It seems like every week another company announces a data breach. Retailers, healthcare providers, schools, and even financial services companies have all been targets. While these headlines can be unsettling and sometimes overwhelming, a data breach doesn’t automatically mean your identity has been stolen. What matters most is how quickly and thoughtfully you respond.

This month, we are here to help your account holders learn about the steps that accountholders can take to help protect themselves against the impacts of identity theft following a data breach, whether they have been directly affected by the latest incident that reaches the headlines.

Has Your Information Been Exposed? Here’s What to Do Next

It seems like every week another company announces a data breach. Retailers, healthcare providers, schools, and even financial services companies have all been targets.

While these headlines can be unsettling and sometimes overwhelming, a data breach doesn’t automatically mean your identity has been stolen. What matters most is how quickly and thoughtfully you respond.

What is a Data Breach and Why Does This Matter?

A data breach happens when unauthorized parties gain access to confidential personal information stored by an organization. What is considered personal information depends on state law, but typically it includes an individual’s first name or initial and last name, plus one or more of the following – Social Security number (SSN), driver’s license or state-issued ID number, or account number or credit or debit card number, combined with any security code, access code, PIN, or password needed to access an account.

Data breaches continue to occur at a record pace. In 2025 alone, more than 4,000 unique data breach events impacted at least 375 million individuals, according to the Privacy Rights Clearinghouse. Financial services remained one of the most frequently targeted industries, but healthcare, manufacturing, and retail are often targeted as well.

Typically, digital accounts and information come to mind, but a data breach can happen to physical records as well. And, while we generally consider data breaches to be tied to criminal activities, a data breach can be accidental and without malicious intent. Accidents happen!

Regardless of whether the data breach incident is accidental or malicious, the consequences can be severe. Once your personal data is exposed, criminals may use it to open fraudulent accounts in your name, steal your money or make unauthorized purchases, commit tax or medical identity theft, sell your information on the dark web, or access your online accounts, including email and social media.

The Federal Trade Commission (FTC) reports that Americans lost more than $16 billion to fraud in 2025, and more than $12.5 billion to fraud in 2024, a 25% increase each year. More than 1.1 million identity theft reports were filed through identitytheft.gov, highlighting just how common these crimes have become.

Even if you aren’t directly targeted or your information has been compromised in multiple data breaches over the year, any breach involving your information has the potential to cause long-lasting damage and stress.

If You Receive a Data Breach Notice, Don’t Ignore It.

Immediately after receiving a data breach notification in your inbox or hearing about a retailer breach that might affect you, it’s important that you act quickly to help secure your information and mitigate any potential damage. By taking a few simple steps now you can make a significant difference later.

Read the notification carefully.

Find out exactly what information was exposed. Was it your email address, password, Social Security number, or financial account information? When did the incident happen, and what is being done to avoid compromises like this in the future?

Change Your Passwords and Enable Multi-Factor Authentication (MFA).

Use a unique password for every account whenever possible. Even if the data breach notification you receive is for an account you don’t use anymore, so it doesn’t have your current credit card information, you might have used a password that you’re still using on other sites. Hackers know there’s a good chance you’re using the same password on multiple platforms. If they access your old gaming password from college, they might also be able to use it to log in to your current financial accounts. 

Activate MFA whenever it is available. Accounts that offer MFA provide extra security by requiring additional forms of identification beyond a password to log in to an account, such as a passcode or secret key obtained via text or email. Adding a second layer of security makes it much more difficult for criminals to access your accounts, even if they have your password.

Monitor Your Accounts and Check Your Credit.

Review your bank and credit card transactions regularly. If something doesn’t look right, report it immediately.

It can often take months for a company to find out that their customers’ data has been stolen and then communicate the information to their users. By then, your personal information could have already been sold on the dark web and used to open lines of credit before you have even been notified of the risk. Federal law entitles you to a free copy of your own credit report at least once every 12 months from each of the three main consumer credit reporting agencies: Equifax, TransUnion, and Experian. Reports can be requested at annualcreditreport.com or by calling 877-322-8228.

You may also consider placing a fraud alert on your credit report. An initial fraud alert is free and will stay on your credit file for at least 90 days. The alert informs creditors of possible fraudulent activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. Visit annualcreditreport.com for details. 

Watch for Warning Signs

Identity theft often starts quietly. Remain vigilant and stay alert for things like:

·       Purchases you don’t recognize

·       New accounts you didn’t open

·       Bills for services you never received

·       Unexpected password reset emails

·       Calls or text messages asking you to “verify” personal information

If something feels suspicious, trust your instincts and investigate.

Remember: Scammers Often Strike After a Breach

Even if you weren’t the direct victim of a data breach, you could still be targeted. Criminals frequently use breach announcements to launch convincing phishing scams. They may send emails or text messages pretending to be your bank, a retailer, or even a government agency.

Stay aware, and before clicking a link or providing personal information, make sure that you:

·       Verify the sender.

·       Visit the company’s website by typing the address into your browser rather than clicking a link.

·       Never share one-time verification codes, PINs, or passwords with anyone.

Our financial institution will never contact you by phone, email, or text asking you for your password, PIN, or security code.

We’re Here to Help

Protecting your financial well-being is our priority. If you notice suspicious account activity or believe you’ve been targeted by fraud, contact us immediately. The sooner potential fraud is reported, the faster we can work together to help protect your accounts and your identity.  [Personalize this section to reflect benefits included in your Econocheck Program] If you or a family member worry that you have become a victim of identity theft after a data breach or another fraud event, do not hesitate to reach out to one of our Identity Theft Recovery Advocates that are available to you as an <EMBEDDED ACCOUNT> account holder. They can help you assess what information has been compromised and quickly begin the process of recovering any losses that have occurred.