What should I do immediately after a data breach?

Immediately after a data breach: (1) Freeze your credit at all three bureaus — Equifax, Experian, and TransUnion. This is free and instant. (2) Change the password for the breached account and any account that shares that password. (3) Enable two-factor authentication with an authenticator app. (4) Check HaveIBeenPwned.com for all your email addresses. (5) Contact your bank if payment details were exposed. Do not wait — account takeovers happen within hours of breach data going on sale.

How do I freeze my credit after identity theft?

To freeze your credit after identity theft, contact each bureau directly: Equifax at equifax.com/personal/credit-report-services, Experian at experian.com/freeze/center.html, and TransUnion at transunion.com/credit-freeze. Credit freezes are free and immediate under federal law (FCRA). You will need your SSN, address, and a PIN to unfreeze later.

What is a SIM swap attack and how do I prevent it?

A SIM swap attack happens when a criminal calls your mobile carrier, impersonates you using stolen personal data, and convinces them to transfer your phone number to a SIM card the criminal controls. In 2025, AI voice cloning makes these calls nearly undetectable. Prevention: add a carrier account PIN, enable SIM lock, and switch two-factor authentication from SMS to an authenticator app like Authy or Google Authenticator.

How is AI being used for identity fraud after data breaches?

In 2025, AI is weaponizing breach data in three ways: (1) AI voice cloning uses 3-30 seconds of your audio (from social media or voicemail) to impersonate you in calls to your bank or carrier. (2) AI phishing generates personalized emails using your breach data — name, employer, recent purchases — that are nearly impossible to distinguish from real messages. (3) AI-powered synthetic identity fraud combines your real SSN with fabricated identities to open credit lines that bypass standard monitoring.

Data Breach Response Playbook — What to Do in the First 24 Hours

Name: Data Breach Response Playbook
Brand: Digital Ghost Protocol
Price: 7.00 USD
Availability: InStock

// How to use this playbook

Work top to bottom, phase by phase. Click each task to check it off as you complete it — your progress is tracked at the bottom of each phase. Do not skip ahead. Phase 1 must be completed before Phase 2. The checklist resets if you close your browser, so complete each phase in one session or leave this tab open.

Overall Progress 0 of 38 actions complete

Start with Phase 1 below ↓

HOUR 0–1

IMMEDIATE LOCKDOWN

// PRIORITY: CRITICAL

Change the breached account password immediately

Go directly to the affected service. Do not use the same password or any variation of it. Generate a random 20+ character password using your password manager or a random string.

Do first
Enable 2-Factor Authentication on the breached account

Use an authenticator app (Google Authenticator, Aegis on Android) — not SMS. SMS 2FA can be defeated by SIM-swap attacks.
⚠ AI THREAT: Watch for SIM-Swap + AI Voice Cloning Attacks

After a breach, attackers may use your exposed phone number to SIM-swap your carrier account — transferring your number to their device to intercept calls and SMS codes. Simultaneously, if your voice is in any public audio or video, AI can clone it in under 30 seconds. Call your carrier now and request a SIM-lock PIN (also called a port freeze or number lock). Ask for it verbally — it's free. Then establish a family safe word — a short phrase only your household knows — to verify any urgent phone call claiming to be you.

New threat
Identify every account using that same password

If you reused this password anywhere, those accounts are also compromised. List every site that shares it — you'll change them all in the next step.
Change all shared passwords to unique ones

Start with highest-value accounts: email, banking, PayPal, Amazon, Apple ID, Google. Use a free password manager (Bitwarden) to generate and store unique passwords for each.
↗ Get Bitwarden (Free)

Do first
Log out all active sessions on the breached account

Most platforms have a "Sign out all devices" option in Security Settings. Do this immediately after changing your password to kick out anyone who may have active access.
Check email account for unauthorized forwarding rules

Attackers often set up silent email forwarding to receive copies of your email indefinitely. Go to Gmail/Outlook Settings → Forwarding → verify no unknown addresses are listed.
Check for unknown linked apps or OAuth connections

In your Google/Apple/Microsoft account: Settings → Third-party apps. Revoke any app you don't recognize or no longer use. These can be backdoors into your account.

