The Identity Theft Resource Center just counted 471 million victim notices in the first half of 2026 alone — already more than all of 2025 — and here’s the part that should change how you react: 76% of those notices don’t say what happened. No cause, no attack vector, often no clear list of what was taken. You’re handed a vague letter and left to figure out your own exposure.

So let’s remove the guesswork. Professional responders don’t improvise during an incident — they follow a runbook. You should have one too. Print this, save it, and when the letter arrives (or you spot a fraudulent charge, or a login alert you didn’t make), you work the steps instead of panicking. This is the personal-scale version of the incident-response strategies we’ve covered for systems.

Phase 0: Triage — Figure Out What’s Actually Exposed (First Hour)

Before you do anything, answer one question: what was in this breach? Your response depends entirely on the data type.

  • Read the notice for the data categories — even the vague ones usually list something. Map exposure to severity:
    • Password / login exposed → account-takeover risk. Go to Phase 1 immediately.
    • SSN / national ID / driver’s license → identity-theft risk. Phase 3 (credit freeze) is mandatory.
    • Payment card → fraud risk. Contact the bank, get a new card number.
    • Email + phone + address → phishing/vishing fuel. Raise your guard (see our vishing defense guide); these feed the next attack.
  • Confirm your own exposure independently. Check Have I Been Pwned for the breach and your accounts — it’s often clearer than the official notice about what leaked. Our credential-stuffing tutorial has a script to check specific passwords.
  • Assume the worst on vague notices. If the letter won’t say, treat login and identity data as potentially exposed and do both tracks.

Phase 1: Contain — Lock the Affected Accounts (First Day)

Containment first. Stop the bleeding before you investigate anything.

  1. Change the password on the breached account — to a unique, generated one from your password manager. If you reused that password anywhere, change it everywhere it was used. This is the whole reason credential stuffing works.
  2. Revoke active sessions. Changing your password often doesn’t kick out an attacker who’s already logged in. Every major service has “log out all devices” / “active sessions”:
    • Google: Security → Your devices → Manage all devices → Sign out.
    • Microsoft, Apple, Facebook, and most others have the equivalent under Security.
    • Do this for email first — it’s the master key to everything else.
  3. Audit connected apps (OAuth grants). This is the step most people miss. Attackers plant a “connected app” so that even after you change your password, they still have API access. Review and revoke anything you don’t recognize:
    • Google: Security → Third-party apps & services.
    • Microsoft: My Apps / app permissions. GitHub: Settings → Applications.
  4. Turn on phish-resistant MFA if it wasn’t already — passkeys or a FIDO2 hardware key. This locks out an attacker even if they still have your (now-changed) password.

Phase 2: Investigate — Was Anything Else Touched? (First Few Days)

Now that the account is contained, check what the intruder did while they had access.

  • Read the security/activity log. Most services show recent logins with location and device. Note anything you don’t recognize — that’s your timeline.
  • Check for attacker persistence:
    • Email forwarding rules and filters — a classic trick is a silent rule forwarding your mail (or auto-deleting bank alerts) to the attacker. Check Settings → Filters/Forwarding and delete anything you didn’t create.
    • Recovery email and phone — attackers change these to lock you out later. Confirm they’re still yours.
    • New “trusted devices” or app passwords you didn’t set up.
  • Follow the blast radius. If your email was compromised, assume every account that uses that email for password resets is at risk, and work outward to the important ones.

Phase 3: Protect Your Identity (If SSN / ID Was Exposed)

If identity data leaked, account passwords aren’t the threat — someone opening credit in your name is. Do this regardless of whether you’ve seen fraud yet:

  1. Freeze your credit. This is the single most effective, and free, anti-identity-theft move. A freeze stops new accounts from being opened in your name. In the US, freeze at all three bureaus — Equifax, Experian, and TransUnion — individually. (Outside the US, use your national equivalent.) You can temporarily lift it when you need credit.
  2. Set fraud alerts as a lighter-weight backup if you’d rather not freeze.
  3. Watch your financial accounts closely for the next several months — new-account fraud often lags the breach.
  4. Be extra skeptical of “breach follow-up” contact. Scammers call breach victims pretending to be the breached company or a bank “helping.” Real breach response never asks for your password or a 2FA code. Verify out of band, every time.

Phase 4: Monitor and Recover (Ongoing)

  • Turn on breach monitoring. HIBP notifications email you automatically when your address appears in a future breach — free early warning.
  • Watch bank and card statements for small “test” charges, the tell of card fraud before the big one.
  • Keep records. Save the notice, your timeline, and every action you took. If fraud happens later, this documentation is what you’ll need for disputes and (in the US) an FTC IdentityTheft.gov report and police report.
  • Do a wider password sweep. A breach is a good forcing function to fix every reused password, not just the one that leaked.

The One-Page Runbook (Screenshot This)

The moment you learn you’re breached:

  • Triage: What data leaked? (password / SSN / card / contact info) — set your track.
  • Change the password → unique + generated. Change it everywhere it was reused.
  • Revoke all active sessions (email first).
  • Audit + revoke connected OAuth apps you don’t recognize.
  • Enable passkey / hardware-key MFA.
  • Check for forwarding rules, changed recovery info, rogue devices.
  • Freeze credit at all bureaus (if ID/SSN exposed).
  • Raise phishing/vishing guard — you’re now a target for the follow-up.
  • Turn on breach + financial monitoring.
  • Document everything.

The Bottom Line

You will end up in a breach — 471 million notices in six months is not a statistic you dodge, it’s one you join. What separates a scary letter from an actual identity-theft nightmare isn’t luck; it’s whether you had a plan before you needed it. The companies losing your data increasingly won’t even tell you what happened, so your response can’t depend on their transparency. Work the runbook: triage what leaked, contain the accounts, hunt for persistence, freeze your credit, and stay alert for the follow-on scam. Calm and methodical beats fast and panicked every time — and now you’ve got the checklist to be both calm and quick.

The full ITRC H1 2026 breakdown — including why 76% of notices disclose no cause and the surge in insider incidents — is on our sister site: 471 Million Notices in Six Months.