SSN Exposure Action Plan
A breach letter says your Social Security number was exposed. Now what? Tick what the notice lists and answer three questions, and this tool gives you a personal plan in order: what to do today, this week and from now on, with the official link for every step. It was built after notices like the one Vanguard filed with the Vermont Attorney General in November 2026; read what that notice says in our Vanguard data breach briefing. Not sure what your letter means? Start with the Breach Notice Decoder. Everything runs in your browser; nothing you tick is sent to us.
1. What the notice says was exposed
These are the categories US state attorney general breach listings use (Vermont's, for example). Tick everything your letter names.
2. Your situation
Everything runs in your browser. Nothing you tick or type is sent to us.
Tick at least one type of data (or a sign of misuse) to see your plan.
4. Keep a copy
Save the plan as a checklist with every link and source.
Sources
Every step comes from these official pages, read on November 13, 2026. Check them for changes before you act.
- FTC: Credit freezes and fraud alerts
- IdentityTheft.gov/databreach
- FTC: Free credit reports
- FTC: Free weekly credit reports are permanent
- FTC: Protect your child from identity theft
- IRS: Get an Identity Protection PIN
- Equifax freeze
- Experian freeze
- TransUnion freeze
- ChexSystems: security freeze information
- NCTUE consumer page
- my Social Security (SSA)
General guidance for people in the US, not legal or financial advice.
TL;DRWhat this plan does
4 points
- Tick the data your breach notice lists (the same categories state attorney general listings use), say whether it offers credit monitoring and by when, whether a child’s data was involved, and whether you already see misuse.
- You get an ordered plan in three groups: today, this week and ongoing. Each step says why it matters, how to do it, and links to the official page.
- It covers credit freezes at Equifax, Experian and TransUnion, fraud alerts, free weekly reports at AnnualCreditReport.com, the IRS Identity Protection PIN, your Social Security work history, ChexSystems, your bank or card issuer, health statements, your child’s credit, and breach-themed scams.
- Every step comes from an FTC, IRS, credit bureau or other official page, with the source and the date we read it. Free to use, signed out too. Everything runs in your browser and nothing is sent to us. Copying and downloading the plan are available with a paid plan.
Frequently asked questions
What should I do if my SSN was in a data breach?
The FTC’s IdentityTheft.gov lists the steps: get your free credit reports at AnnualCreditReport.com and look for accounts you don’t recognize; place a free credit freeze at Equifax, Experian and TransUnion (or at least a fraud alert); try to file your taxes early and respond right away to IRS letters; and review your Social Security work history through a my Social Security account. Sign up for free services if the breached company offers them. If someone has already used your information, report it at IdentityTheft.gov to get a recovery plan.
Should I freeze my credit after a data breach?
A freeze is the strongest step for an exposed SSN. While it is in place nobody can open a new credit account in your name, including you. Per the FTC it is free to place and lift, does not affect your credit score, and lasts until you lift it. You have to contact each of the three bureaus separately, and lift the freeze before you apply for credit. The FTC also notes you don’t have to wait for a breach to place one.
Is the credit monitoring in the breach letter enough?
Take it: the FTC advises signing up when a breached company offers free services. But monitoring watches your credit reports and alerts you when something happens, such as a credit check or a new account. A freeze is what stops a new account being opened. IdentityTheft.gov’s key steps are to check, freeze and monitor your credit, so do both.
What is the difference between a credit freeze and a fraud alert?
A freeze blocks access to your credit report for new credit until you lift it, and you place it at each bureau. A fraud alert makes businesses verify your identity before opening an account; you contact one bureau and it must tell the other two. An initial alert lasts one year and can be renewed. An extended alert lasts seven years and needs an FTC identity theft report or a police report. Both are free.
How does an IRS Identity Protection PIN help after an SSN breach?
An IP PIN is a six-digit number that stops someone else filing a tax return using your SSN. Anyone with an SSN or ITIN who can verify their identity can get one, most quickly through an IRS online account. A new one is issued each year, parents can get one for dependents, and the IRS says it will never ask you for your IP PIN.
Can I get a new Social Security number after a data breach?
Usually not. IdentityTheft.gov says that in most cases you can’t get a new number without evidence that someone is misusing yours, and a new number likely won’t solve everything because records still link you to the old one. The freeze, IP PIN and regular credit report checks do more.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.