HOUR 1–6

ASSESS THE SCOPE

// PRIORITY: HIGH

Run your email on Have I Been Pwned

Free tool that shows every known breach containing your email. Run all email addresses you own. Note the exact breach names and what data was included.
↗ haveibeenpwned.com
Determine what data was exposed in this specific breach

Find the breach notification email or the company's public statement. Identify exactly what was taken: email only, password hash, credit card, SSN, phone, address. This determines your next steps.
Check your email inbox for suspicious activity in last 30 days

Look for: password reset emails you didn't request, "new device signed in" alerts, purchase confirmations you don't recognize, or any email chains you don't remember starting.
Review account activity logs on high-value accounts

Gmail: Settings → See all settings → Last account activity. Google Account: myaccount.google.com → Security → Recent activity. Look for logins from unknown locations or devices.
Check your financial accounts for unauthorized transactions

Log into every bank, credit card, PayPal, Venmo, Cash App, and crypto account. Look for charges or transfers in the last 72 hours you did not initiate. Note any with amounts and dates.
Search your name on Google for any new exposure

Attackers sometimes post breached data publicly. Search: "YOURFULLNAME" + password OR "YOURFULLNAME" + leaked. Also check pastebin.com for your email address.
⚠ AI THREAT: Be Alert for AI-Crafted Phishing After This Breach

Attackers now feed breached data directly into AI tools to generate hyper-personalized phishing. They know your name, employer, recent purchases, and account types — and they use that to write convincing fake emails, texts, or calls that mention specific real details to earn your trust. In the 7 days following a breach, treat any unsolicited contact — email, call, or text — as suspicious regardless of how legitimate it sounds. Do not click links in any email related to your accounts. Navigate directly by typing the URL.

New threat

HOUR 6–24

CONTAINMENT

// PRIORITY: HIGH

Credit Protection

Freeze your credit at all 3 bureaus

A credit freeze is free and prevents new lines of credit from being opened in your name — even if someone has your SSN and full identity. Must be done at each bureau separately.

If SSN exposed

Bureau	Freeze URL	Phone
Equifax	equifax.com/credit-freeze	1-800-685-1111
Experian	experian.com/freeze	1-888-397-3742
TransUnion	transunion.com/credit-freeze	1-888-909-8872
ChexSystems	chexsystems.com/freeze	1-800-428-9623

Place a fraud alert with one bureau (auto-alerts the others)

A fraud alert is lighter than a freeze — it requires businesses to verify your identity before extending credit. Filing with one bureau legally requires the others to be notified. Start at Equifax.
↗ Equifax Fraud Alert
Pull your free credit report and review for unknown accounts

You're entitled to free reports from all 3 bureaus. Look for accounts, inquiries, or addresses you don't recognize — these may indicate identity theft already in progress.
↗ annualcreditreport.com (official)
⚠ AI THREAT: Watch for Synthetic Identity Fraud — Not Just Your Name

Synthetic identity fraud is the fastest-growing financial crime in the US. Criminals combine your real SSN with a fabricated name and address — creating a "Frankenstein" identity that won't appear on your credit report because it's technically a different person. It can take years to surface. Signs to watch for: unexplained hard inquiries on your credit report from lenders you've never contacted, IRS notices about income you didn't earn, or Social Security Administration alerts about earnings under your SSN from an unknown employer. If any of these appear, file an IRS Identity Protection PIN and an SSA fraud report immediately.

