Got a data-breach notice? The first three things to do

A breach notice means a company says your information may have been exposed. It is not a confirmation that someone is using it — and it is not junk mail. Read what data was involved: a password is annoying, a Social Security number is serious, medical data is both.

Also check the letter for two things people miss: a settlement or claim deadline, and an offer of free credit monitoring with an enrollment code and its own expiry date.

Step one and two: reports, then freezes

Pull your free credit reports at the official AnnualCreditReport.com and scan for accounts you do not recognize. Then place free credit freezes at all three bureaus — free by federal law, liftable in minutes when you need credit.

If you find actual misuse, go to IdentityTheft.gov: the FTC's official tool builds a free recovery plan and generates the report that bureaus and creditors use to block fraudulent accounts.

Step three: check for a settlement

Large breaches usually produce a class-action settlement with a claim deadline months later. Keep the notice — it often contains the ID you need to file — and check whether a settlement is open. We track the active ones, each linking to the official administrator site.

One caution: breach news attracts phishing. Any message asking for a fee, password, or full Social Security number to 'confirm your settlement' is a scam. File only on the official site.