Got a Data-Breach Letter? A 30-Minute Lock-Down Plan
A breach notice says your data was exposed. This 30-minute plan sorts the steps by what was taken, and warns about the phishing that follows breach news.
The notice arrives by email or mail, it uses words like “unauthorized access,” and it rarely says what to do. Start by finding exactly what was exposed, because the right steps differ for a password and for a Social Security number.
An example, and what is still unknown
On October 28, 2026, Japan Airlines and its group carrier JTA announced that a third-party airline IT provider, Amadeus, had suffered unauthorized access. Aviation Wire reported that about 92,000 customers were affected, that part of the booking information was viewed from outside the system, and that no credit card numbers or passwords were leaked, according to the announcement. We could not open the airline’s own notice, so the numbers come from that news report.
| Confirmed in the report | Not confirmed here |
|---|---|
| Announced October 28, 2026 | When the intrusion happened |
| About 92,000 customers | Whether any data has been misused |
| Booking information partly viewed | Exactly which fields each person lost |
| Card numbers and passwords not leaked, per the announcement | Whether the letter you receive matches this summary |
Whatever the company, the pattern is the same: you receive a letter, and you decide in half an hour what it changes for you.
Minutes 0 to 5: read the letter for the data type
Find the sentence listing what was involved. Write it on paper in one of these categories: email address, phone number, home address, date of birth, passport or driver’s license number, payment card, bank account, Social Security number, or login credentials. If the letter says “personal information” without a list, call the company on a number you found yourself and ask for the list.
Minutes 5 to 20: act on what was exposed
| If this was exposed | Do this |
|---|---|
| Password for that company | Change it right away, plus any account using a similar password. Turn on multi-factor authentication. |
| Social Security number | Get your free credit reports, look for accounts you do not recognize, and consider a credit freeze or fraud alert. Use any free monitoring the company offers. |
| Credit or debit card | Watch for charges and account changes such as a new address, and contact the card issuer about the exposure. Switch on transaction alerts. |
| Bank account number | Call your bank on the number on your card and ask what it recommends for that account. |
| Email, phone, date of birth, travel details | No account is open yet, but expect targeted messages. Use the phishing checklist below. |
The SSN and password rows follow the FTC pages on what to do after a data breach and breach notices. The FTC also says to turn on multi-factor authentication and, for steps tailored to each data type, to use IdentityTheft.gov/databreach. The FTC’s pages do not give separate steps for email, phone or date of birth alone, so the last row is our judgment, not the FTC’s.
Minutes 20 to 30: set up for the phishing that follows
News of a breach is itself bait. The FTC’s alert about emails claiming your personal information is for sale advises: do not click links or call numbers in the email; change passwords, starting with your email, because password resets go there; check your credit reports at AnnualCreditReport.com; consider a free credit freeze; and report the email at ReportFraud.ftc.gov.
For travel data specifically, the likely follow-up is a message about a booking: a “change” to a flight, a refund, a seat upgrade or a payment problem. Korean Air and Asiana Airlines, which reported a related Amadeus exposure, advised customers to be wary of suspicious links, attachments and requests for personal information, per the same Aviation Wire report. Any message about a trip you take is a prompt to open the airline’s app or type its website yourself, not to reply.
- Save the original notice in a folder.
- Make a note of which accounts use the breached company’s login.
- Tell family members on the same booking or account.
- Set a calendar reminder in 30 days to recheck your credit reports and statements.
When to report, and where
If someone uses your information to open accounts or make purchases, the FTC’s advice is to report it at IdentityTheft.gov, where a personal recovery plan is built from what you tell it. You can also reach the FTC at 1-877-438-4338.
Questions people ask
Is a breach letter itself ever a scam?
It can be. Verify through the company’s own site or an independent phone number. Real notices do not require you to enter your password or Social Security number to “confirm” it.
Does monitoring cost anything?
The FTC says to take advantage of free credit monitoring or identity theft insurance if the breached organization offers it. A freeze is free regardless.
Is a freeze worth it if only an email address was exposed?
It does no harm and costs nothing. The decision is yours; the FTC calls a freeze “the best way to protect against an identity thief opening new accounts,” in the alert on dark-web emails.
If the follow-up email already has your attention, our guide on a suspicious link where you entered nothing helps check what actually happened.
If the letter is about a child or a relative
Breach notices sometimes arrive for a minor or an older relative. The FTC describes a free freeze for a child under 16 that stays until removed, and the credit bureaus provide separate forms for minors and for people with a power of attorney. Check whether the letter names the person whose data it is, and act on their behalf only with the authority to do so.
What the company’s offer is worth
Many notices offer a year of credit monitoring. The FTC says to take advantage of it if the breached organization offers it. Read the enrollment page carefully: use the website printed in the letter only after confirming it independently, and do not give more than the notice asks for. Monitoring tells you after an account opens; a freeze helps prevent it. They do different jobs, and you can use both.
Keep one record
Put the notice, the date it arrived and your actions in a single note or folder. If a fraudulent account does appear months later, that record shortens the conversation with the bureau, the bank and the FTC.
The second wave: what the follow-up messages look like
Breach news produces two kinds of fake message. One pretends to be the breached company: a “security update,” a “free credit monitoring” link, a refund. The other pretends to be a bank, an agency or an identity-protection service offering help. The FTC’s phishing page lists the signs: unexpected messages from a company you know that mention suspicious activity or account problems, generic greetings, urgent language, and requests to click a link, open an attachment or confirm personal information. Its rule for an uncertain message is to ask whether you have an account with the company, and if you do, to contact it using a phone number or website you know is real, not the details in the message.
| Message claims | Safe response |
|---|---|
| “Enroll in free monitoring” with a link | Do not click. Look up the monitoring offer in the original letter, or call the company on a number you found yourself |
| “Your account was locked after the breach, verify now” | Open the company’s app or type its address; check for any notice there |
| “Your bank detected fraud” a day after the news | Hang up or ignore it, then call the number on your card |
| “Your info is for sale, pay to remove it” | Ignore. The FTC says not to click links or call numbers in such emails, and to report them at ReportFraud.ftc.gov |
The FTC’s phishing page also says to forward phishing emails to [email protected] and phishing texts to 7726 (SPAM). If you shared a Social Security, card or bank number, it points to IdentityTheft.gov for steps by what you lost.
Scenarios: what to do by data type
- Only your email address and name. No account is open to abuse yet. Expect phishing. Make sure the email account itself has a unique password and multi-factor authentication, because the FTC notes that resets for other accounts go there.
- Email plus a password you reused. Change the password on every site where you used it, starting with email and money accounts. Our password cleanup plan shows how to find reuse quickly.
- Card number. The issuer can replace the card. Switch on alerts, and watch for small test charges.
- Social Security number. Freeze all three bureaus. The FTC lists fraud alerts as an alternative or addition, and says to order your free credit reports and look for accounts you do not recognize.
- Passport or travel documents. The sources we read give no federal checklist for passport numbers. Follow the company’s own guidance, apply the FTC’s general identity theft steps, and watch for accounts opened in your name.
The 30-day follow-up
- Week one: finish the steps above, and keep the notice.
- Week two: check statements and email for the account that was exposed.
- Day 30: pull your free credit reports and look for new accounts, inquiries or address changes.
- Quarterly for a year: repeat the report check and confirm any freeze is still in place.
If you do find something, report it at IdentityTheft.gov, where the FTC says a personal recovery plan is built from your answers. A freeze stops new accounts but does not remove ones already opened, so report them promptly.