New threat

Bank & Financial Notifications

Call your bank's fraud hotline and report the breach

Even if no transactions are compromised yet — report proactively. Banks can flag your account for enhanced monitoring, issue a new card, and reverse any fraudulent charges more easily with a pre-filed report.
Enable transaction alerts on all financial accounts

Set up real-time SMS or email alerts for any transaction over $1. Most banks and credit cards offer this for free. This is your early warning system for the next 30 days.
Request a new card number if payment info was breached

Call and request a new card number even if no fraud has occurred. Card numbers in breach databases are tested immediately by bots. Don't wait for a charge to appear.

Notification Templates

Use these when contacting banks, employers, or contacts who may be targeted as a result of your breach.

// Bank / Financial Institution Notice

To: [Bank Fraud Department] Subject: Fraud Alert — Compromised Credentials, Account [LAST 4 DIGITS] I am reporting that my personal credentials were exposed in a data breach at [COMPANY NAME] on approximately [DATE]. The following data types were confirmed exposed: • [Email / Password / Payment Info / etc.] I am requesting: 1. A fraud flag placed on my account immediately 2. Enhanced monitoring for the next 90 days 3. Notification of any new account activity by email or SMS 4. A replacement card issued (if applicable) I have not yet identified unauthorized transactions, but am reporting proactively. Please confirm this alert has been placed. Account holder: [Full Name] Account ending: [XXXX] Date: [Today's Date]

// Warning to Known Contacts (if email breached)

Subject: Security Notice — Please Be Aware Hi [Name], I wanted to let you know that my email account was recently compromised in a data breach. If you receive any emails from [your email address] asking for money, passwords, gift cards, or personal information — please do not respond and delete immediately. It may not be me. I have secured my account and this address is now safe to use again. But please stay alert for the next few weeks. Thank you, [Your Name]

DAY 2–7

RECOVERY

// PRIORITY: MEDIUM

File an Identity Theft Report with the FTC (if identity stolen)

If you discover fraudulent accounts or charges, file immediately at IdentityTheft.gov. This creates a legal record that protects you when disputing fraudulent activity with creditors and credit bureaus.
↗ identitytheft.gov
File a police report if financial fraud occurred

Contact your local police department and request an identity theft report. Get the report number. You'll need this to dispute fraudulent accounts and may need it for your bank's investigation.
Dispute any fraudulent accounts or charges in writing

Send written disputes to each credit bureau and financial institution. Under the FCRA, bureaus must investigate and respond within 30 days. Include your police report and FTC report numbers.
Set up a Google Alert for your name and email

Go to google.com/alerts. Create alerts for: "YOURFULLNAME", "YOUREMAIL@domain.com", and any usernames exposed. You'll be notified if your info appears in new indexed pages.
↗ google.com/alerts
Enable breach monitoring on Have I Been Pwned

HIBP offers free email notifications when your address appears in a new breach. Set this up so you get early warning on future incidents instead of finding out months later.
↗ HIBP Breach Alerts
Audit and delete all accounts you no longer use

Use JustDeleteMe to find deletion instructions for hundreds of services. Old accounts are breach liabilities — every forgotten account with your email/password is an attack surface.
↗ justdeleteme.xyz
Contact the breached company for formal confirmation

Email their privacy or security team requesting: confirmation of what data was taken, when the breach occurred, and what remediation they're providing. Keep this correspondence for legal records.
⚠ AI THREAT: Submit Machine Unlearning Requests to AI Platforms

If your breached data was sold to AI training pipelines — which is common — your information may now be embedded in AI model weights. Under CCPA and emerging AI governance rules, you can formally request that platforms delete your data and exclude it from future training. Send the request below to: OpenAI (privacy.openai.com), Google (myaccount.google.com → Data & Privacy), Meta (facebook.com/help/contact/259518714718624), and Microsoft (account.microsoft.com → Privacy). Keep copies of all responses — compliance is legally required within 45 days in covered states.

