If You’ve Been Affected by a Data Breach

If you have been notified of a data breach or if you suspect that you have been a victim of a data breach, we recommend you consider the following:

• Check the website of the retailer with the latest breach. Type the store’s name directly into your browser. Do not click on an e-mail or social media message that mentions the security breach. It could be a scam.
• Beware of scammers who attempt to trick you into thinking they are really the retailer. The scammers can also pretend to be your bank or your credit card issuer. They tell you that your card was compromised and suggest actions to “fix” the problem. Do not provide your financial information to anyone who e-mails or calls you. Scammers can “spoof” your telephone’s caller ID so that it appears that the call is being made from a specified retailer with a specific telephone number, even though the call is being made from a different location. Again, type the store’s name directly into your browser in order to obtain a telephone number, e-mail address or other contact information. Then contact the company directly and ask about the data breach.
• Accept or enroll in identity protection services that the breached company offers you free of charge, such as protection services with any of the three credit reporting companies (TransUnion, Equifax, or Experian).
• Change your passwords. Set new passwords for your financial (bank and credit card) accounts. A strong password should be more than eight characters in length and contain both capital letters and at least one numeric or other non-alphabetical character. Consider using non-dictionary words.
• Monitor your credit reports. To order a free credit report, visit annualcreditreport.com.  Or complete an Annual Credit Report Request Form and mail it to:

• Check every credit card charge, no matter how small, on your statements. Scammers often test cards with minimal charges before making much larger charges. If you see a suspicious charge, contact your bank immediately.
• Inform your bank that you were a customer at the breached institution. If your card was affected, the bank might contact you first to issue a new card.
• Request a fraud alert. If your Social Security Number was stolen in a breach, ask the credit reporting agencies to put an Initial Fraud Alert on your file so creditors know to further verify the identity of any individual who attempts to open new accounts or take other actions under your name. You may contact:

You only need to contact one of the three credit reporting agencies to place an alert on all three.  The credit reporting agency you call must tell the other two agencies about your alert — confirm that the credit reporting agency plans to do that.  The Initial Alert stays on your report for 90 days.

• Get a security freeze. A security freeze allows you to proactively “lock up” your credit information so no one can access it without permission. This prevents a thief from falsely using your identity to take out a new mortgage, apply for a credit card, or get financing, among other things. Here are some important things to consider before getting a security freeze:
  • 1. How do you request a security freeze? You must write each of the three credit reporting agencies. A sample request letter is available here. Each of the agencies will send you written notice that the freeze is in place within five days of it going into effect. That notice will also provide a personal identification number (PIN), and instructions on how to lift or remove the freeze.
  • 2. How do you temporarily lift a freeze? To open a new credit account, take out a new loan, or allow a background check, you will need to lift the security freeze. The freeze can be lifted for a specific period of time or for a specific creditor. Call each of the agencies and use your PIN. Specify whether you want to temporarily lift the freeze for a specific date range or for a specific creditor.
  • 3. How do you permanently remove a security freeze? Call the agencies and use your PIN. There is no fee for permanently removing a security freeze.