I Got a Data Breach Notice. Do I Actually Need to Do Anything?

The Identity Theft Resource Center tracked 3,322 data compromises in the United States in 2025, the highest annual total ever recorded. Their consumer survey found that 80% of Americans received at least one breach notice in the past 12 months. Nearly 40% got three to five.

But 48 percent of people who did nothing said they were simply exhausted from too many notices. That exhaustion is exactly what scammers count on.

WHY THE NOTICE TELLS YOU SO LITTLE

Companies are legally required to notify you when your data is exposed. They are not required to tell you exactly what was taken, how it happened, or how serious it actually is.

The ITRC found that 70% of breach notices in 2025 left out key details about the attack. Most are written by legal teams focused on limiting liability, not helping you understand your real risk.

So you have to do that part yourself. It is not hard once you know what to look for.

THE ONE QUESTION THAT DECIDES EVERYTHING

What type of data was exposed?

That single answer tells you whether to file the notice away or act on it today.

Low urgency: email address, username, or preferences

Expect more phishing attempts and spam in the weeks ahead. Change the password for that specific account if you reuse it anywhere else, then move on.

Medium urgency: phone number, date of birth, or home address

These details help scammers craft convincing impersonation attempts. Change the account password, stay alert to calls or texts that seem to know too much about you, and place a free fraud alert with the three credit bureaus.

High urgency: Social Security number, financial account numbers, medical records, or driver's license

Act today. Freeze your credit at all three bureaus: Equifax, Experian, and TransUnion. It is free, takes about ten minutes, and is the single most effective thing you can do to block someone from opening new accounts in your name.

A fraud alert asks lenders to verify your identity before approving credit. A credit freeze stops most access entirely. They are not the same. A freeze is stronger.

What to Do, Step by Step

THREE STEPS, IN ORDER

1.  Find out exactly what was taken

Read the notice for the specific data types listed. If the letter is vague, check the company's breach FAQ page or call their response line. They are required to have one.

2.  Match the data type to the urgency level above

Not every breach needs a credit freeze. Not every breach can be safely ignored. The data type tells you which it is.

3.  Check what else might already be exposed

A breach at one company often means your email and password combination is already being tested against other sites. PrivacyHawk alerts you when your data shows up in a breach and scans data broker sites so you can see where else your information is currently sitting out in the open. 

A breach notice is often not the end of your exposure. It is the first sign of it.

‍