A breach notice landed in your inbox. What an incident responder does next

Breach notifications are written by lawyers and read by nobody. They arrive weeks or months after the event, describe what happened in the passive voice, and end with an offer of credit monitoring that most people either ignore or accept without understanding what it does.

The conversation below is with someone who has spent several years doing incident response work for mid sized companies, on the other side of these letters. It has been condensed and edited for length, and the person asked not to be named because they still work in the field.

What do you actually read a notification for?

Three things, and they are usually buried. First, what categories of data were involved. There is an enormous difference between an email address and a password hash on one hand, and a Social Security number or a driver's license number on the other. The first is an inconvenience. The second is the raw material for opening credit in your name.

Second, the date range. Not the date of the letter, the date range of the exposure. If it says the access occurred between June and September and you are reading this in February, that data has been circulating for months and anything that was going to happen with it has probably started.

Third, whether they say the data was encrypted, and if so, whether the encryption keys were also involved. Companies are careful with that sentence for a reason. Encrypted data with the keys taken is unencrypted data with extra steps.

What is the first thing you tell a friend to do?

Change the password on that account, and then change it anywhere else you used the same one. That second part is the whole game. The primary way one breach becomes six is credential stuffing: attackers take the email and password pairs from one site and try them everywhere, automatically, at enormous scale.

Then turn on second factor authentication on the account, and on your email account if it is not already on. Email is the reset mechanism for everything else you own, so an attacker with your email has your bank, whether or not they ever saw your banking password.

Where does credit monitoring fit?

It is useful and it is oversold. Monitoring tells you after something has happened. It does not prevent anything. Accept the offer, since it is free, but do not treat it as the response.

The step that actually prevents new credit being opened is a security freeze at each of the three major credit bureaus. It is free, it is a legal right, and it stops a lender from pulling your file, which is what stops an account being opened in your name. You lift it temporarily when you need credit yourself. Most people never do this because it sounds like more work than it is; it takes about twenty minutes total.

What comes after the account itself?

Look at what that account can reach. If it stored a payment card, watch the statement for that card specifically, and consider having it reissued. If it held an address history and a date of birth, those combine with anything else already circulating about you, which is why exposures accumulate rather than expire.

Then think about the security questions. People reuse those far more than they reuse passwords, and if a breached site held your mother's maiden name and your first pet, those answers are now in the same place as everyone else's.

How much of this is actually urgent?

Password changes and second factor are the same day. The credit freeze is that week. Everything else can wait.

What I would push back on is the instinct to do nothing because the letter is vague and the event is old. The half life of this data is long. A Social Security number does not expire and cannot practically be changed, so exposure now can be used in two years, and often is, precisely because people have stopped watching by then.

Is there anything people do that makes it worse?

Clicking through from an email about a breach. The single most reliable follow on attack to any publicized breach is a wave of phishing referencing it, because the attacker knows the recipients are expecting to hear from that company.

So do not use the link in the letter. Go to the company's site by typing the address, or call the number on the back of your card. The same applies to phone calls claiming to be from a bank's fraud department. End the call and dial the number printed on your own statement instead. Every incident responder I know does this automatically, and it is the habit most worth borrowing.

The reassuring part is how short the actual list is: change the reused passwords, turn on second factor, freeze the credit files, and be suspicious of anything that arrives referencing the breach. That is an hour of work and it covers nearly all of the realistic risk from a letter like this one.