Your First 24 Hours After a Breach Notification: A Step-by-Step Guide

When a breach notification arrives, the first 24 hours matter most. Attackers with stolen credentials move quickly, testing access and selling data before victims react. But a methodical response, starting immediately, can significantly reduce the damage. What follows is what to actually do, in order, based on how real breaches unfold.

Step 1: Determine What Was Breached and When

Before you act, understand the scope. Breach notifications are required by law in all 50 US states, but the letter or email you receive may lack details. You need to know: What data was taken (name, email, password, Social Security number, payment card)? When did the breach occur? How many people were affected? Was this a credential exposure or financial data?

Many companies now provide a URL or portal where you can check whether your specific account was included. HaveIBeenPwned.com, a free service maintained by security researcher Troy Hunt, has indexed over 650 major breaches and lets you search by email address. If your email appears in a known breach but you have not received a notification, that is a separate problem worth investigating.

Read the notification carefully for the date the company discovered the breach, the date it was disclosed, and any indication of ongoing unauthorized access. If the breach happened six months ago but was just discovered, your passwords may have been compromised longer than you think. If the notification says “ongoing monitoring,” the breach may still be active.

Step 2: Change Your Passwords on All Connected Accounts

If the breached company stored your password, assume it is compromised even if the notification says encryption protected it. Start with accounts where you reused that password, because attackers test breached credentials across all major platforms. This is called credential stuffing.

Prioritize accounts tied to account recovery or authentication: email, phone provider, banks, and investment firms. These are the keys to everything else. A compromised email account gives attackers the ability to reset passwords on other sites using “forgot password” flows.

Use a password manager to generate new passwords: 16+ characters, random, unique to each site. Password managers like Bitwarden (free or $10/year), 1Password ($35.99/year for individuals), or Dashlane ($99.99/year) make it feasible to maintain truly unique credentials. If you do not use one, this breach is the moment to start.

Do not reuse your new passwords across sites, and do not try to memorize complex passwords manually. If the breached company is critical to your finances (your bank), consider changing that password again in 48 hours, once you have verified that your account access has not been compromised in the meantime.

Step 3: Enable Multi-Factor Authentication

Password-only authentication is insufficient after a breach. Multi-factor authentication (MFA) makes stolen credentials alone useless because attackers also need your second factor: a code from an app, a push notification, or a hardware key.

If the breached service offers MFA, enable it now. Most major platforms support authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) and hardware security keys (YubiKey, Google Titan, Titan Security Key, priced $25–$60 per key). Authenticator apps are free; hardware keys are more expensive but harder to compromise.

Priority order: Email provider, bank, investment firms, social media accounts, breached service itself. You cannot protect every account in 24 hours, but these are the accounts attackers use to access everything else.

Note: SMS-based MFA (codes sent via text) is better than nothing, but it has known weaknesses. Authenticator apps or hardware keys are stronger, though SMS is what most services offer by default.

Step 4: Monitor Your Credit and Set Up Fraud Alerts

If the breach included your name, date of birth, Social Security number, or home address, identity thieves have the raw material to open accounts in your name. You cannot prevent this entirely, but you can detect it early.

Credit Freeze

A credit freeze locks your credit file so that thieves cannot open new accounts without your permission. You request it free from the three major bureaus: Equifax, Experian, and TransUnion. Each bureau must be contacted separately. A freeze typically takes about an hour to process per bureau and blocks new credit inquiries, which makes it nearly impossible for someone to open a credit card in your name. It does not affect your credit score and does not prevent existing creditors from reviewing your file.

Fraud Alert

If a freeze feels too restrictive (for instance, if you plan to apply for a mortgage), place a fraud alert instead. This instructs creditors to verify your identity before opening new accounts. It lasts one year and is free. You file with one bureau, and it is reported to all three.

Credit Monitoring

Begin checking your credit reports at AnnualCreditReport.com, where you can request one free report from each bureau per year. Stagger them across the year, or pull all three now after a breach. Look for accounts you did not open. Most major credit card companies and banks offer free credit monitoring and credit scores to customers; check your account portals.

Paid credit monitoring services like Equifax Complete ($9.99/month or $99.99/year), Experian Plus ($10.99/month or $95.99/year), and Transunion Credit Monitoring ($9.99/month or $89.99/year) add alerts for suspicious activity and recovery assistance. These are options if you want continuous monitoring beyond the annual free reports.

Step 5: Watch Financial Accounts for Unauthorized Transactions

Check your bank and credit card statements for the past 30 days. Look for charges you do not recognize, including small test transactions (attackers often make small purchases to verify stolen cards work before making large purchases). Report unauthorized transactions to your card issuer or bank immediately. Federal law caps your liability for fraudulent credit card charges at $50; most card issuers cap it at $0.

Enable transaction alerts on your accounts if your bank offers them. Many banks and card issuers allow you to set up notifications when a transaction exceeds a certain amount, when a card is used internationally, or when a payment is added to your account. These alerts can catch unauthorized activity within hours.

Check less frequently used accounts: medical insurance, utility bills, PayPal, cryptocurrency exchanges, insurance policies. If an attacker has your personal information plus a breached password, they may apply for credit or services outside banking.

Step 6: Document Everything and Understand the Company’s Obligations

Save the breach notification email and take screenshots of any portal information. Document the date you received notice, the date the breach occurred, what data was exposed, and any URLs or reference numbers provided. Create a text file or spreadsheet with this information.

Under state breach notification laws (particularly California, which sets the standard for many states), companies must notify you “without unreasonable delay” and provide details about what is being done to prevent future breaches. Some states require notification within a specific timeframe (California requires “without unreasonable delay” but defines this loosely; New Hampshire requires within 18 months).

In rare cases, breaches trigger free credit monitoring, identity theft insurance, or settlements. Check whether the breached company is offering these. Some companies provide 1–2 years of credit monitoring free; document the enrollment window because these offers often expire.

Step 7: Report to Authorities and Check for Ongoing Exploitation

If the breach included financial data, file a report with the Federal Trade Commission at ReportFraud.ftc.gov. The FTC does not investigate individual cases, but reports inform their oversight and can help you document the incident. Provide details: what company, what date, what data was exposed.

If the breach included Social Security numbers or there is evidence the breach is being actively exploited (credentials are being sold on the dark web), file a report with your state’s attorney general office. Some states have cybersecurity units that track breaches affecting residents.

Over the following weeks, watch your credit reports and financial accounts. Most identity theft is caught within months, not years. If you see unauthorized accounts or inquiries, freeze your credit immediately (if you have not already), dispute the fraudulent accounts with the credit bureau and the company that opened them, and file an identity theft report with the FTC for documentation.

After 24 hours, your immediate response is complete. The work of monitoring and recovery continues for months, but taking these steps quickly significantly reduces the window during which attackers can exploit the data.