Got a Data Breach Letter? What to Do First

Breach letters tend to follow a script. A company "recently became aware of a security incident," some of your information "may have been affected," and the company "takes your privacy seriously." Somewhere in the middle is the part that matters: what was actually taken. Names and email addresses call for one response. A Social Security number or driver's license number calls for a much more urgent one.

What the company had to tell you

California's breach notification law, Cal. Civ. Code § 1798.82, requires businesses to notify California residents whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Since January 1, 2026, the law has had a firm deadline. Senate Bill 446 replaced the old "most expedient time possible" standard with a requirement that notice go out within 30 calendar days of discovering or being notified of the breach. Delay is allowed only for the legitimate needs of law enforcement or as necessary to determine the scope of the breach and restore the reasonable integrity of the system. For breaches affecting more than 500 Californians, the business must also notify the Attorney General within 15 calendar days of notifying residents.

The notice must describe, among other things, the types of personal information involved, the date or estimated date of the breach if known, and a general description of the incident. If Social Security numbers or driver's license or California ID numbers were exposed and the business was the source of the breach, it must generally offer identity theft prevention and mitigation services at no cost for at least twelve months.

If your letter is vague about what was taken, or if it arrived long after the company says it discovered the breach, note that. It may matter later.

The first few days

Freeze your credit if the breach involved your Social Security number, date of birth, or a government ID number. Do it at Equifax, Experian, and TransUnion. Freezes are free and take effect within one business day when requested online or by phone, and they're the most effective protection against someone opening new accounts in your name.

Change passwords if login credentials were involved, both on the breached account and anywhere else you used the same or a similar password. Turn on two-factor authentication wherever it's offered.

Enroll in the monitoring the company offers. Accepting it generally doesn't waive your legal rights, though it's worth reading the enrollment terms.

Watch for phishing. Stolen data is often used to write convincing fake emails and texts, sometimes posing as the breached company itself. Be skeptical of any message about the breach that asks you to click a link or confirm your information.

The following months

Pull your credit reports and look for accounts you don't recognize. Read your bank and card statements closely. If your Social Security number was exposed, consider filing your tax return early to reduce the risk of a fraudulent return, and setting up an account at ssa.gov to monitor your earnings record. If medical information was taken, review the explanation-of-benefits statements from your insurer for care you never received.

Start a file now

If you later pursue a claim, or file for money from a class settlement, documentation largely determines what you can recover. Keep the breach letter itself, confirmations of every freeze and password change with dates, receipts for anything you paid for, a running log of the time you spent dealing with the breach, and records of any fraud that follows. Save any suspicious messages that reference the breach, too.

Whether you can sue depends on what was taken and why. We explain that in our article on suing over a data breach in California.