Received a data breach letter? Here’s what to do.

Verify the sender first

Keep the notice, but verify the incident through the organization’s official website before following unfamiliar links or sharing information. Use contact details you find independently if the message seems suspicious.

A legitimate notice can arrive after the incident occurred. Compare the date of the breach, the date it was discovered, and the date of your letter rather than assuming they are the same.

Find the details that apply to you

Read for the name of the organization, what happened, the information involved, and what the company recommends. Note any offered assistance and its enrollment deadline. If the notice is unclear, ask the company what information about you was involved.

Use guidance matched to the exposed information

The appropriate response depends on what was involved. Use the FTC’s data breach resources for next steps, and contact the relevant account provider if you see unfamiliar activity. If you suspect identity theft, IdentityTheft.gov provides reporting and recovery guidance.

Keep your notice even if an email breach check returns no matches. Email checks cover only supported records.

Keep a clear record

Save the original notice, relevant correspondence, and any records of unfamiliar activity or expenses you believe relate to the incident. Keep these documents somewhere secure. Write down what happened and when while the details are fresh.

Separate a breach notice from a settlement notice

A breach notification describes an incident. It does not by itself mean a lawsuit or settlement exists. A settlement notice has its own case details, eligibility terms, and deadlines. Read that notice independently and verify its source.

If you choose to contact us, describe the company and the notice you received. Submitting our form is not the same as filing a settlement claim.