What is a data breach?


When a company's records are wrongly accessed, lost, or stolen, your sensitive information (like your Social Security Number, driver's license, or bank account details) could land in the hands of a criminal.

This information can then be used to create a false identity in order to open new accounts, file a tax return, or gain access to your credit cards. As a result, your credit could be blemished with unpaid accounts, and if you don’t take steps to close fake accounts under your name, you could receive phone calls from collection agencies. A data breach can happen to any business, whether a local dental clinic or a big online retailer.

What you should know:

  1. State laws typically require businesses to notify affected customers as quickly as possible. 
  2. Some type of data breach law exists in all 50 states and 4 U.S. territories..
  3. Typically, companies offer at least 12 months of credit monitoring or identity theft resolution to affected individuals. Several states now require this when highly sensitive information such as a Social Security Number has been breached.

What to do if you are a victim of a data breach:

If you think you’ve been the victim of identity theft, here are some tips to help you resolve the matter. Be sure to keep detailed records of all conversations and documents connected to resolving this matter in case you need to refer to these items later.

Step 1: Contact 1 of the 3 credit bureaus

  • By contacting Experian®, TransUnion®, or Equifax®, an initial security alert (or fraud alert) can be immediately included in your credit file that warns creditors to confirm your identity before approving credit. Keep in mind that an alert may limit your chances of being approved for new credit right away, and you may be asked to provide additional proof of identification.
  • Securing a report from each of the 3 bureaus is highly recommended if you believe you might be the victim of identity theft or fraud. When you contact a credit bureau regarding your case, you may also request a complimentary credit report. If you alert one of the credit reporting bureaus about fraudulent activity, the alert will be shared with the other credit reporting companies so they can update their credit files.

Step 2: Review credit report(s) carefully

  • Request a copy of your credit report from the credit bureaus, and thoroughly review each report for suspicious information or activity. You should also review your billing statements and immediately notify each creditor to dispute what you believe are fraudulent charges.
  • If you’ve identified fraudulent data, keep a list of all the potentially fraudulent information found on your credit report. Any data included that looks unfamiliar, including accounts, credit lines, addresses, and names should be reported.

Step 3: Obtain an identity theft report

  • An identity theft report will help remove fraudulent information from your credit report(s), prevent companies from collecting debts that result from identity theft, and can place an extended fraud alert on your credit profile. The extended fraud alert will last 7 years.
  • To create an identity theft report, fill out a complaint form on the Federal Trade Commission’s website and print the Identity Theft Affidavit. Use the affidavit to file a police report and create your identity theft report. You can also obtain an identity theft report by filing an official report about the identity theft to a federal, state, or other local law enforcement agency.

Step 4: Obtain an extended fraud alert & request removal of fraudulent data from your credit report

  • Once you have an identity theft report, contact one of the bureaus again to place an extended fraud alert on your credit profile and remove the fraudulent information.

There are 4 pieces of information that a credit bureau needs to remove fraudulent activity on a credit report:

  1. Proof of your identity
  2. Identification of fraudulent data from your credit report
  3. A copy of an official identity theft report (refer to Step 3)
  4. A statement from you that the fraudulent activity does not relate to any transaction made by you

With the required information, that bureau will remove all fraudulent activity from your credit report within four business days.

After following these steps, it’s important to continue monitoring your credit history regularly. Understanding how identity theft can be detected early and resolved is one of the best ways to help protect yourself from the harmful effects of identity theft and identity fraud.

Consider a dark web scan

If your personal information is involved in a data breach, it may not immediately be used for fraud. Instead, it may end up on the dark web where other fraudsters can buy and sell it for use at a later date.

Once your information is on the dark web, it's effectively impossible to remove it. But identity theft protection products like Experian's ProtectMyID Deluxe and ProtectMyID Complete can scan the dark web for your information and alert you if your identity may be at risk.

RELATED: What is the dark web, & how does it affect you?

Experian identity theft protection 

AAA members get free Experian identity theft protection2 with ProtectMyID Essential, or 2 free months of ProtectMyID Deluxe or Complete with promo code 60FREE24. Plus, get 2 free additional months by choosing annual payments.3

back to top icon