What should you do if your data is in a breach?

Act in order of leverage. Change the password on the breached account and, more importantly, anywhere you reused it, because credential stuffing, where attackers try leaked combinations across other sites, is the primary way a single breach becomes many. Turn on two-factor authentication wherever available, preferring an authenticator app or hardware key over SMS, which is vulnerable to SIM swapping. If the breach exposed a Social Security number or financial data, freeze your credit with Equifax, Experian, and TransUnion; freezing is free by federal law, blocks new accounts from being opened in your name, and can be lifted temporarily when you need credit.

Some further steps depending on what leaked. Place a fraud alert if you prefer a lighter measure than a freeze. Monitor account statements directly rather than relying on notification, and report identity theft at the FTC's site, which generates a recovery plan and an official affidavit. The free credit monitoring offered after a breach is worth accepting but is detection rather than prevention, and it is a weaker tool than a freeze. Expect targeted phishing afterward, since attackers combine leaked details to make convincing approaches, and treat any unexpected contact referencing the breach as suspect. Longer term, a password manager makes unique passwords per site practical, which is the single change that limits the blast radius of the next breach, and there will be a next one.