Email, Card Number, Social Security Number. Which Breach Letter Actually Changes Your Week

Breach letters are written by lawyers to satisfy a state statute, which is why they all sound alike regardless of whether the incident is trivial or serious. The tone will not tell you which one you are holding. The data element will. A letter that says an email address and a hashed password were exposed asks something very different of you than one naming a Social Security number and date of birth, and the difference is not a matter of degree but of kind. Sorting by that single fact is the whole judgment.

Five categories, and the very different weeks they produce

An email address alone, or an email address paired with a hashed password, is the most common category and the least demanding. You change that password, you change it anywhere you reused it, and you are done inside twenty minutes. A payment card number is the next tier up, and it is genuinely easy because the card network absorbs the loss: you call the issuer, a new card arrives in a few days, and your only real work is remembering which recurring charges are attached to the old number. The gym, the streaming service, the pharmacy autopay. That is a week of small annoyances, not a year of exposure.

A Social Security number paired with a date of birth is a different animal, because neither can be reissued and both are permanently useful to someone opening credit in your name. A driver's license number sits oddly in between, since it can be changed only through the DMV and usually only with cause, and it turns up in account-opening fraud more often than people expect. Medical and insurance records are the fifth category, and the one most letters describe least clearly. The exposure there is not usually credit fraud but billing fraud and a record that becomes hard to correct.

Freeze, monitoring, or password hygiene: what each one costs you in ordinary time

A credit freeze at all three nationwide bureaus is free, it takes maybe half an hour the first time, and it is the only measure in this comparison that actually blocks a new account from being opened. Its ongoing cost is not money but friction, and the friction is real. You will thaw the file when you refinance, when you lease a car, when you switch cell carriers, sometimes when you sign up for utilities at a new address. Each thaw takes minutes if you have the PIN and an afternoon if you do not. Store the PINs where the household can find them.

Credit monitoring, the service the breached company usually offers for a year, does not block anything. It tells you after the fact, by email, that something appeared on your file, which is worth having but is a detection tool rather than a defense. Its week-to-week reality is a stream of low-value alerts that most people stop reading by month three, which is the failure mode nobody warns you about. Password work is the cheapest and highest-yield of the three, because reused credentials are what turn one company's breach into a problem at four other companies. A manager makes that permanent.

The Federal Trade Commission is responsible for identity theft reporting and recovery guidance at the federal level, and its recovery process is the one that banks, collections agencies, and credit bureaus recognize when you need a fraudulent account removed. Knowing that the route exists changes how you weigh the three measures. A freeze reduces the chance you ever need it, monitoring shortens the time before you notice you do, and neither replaces the paperwork itself. The right combination for most households is the freeze plus a password cleanup, with monitoring accepted because it is free rather than because it is protective.

Deciding for someone who is not going to manage it themselves

Most of the hard cases are not your own file. A letter arrives addressed to a parent who no longer opens mail carefully, or names a minor child who has a credit file only because someone else already tried to use it. The comparison shifts, because the friction cost of a freeze drops close to zero for a person who is not applying for credit anyway. A retired parent who owns their home outright and has no plans to borrow loses almost nothing by freezing permanently. A child under sixteen loses nothing at all, and the freeze is the single most useful thing you can do on their behalf.

What you gain in protection you pay for in administration, and that is the part to settle in advance rather than discover later. If you freeze a parent's file, you become the person who thaws it when the assisted living facility runs a credit check or the new insurer wants a soft pull. Write down which bureaus were frozen, on what date, and where the PINs live, and tell one other family member where that note is. The failure is almost never the freeze. It is the freeze nobody else in the family knows about.

Get the account access sorted too, because breach response often requires logging into the breached service to change a password or check what was on file. If you are acting for someone else, that means either their credentials or a legitimate authorization, and the time to arrange that is a quiet Tuesday rather than the day a letter arrives. Many households find that this one prompt is what finally gets a shared record of logins written down. The breach letter is a poor reason to build that list and a very effective one.

How to tell, six months later, whether you judged it right

The honest measure is not whether anything bad happened, since most exposures never produce a visible fraud, but whether the measures you chose are still in place and still working. Check that the freeze survived: bureaus occasionally lift them after a dispute or an account merge, and nobody writes to tell you. Pull your free credit reports on a rotating schedule rather than all at once, so you are looking at fresh data three times a year instead of once. Confirm that the reused passwords you meant to change actually got changed, because the ones people forget are the old accounts.

Watch, too, for the second-order signal that a breach is being worked: a rise in targeted messages that know something about you. Texts naming the breached company, calls claiming to be from the fraud department, emails referencing a real recent purchase. Those follow a disclosure by weeks or months, and their appearance means the data is circulating rather than sitting idle. Treat every inbound contact about the breach as unverified and call the number on your own statement instead. That habit costs nothing and closes the most reliable path anyone has into your accounts.

The letter itself is a legal document with almost no information density, and reading it for reassurance is the wrong use of ten minutes. Read it once for the data element, decide which of the five categories you are in, take the twenty-minute action or the half-hour one, and write down what you did and for whom. Then let it go until the next one arrives, because another one will.