A data breach notice (Change Healthcare-style health vendor, a retailer, a university, a password dump) means criminals may already have your email, hashed or plain passwords, phone number, or Social Security number. Account takeover is when they use that data to drain a bank app, open credit, or hijack email—the keys to every password reset.
This is a containment checklist, not a reason to buy expensive “breach insurance” upsells. Core tools: Credit freezes and fraud alerts, How to protect your SSN, and How to spot phishing and account takeover.
First 24 hours
- Change the password on the breached account from a device you trust. If you reused that password elsewhere, change those too—password managers (Bitwarden, 1Password, built-in browser managers) make unique passwords realistic.
- Turn on MFA (app-based or hardware key preferred over SMS when available) on email, bank, brokerage, and Apple/Google ID first.
- Freeze credit at Equifax, Experian, and TransUnion if SSN or identity data may be exposed. Freezes are free under federal rules.
- Treat unexpected “we noticed a login” texts as phishing until you log in via the bookmark you already trust—Fake bank and brokerage alerts.
If takeover already happened, jump to Rebuild after identity theft and Report credit report fraud.
What freezes do and do not stop
Place and lift freezes calmly at Equifax, Experian, and TransUnion with Freezing and unfreezing your credit.
| Tool | Stops | Does not stop |
|---|---|---|
| Credit freeze | Most new credit accounts in your name | Takeover of existing bank/card logins |
| Fraud alert | Extra verification at some lenders | Existing-account drains |
| Password + MFA reset | Many remote takeovers | SIM-swap if SMS is your only factor |
| Transaction alerts | Fast notice after theft | The first fraudulent charge itself |
Existing accounts need password/MFA hygiene and monitoring—not only a freeze.
Worked example: retailer password dump
Casey gets an email that a national retailer exposed emails and passwords. Casey used CaseySummer2022! on that store and on an old Yahoo mail still listed on two credit cards.
- Casey resets Yahoo and both card logins, enables app MFA on Yahoo and the bank apps (Chase and a local credit union).
- Places freezes at all three bureaus the same evening.
- Pulls free weekly reports via AnnualCreditReport.com for the next month.
- Ignores a follow-up text claiming “Apple Support” needs a gift card to “secure the account”—classic pattern from phishing and takeover.
No new accounts appear. Cost: time, not a $29.99/month monitoring upsell.
Monitoring without panic spending
- Free: AnnualCreditReport.com, bank/card login alerts, freeze confirmations
- Optional: issuer credit-score tools you already have
- Paid monitoring: redundant if you freeze and watch reports; never a substitute for unique passwords
Gift-card and refund “helpers” who contact you after a breach are scammers—see Gift card payment scams and Tech support and refund scams.
SSN exposure extras
If the breach included SSN or driver’s license data:
- Freeze credit (all three) and consider a fraud alert
- Review IRS withholding/online account security; watch for fake IRS threats (Fake IRS and benefit scams)
- Follow SSA and FTC guidance linked from IdentityTheft.gov if accounts open in your name
Children’s SSNs need separate monitoring habits—see the dependents section in Protect your SSN.
Checklist
- Reset breached and reused passwords; enable MFA on email and money apps first.
- Freeze Equifax, Experian, and TransUnion if identity data may be out.
- Turn on transaction and new-device alerts at banks and cards.
- Pull all three credit reports; dispute stranger accounts quickly.
- Ignore gift-card / refund / “support” outreach tied to the breach.
- Document dates and confirmation numbers if you later need identity theft recovery.
Educational only. Not legal, cybersecurity, or insurance advice. Institution steps vary—use official bank and bureau sites, not links in unexpected messages.