The letter arrives on good paper, apologizes in the second paragraph, and offers you a year of credit monitoring at no cost. That offer is the most visible thing on the page and the least valuable. It is worth taking, because free is free. It is not worth mistaking for protection.
Monitoring is a smoke alarm, not a lock. It watches for a new account opened in your name and tells you afterward. Somebody still opened the account, you still have the phone calls, the disputes, and the letters ahead of you. What it saves is time, and only if you act on the alert the day it arrives.
The thing that actually stops it
A freeze does the thing monitoring cannot. It puts your credit file out of reach, and a lender who cannot see the file has nothing to open an account against. Monitoring tells you afterward. A freeze means there is nothing to tell.
Freezes are free at each of the three nationwide credit bureaus, and you have to place one at all three separately, because a lender only checks one and you do not get to pick which. You can lift a freeze temporarily when you are applying for something yourself, which takes minutes online. That inconvenience, a few times a year, is the entire cost.
None of this is guesswork. The freeze process is set out step by step in the identity theft material the Federal Trade Commission publishes, which is also where a report gets filed if an account does get opened in your name. If you read one thing after a breach letter, read that rather than the enclosure the company sent.
Read the letter for the category, not the apology
Somewhere past the regret is a sentence listing what was taken. That sentence decides what you do next, and the categories are not equivalent.
- Email address and name only. Expect more convincing phishing, aimed at you by name, referencing the company you actually do business with. Nothing to freeze.
- Password, even hashed. Change it, and change it everywhere you used the same one. This is the case where the breach at a company you barely remember signing up with becomes a problem with your bank.
- Payment card number. The card issuer replaces the card and you are largely done. Card fraud is the well worn path with the strongest consumer protections on it.
- Social Security number, date of birth, driver's license number. This is the one that justifies the freeze. These do not expire and cannot be reissued casually, which is why an old breach can surface years later.
The week after
Freeze all three files. Change the password on the breached account and on every account where you reused it, starting with email, because whoever holds your email can reset everything else. Turn on two factor authentication wherever it is offered, which means a code or a prompt in addition to the password.
Then check your own statements for small charges rather than large ones. A test transaction for a few dollars is how a stolen card gets validated before it gets used properly, and it is the charge most people scroll past.
Pull your own credit reports while you are at it. You are entitled to free copies from each of the three bureaus, and the point is not to look for a dramatic surprise. It is to check the addresses and employers listed on the file, because an address you have never lived at is the earliest visible sign that somebody has been opening things in your name.
What the letter is not required to tell you
Breach notification is governed by state law, and every state has its own version. What that means in practice is that the letter you receive is written to satisfy the strictest state the company has customers in, and the level of detail varies accordingly.
The letter usually will not tell you how long the intruder was inside, whether the data has already been seen elsewhere, or whether your particular record was among those taken as opposed to potentially taken. The phrase may have been affected is doing real work in those sentences, and it often means the company cannot rule it out rather than that it happened.
Treat the ambiguity as a yes. The cost of freezing your credit when you did not strictly need to is a few minutes. The cost of assuming you were outside the affected set and being wrong is measured in months.
Monitoring is cheap in bulk, it is visible, and it is what state notification laws and years of practice have made the expected gesture. A company that offers it looks responsive, and the enrollment rate is low enough that the real cost is modest.
None of that makes it dishonest. It is a genuine service and some people will catch something with it. The point is only that it is the floor, provided by the company, and the ceiling is a freeze you place yourself in twenty minutes.
The habit worth forming
Keep the freeze on permanently and lift it when you need to. Most people apply for credit a handful of times a decade and are exposed the other ninety nine percent of the time for no reason.
Handled that way, the next breach letter is a piece of mail rather than an event. You read the category line, change a password if it applies, and put it in the recycling.