New threat

// Machine Unlearning Request Template

Subject: Formal Data Deletion + AI Training Opt-Out Request To Whom It May Concern, Under [CCPA / GDPR / applicable state law], I am formally requesting: 1. Deletion of all personal data you hold associated with my identity 2. Opt-out of sale or sharing of my data for AI/ML training purposes 3. Removal of my data from any AI model training pipelines, past or future 4. Written confirmation of compliance within 45 days My identifying information: Name: [Full Name] Email(s): [All emails associated with your account] State of Residence: [Your State] This data was recently exposed in a third-party breach and may have been sold to data brokers or AI training pipelines without my consent. Failure to comply constitutes a violation of applicable consumer privacy law. — [Your Name] Date: [Today's Date]

// Formal Breach Inquiry to Company

To: [security@company.com / privacy@company.com] Subject: Formal Data Breach Inquiry — Account [USERNAME/EMAIL] I am writing regarding the reported data breach at [COMPANY NAME]. As an affected account holder, I am formally requesting: 1. Confirmation that my account was included in the breach 2. The exact categories of personal data that were accessed or exfiltrated 3. The date the breach occurred and the date you became aware of it 4. The specific steps being taken to prevent recurrence 5. Any identity protection services you are providing to affected users Please respond in writing within 14 days. I am retaining this correspondence as part of an ongoing personal records review. Name: [Full Name] Account Email: [Your Email] Date of Request: [Today's Date]

ONGOING

PREVENTION REBOOT

// PRIORITY: LONG-TERM

// Password Infrastructure

Switch to a Password Manager

Bitwarden (free, open-source) generates and stores unique passwords for every account. One master password — every account different.

// Authentication

Authenticator App for All Accounts

Replace SMS 2FA with an authenticator app. Aegis (Android, free) or Google Authenticator. Immune to SIM-swap attacks.

// Email Hygiene

Use Email Aliases for Signups

SimpleLogin.io (free tier) creates throwaway aliases that forward to your real address. Compromised alias? Disable it instantly.

// Monitoring

Monthly Credit Check

Rotate through Equifax, Experian, and TransUnion monthly using annualcreditreport.com — that's one free full report every 4 months.

Set a recurring calendar reminder to run a breach check

Once a month: run your email on HIBP, check your credit report, and Google your name. Takes 10 minutes. Catches 90% of new exposure before it becomes a problem.
Run the Digital Ghost Protocol on your full data footprint

The Playbook handles the breach response. The Ghost Protocol handles everything that was already public before this happened — your address, phone, family members, and social data still need to be removed.

// 30-Day Post-Breach Monitoring Checklist

WEEK 1: □ Confirm all passwords changed and 2FA enabled □ Monitor bank/credit accounts daily for new charges □ Review email inbox for unauthorized password resets □ Confirm credit freeze is active at all 4 bureaus WEEK 2: □ Check credit report for new account inquiries □ Search your name on Google for new public exposure □ Check pastebin.com for your email address □ Follow up with breached company if no response WEEK 3: □ Review all active sessions on major platforms □ Confirm Google Alerts are sending notifications □ Check HIBP for any new breach appearances WEEK 4: □ Pull second credit report from a different bureau □ Review and revoke any suspicious 3rd-party app access □ Document the full incident with timeline for records □ Decide if freeze should remain or be lifted

// PLAYBOOK COMPLETE

You Ran the Protocol.

The breach is contained. Now make sure your broader digital footprint is clean — addresses, phone numbers, family data, and old accounts still need to come down.

The Digital Ghost Protocol covers everything else.

// STEP TWO

Erase Your Existing Footprint

This Playbook handled the breach. The Digital Ghost Protocol removes everything that was already public — data brokers, people-finder sites, old social profiles.

GET THE GHOST PROTOCOL →

$17–$27 · one-time

// STEP THREE

Build a Privacy-First Tech Stack

Once your footprint is gone, the Ghost Stack Setup Guide locks down your browser, email, passwords, and devices so new exposure stops accumulating entirely.

GET THE GHOST STACK →

$27–$47 · one-time

DATABREACHRESPONSEPLAYBOOK