, everywhere it was reused
If the breached account's password was reused anywhere else, change it on every site where you used it, not just the breached service. This is the single most common way one breach turns into multiple compromised accounts, and it's also the most avoidable, which is the core argument for a password manager that generates unique passwords per site.
Step 3: Freeze your credit if financial or identity data was involved
If the breach involved your Social Security number, financial account numbers, or other data that could be used to open new credit in your name, place a credit freeze with all three major credit bureaus. A credit freeze is free and blocks new credit accounts from being opened in your name without first lifting the freeze, and it doesn't affect your existing accounts or credit score.
Step 4: Watch for and report identity theft promptly
IdentityTheft.gov, run by the FTC, provides a free, structured recovery plan if you find evidence your identity was actually misused, not just exposed. Reporting promptly through this official channel creates a documented recovery plan and can speed up resolving fraudulent accounts or charges.
Step 5: Know and use your state's breach-notification rights
Many states have specific breach-notification laws that require the company to tell you certain things (what was exposed, when, and sometimes what remediation, like free credit monitoring, is being offered) within a defined timeframe. Check your specific state attorney general's consumer protection page for your state's exact requirements; don't assume a generalized national standard applies, since state laws genuinely differ on notification timing and required remedies.
Step 6: Actually request deletion where you have that right
Depending on your state and the company's own policies, you may be able to formally request that a company delete your personal data rather than just deactivating your account. Look for a privacy or data-rights page on the company's site, or contact their support channel directly, and keep a written record of the request and any confirmation you receive.
The habit that prevents the next one from hurting as much
None of this is only relevant after a breach. Using unique passwords everywhere, enabling two-factor authentication on accounts that offer it, and periodically checking whether your email appears in known breach databases are the three habits that most reduce how much any single future breach can actually cost you.
Checking whether your information has already been exposed
Several reputable, free services let you check whether a specific email address has appeared in a known, publicly disclosed data breach, which is useful both after a specific company's breach notification and as a periodic habit independent of any single incident. A match doesn't necessarily mean active, ongoing harm, but it's a prompt to apply the password-change and monitoring steps above to that specific account proactively rather than waiting for a more direct sign of misuse.
When to involve a credit monitoring service
Many companies offer free credit monitoring for a limited period following a breach they caused, which is generally worth activating if offered, since it's provided at no cost to you. Paid, ongoing credit monitoring beyond that offer is a separate decision; it can catch new-account fraud faster than checking manually, but a credit freeze, which is free and more directly preventive, addresses the same underlying risk for most people without an ongoing subscription cost.
