What a Data Breach Notification Actually Means, and What to Do Next
These emails are common and often vague. Here's how to judge real severity, and exactly what to do based on what was actually exposed.
At some point, nearly everyone gets an email that starts with some version of "we recently discovered unauthorized access to our systems." These notifications are common enough that it's easy to develop a kind of numbness to them — but they range from genuinely low-stakes to seriously urgent, and the notification itself often doesn't make that difference obvious.
What companies are actually required to tell you
Breach notification requirements vary by state and by the type of data involved, but the general pattern is similar: companies are typically required to disclose that a breach occurred and, in general terms, what categories of data were involved. What they're often vague about is scope and specifics — exactly how the breach happened, how many records were taken, and sometimes even which of your specific data was included versus other categories mentioned in the notice. Reading the notice carefully for what data type is actually named is the first real step.
How to judge real severity
Not all exposed data carries the same risk. Here's a rough framework for reading a notification and judging how urgently to act:
Still worth a password change on that account as good hygiene, but a properly hashed password (one the company can't read even internally) is far less exploitable than one stored in plain text.
Change that password immediately, and change it anywhere else you reused it — this is exactly the scenario credential-stuffing attacks rely on.
This category warrants stronger action — a credit freeze at all three bureaus, checking your credit reports, and taking any free credit monitoring the company offers, all covered below.
A next-steps checklist, scaled to severity
For any breach involving a password: change it immediately, and change it anywhere else you reused the same one. This is also a good moment to move that account into a password manager if it isn't already, so this specific problem doesn't recur.
For any breach involving financial or identity data: place a credit freeze at all three bureaus — Equifax, Experian, and TransUnion — which stops anyone from opening new credit in your name. It's free, doesn't affect your credit score, and stays in place until you lift it, which you can do whenever you need to apply for credit. The FTC says a freeze is always a good idea, and even more important after your Social Security number is exposed. Also check your credit reports (you can pull them for free every week at AnnualCreditReport.com), accept any free credit monitoring the breached company offers, and file your taxes early so a scammer can't file first. If you'd rather not freeze, a free fraud alert is the lighter alternative.
In either case: turn on multi-factor authentication for the affected account if it isn't already active, and keep an eye on account activity for the following few months rather than assuming the risk ends the day you read the notice.
The FTC's IdentityTheft.gov/databreach walks you through the right steps for exactly what was exposed.