You just received a California data breach notification, now what?
An identity theft data breach is alarming, but it doesn’t automatically mean you’ve been exposed. You could be at risk, but your next steps depend on what information and which accounts were involved. You may need to change your login details, contact your bank, place a fraud alert or enroll in credit monitoring. Here’s what you can do to prevent bad actors from exploiting your information.
The first 72 hours after a breach notice
The first three days of a data breach are critical. Don’t wait for evidence of fraud to take action. Start with your breach notification letter rights — information about the incident, types of data affected, and any help the organization is providing. This helps you navigate what information was exposed.
Stolen passwords
For stolen bank account numbers, ask your bank to close and replace the account with a new login. (You may want to wait for outstanding checks, automatic payments, and direct deposits to clear first.)
For compromised passwords, change all account credentials, security answers, and use a unique password for each. This step is especially important for sensitive medical or financial information, or stored credit cards. A password manager can help.
If your Social Security number was exposed, check your credit reports for accounts you don’t recognize, especially ones opened recently. Look in the inquiries section for suspicious creditors you did not request credit from. Some companies bill under names different from their store names.
If your driver’s license or state ID number is exposed, contact the DMV’s Driver License Fraud and Analysis Unit (DLFAU) by telephone at 1 866-658-5758 or email at dlfraud@dmv.ca.gov.
Credit monitoring
Next, contact the big three credit bureaus to report the breach. Each bureau has an automated telephone system that lets you flag your file and place a credit freeze.
Experian 1-888-397-3742
Equifax 1-800-525-6285
TransUnion 1-800-680-7289
Fraud alert placement, freezing, and unfreezing are free, and tells lenders to verify your identity before issuing credit. There are several types of alerts:
- Initial: Lasts for one year; for anyone suspecting fraud.
- Extended: Lasts for seven years; requires an identity theft report.
- Active duty: Lasts for one year; designed for deployed military personnel.
You can also enroll in credit monitoring services. Credit monitoring flags some new applications and accounts, but generally misses fraudulent charges on existing cards. Keep reviewing those transactions yourself.
Medical identity theft
Medical identity theft is when someone uses your personal and health insurance information to get medical care, buy devices, fill prescriptions, or submit fake insurance claims.
Thieves use many methods to steal your identity. They may steal your insurance card or medical bills, or hack patient and employee databases. Some scammers use fake emails and phone calls to trick you. Others use malicious links to install malware on your computer that collects personal data.
If your health insurance plan number is exposed, ask your insurer to flag your account. Check your Explanation of Benefits (EOB) statements for suspicious doctor visits and care you never received. An EOB lists your medical services covered by your plan.
When a breach turns into real fraud
When you discover a fraudulent account opened in your name, you have FCRA dispute rights. But fixing your credit report doesn’t repay the money you lost or undo the harm you suffered.
If a company failed to protect your information, California data breach law may allow you to seek compensation. Brennan Law can investigate and pursue legal remedies to hold them accountable and get the compensation you deserve.