What to Do If You Receive a Data Breach Notification Letter

What the Letter Actually Means

Data breach notification letters follow a fairly standard format, and it's worth understanding what the boilerplate language actually signals.

Almost every letter will include a line like "we have no evidence that your information has been misused." This can sound reassuring, but it's important to understand what it actually means: the company is telling you it hasn't detected misuse yet — not that misuse won't happen, and not that it has actively investigated whether your specific information has already been used fraudulently. It's a standard liability-conscious phrase, not a guarantee.

The most important part of the letter is usually buried in the middle: exactly what type of information was exposed. This matters enormously, because the risk profile is completely different depending on what was taken:

• Email address or username only — low risk, mainly increases phishing/spam exposure
• Password (even hashed/encrypted) — moderate risk, especially if you reuse that password elsewhere
• Financial account numbers, credit/debit card numbers — moderate-to-high risk, but usually the easiest to fix (cancel the card)
• Social Security number, driver's license number, or government ID — high risk, because this enables identity theft that's much harder to undo than a stolen card number
• Date of birth combined with SSN or ID — the highest-risk combination, since these two pieces of information together are often enough to open new accounts in your name

Find this section of your letter before doing anything else — it determines how urgently you need to act.

First 24 Hours: Immediate Steps

1. Read the letter fully before reacting

Note the date the breach was discovered versus the date you're being notified — a long gap between the two can itself be legally significant (more on that below).

2. Enroll in the free credit monitoring, if offered

Most companies offer 12–24 months of free credit monitoring or identity protection through a service like Experian, Equifax, or a third-party identity protection vendor. A common misconception stops people from doing this: enrolling in free monitoring does not waive your legal rights or prevent you from joining a class action later. Read the terms, but in most cases there's no meaningful downside to accepting it — it's a free early-warning system.

3. Freeze your credit at all three bureaus

This is the single most effective thing you can do if your SSN was exposed. A credit freeze is free by law and prevents new accounts from being opened in your name without your explicit unlock. You need to do this separately at all three bureaus:

• Equifax: equifax.com/personal/credit-report-services
• Experian: experian.com/freeze
• TransUnion: transunion.com/credit-freeze

A freeze is different from "credit monitoring" — monitoring tells you after something happens; a freeze helps prevent it from happening in the first place. Do both if you can.

4. Change the password on the affected account — and anywhere else you reused it

If a password was exposed, change it immediately on that account, and on any other account where you used the same or a similar password. This is the single most common way one breach turns into several — attackers test stolen credentials against other popular sites (a technique called "credential stuffing").

5. Watch for follow-up phishing attempts

Scammers frequently exploit real data breaches by sending fake "follow-up" emails or texts pretending to be the breached company, asking you to "verify your account" or "claim your compensation." Legitimate companies will not ask you to click a link and enter your SSN or password to resolve a breach. When in doubt, go directly to the company's official website rather than clicking a link in an email or text.

Understanding Your Legal Rights

Every U.S. state has its own data breach notification law, and they're not identical. A few things vary meaningfully from state to state:

• How quickly a company must notify you. Some states set a hard deadline (for example, a fixed number of days after the company discovers the breach); others use a vaguer "without unreasonable delay" standard. Either way, notification is supposed to happen promptly — a company that sat on the information for months before telling you may not have complied with its legal obligations, regardless of which standard applies.
• Whether you can sue directly. Most states only allow the state Attorney General to enforce breach notification law. A smaller number of states — California being the most significant example — give individual consumers a private right to sue for certain types of violations, including in some cases a right to statutory damages (a fixed dollar amount per person) without having to prove you suffered a specific financial loss.
• What counts as "personal information." States differ on whether things like biometric data, health information, or online account credentials trigger notification requirements, in addition to the more universal categories like SSN and financial account numbers.

(See our full state-by-state breach notification law reference for details on your specific state.)

The timing of your notice matters. If you were notified quickly, the company likely met its legal obligations even if the breach itself was serious. If there was a long gap — months, not weeks — between when the breach happened and when you found out, that delay itself may be legally significant, separate from the breach itself. Delayed notice means you lost time you could have used to freeze your credit, watch your accounts, or take other protective steps — and courts increasingly recognize that lost time as a real, compensable harm.

Is It Worth Joining a Class Action?

If a class action lawsuit has been filed over the breach you're involved in, you generally have a few paths:

• Do nothing and stay in the class (in most cases, you're automatically included unless you opt out, and you'll be notified if/when a settlement is reached)
• File a claim if a settlement is reached — this usually requires submitting a short form, sometimes with documentation if you're claiming actual financial losses
• Opt out if you'd rather pursue your own individual claim or aren't interested in participating

What can you realistically expect from a settlement? It varies enormously based on what was exposed, how many people were affected, and whether the company's conduct (like notification delays) was particularly bad. As a general pattern:

• Baseline settlements for exposed information with no proven misuse often provide modest reimbursement plus extended credit monitoring
• If you can document actual financial losses tied to the breach (fraudulent charges, time spent resolving identity theft, etc.), many settlements offer a separate, larger reimbursement tier for documented losses
• Larger, more aggravated cases — especially those involving Social Security numbers and significant delays in notification — tend to produce higher settlement values

There's no universal number, and anyone promising you a guaranteed payout amount before a settlement is reached is getting ahead of the facts. What you can do now is keep your notification letter, document any time or money you spend responding to the breach, and watch for official settlement notices (which will come from a court-approved claims administrator, not a random email).

Check If You're Part of a Known Breach

Use our breach lookup tool to search by company name and see whether a breach has been reported, when it was discovered, what data was involved, and whether a case has been filed.