First, check the letter is real
Breach letters usually come by mail, sometimes by email, and name the company, what was exposed and when. Fakes copy them to get you to call a number or click a link. Look the company up yourself: a real breach is normally announced on its website, and many state attorneys general publish the breach notices companies file. Use the phone number or enrollment site only once it matches what you find. The same checks work for settlement notices; see is that settlement email real.
What to do this week
- Use the free protection the letter offers. Most offer credit or identity monitoring with an enrollment code and a deadline to sign up.
- Freeze your credit if your Social Security number was exposed. A freeze is free at each of the three bureaus, Equifax, Experian and TransUnion, and doesn't affect your score (FTC guide).
- Get an IRS Identity Protection PIN, also if your Social Security number was exposed. It stops anyone else filing a tax return in your name (IRS).
- Change the password if account logins were exposed, and on any other site where you used the same one. Turn on two-step sign-in where you can.
- Watch your statements for charges or accounts you don't recognize. If you find identity theft, report it at IdentityTheft.gov, which gives you a recovery plan.
Keep the letter and a record
Keep the letter, or a photo of it. If a settlement follows, the class is usually the people the company notified, and some claim forms ask about the letter. Many data breach settlements also pay for documented losses and for time spent dealing with the breach, so write down what you spend, like postage or a replacement ID, and how long things take. Save receipts. See do you need proof.
Will there be a settlement?
Not always, and not soon. Lawyers often file class actions within days or weeks of a company announcing a large breach. Some cases are dismissed. The ones that settle usually take a year or more, and only then does a settlement notice go out with a claim form and a deadline. A breach letter is not a settlement notice: there's nothing to claim yet.
You don't need to sign up with a law firm or pay anyone to be part of a class action. If a settlement covers you, you're in the class already and you file your claim for free on the settlement's official site.
Settlements open now
ClaimWell lists 76 data breach settlements open today. If a company wrote to you about an earlier breach, check whether that one has settled: see open data breach settlements.