The email arrives on a Tuesday. Your employer "recently identified unauthorized access" to a system. Your Social Security number, bank details for direct deposit and W-2 data may be involved. That is a lot of nouns for one paragraph. Here is a calm order of operations, with the red flags marked.

Start by reading the breach notice closely

Read the notice before you act on anything else. It should say what data was involved, when the incident happened and what the company is offering. Those three facts decide how urgent every later step is.

Do not assume your employer was hacked directly. Many incidents start at a vendor that handles payroll, benefits or pensions. The 2023 MOVEit file transfer attacks are one example of a vendor problem that reached many employers and their workers. Knowing who held the data tells you who to call.

Payroll and benefits records hold details that cannot be changed. A Social Security number stays yours for life. Benefits files can also list spouses and dependents, so your household may be affected even if you were the only employee.

Start a log today. Write down the date the notice arrived, each call, each form and each letter. If you ever have to dispute a fraudulent charge, this record shows when you noticed and what you did.

What an exposed Social Security number does and does not mean

An exposed number is not the same as stolen identity. What matters is who has it, what else they know about you and whether anyone is using it. Panic is not a plan. Neither is shrugging.

Someone holding your number and other details may try to open credit accounts, claim a tax refund, get a job or services under your name, claim unemployment benefits or obtain health benefits. Each of those leaves a trail in a different place.

That is why checking only your credit reports falls short. A fake job or a fraudulent tax return may never touch them. Tax records and work records matter too.

Compare credit freezes and fraud alerts before choosing

Both tools are free. Neither affects your credit score. They work differently, so here is the short scorecard on how each one behaves.

  1. Credit freeze: blocks new accounts from being opened in your name. You set it up separately with Equifax, Experian and TransUnion. You can lift it temporarily when you apply for credit yourself.
  2. Initial fraud alert: asks businesses to verify your identity before opening accounts. It generally lasts one year, and you can cancel it sooner. Place it with one bureau and that bureau must notify the other two.
A kitchen table in warm afternoon light with a laptop, a printed notice and an open notebook of handwritten dates and call notes, ready for a careful breach response.
A person at a kitchen table with a laptop, a printed breach notice and a handwritten log of calls and dates.
  1. Pick by habit: a freeze blocks more but needs lifting when you borrow. An alert is lighter and still prompts extra checks.
  2. Think about timing: if you rarely apply for credit, a freeze costs you little effort. If you apply often, weigh that before choosing.

Protect your tax filings and your paycheck

An IRS Identity Protection PIN is a six-digit number that helps stop someone else from filing a return with your Social Security number. Any taxpayer who can verify their identity can request one. It is worth considering if your number or W-2 data was exposed. The sources here do not cover how to get one, and one headline suggests the IRS PIN portal may be going offline. Check the IRS site directly for current steps.

If you suspect tax-related identity theft, the IRS suggests Form 14039, the Identity Theft Affidavit. Filing it can help invalidate a fraudulent return made with your information. The IRS page on data breaches for taxpayers is a good place to read more.

Now the paycheck. A common follow-up scam is a fake request to change where your pay is deposited. It often arrives by email and looks official. Red flag. Confirm bank details in the payroll portal, and ask payroll to verify any change by phone using a number you already trust.

Watch for warning signs and know where to report

Warning signs are plain. Bills for things you did not buy. Debt collectors calling about accounts you never opened. Unfamiliar accounts on your credit report. A loan denial that makes no sense. Mail that stops arriving. Any one can have a boring explanation, but check each one promptly.

The FTC runs its identity theft reporting page and a phone line at 1-877-438-4338. IdentityTheft.gov can build a recovery plan for your situation and produce reports creditors may ask for. USAGov lists the same reporting paths.

You can also contact the three credit bureaus to place alerts or freezes. If you see odd activity on an existing account, call that bank or card issuer's fraud department. Write down reference numbers and names.

Ask your employer the right questions and be cautious with contacts

HR should be able to answer a few things. Which system or vendor was involved? Were dependents' records included? Who handles follow-up questions? Will a written notice arrive by mail? How long does any monitoring last, and does it cover family? Will payroll confirm bank changes outside of email? Write down the answers and the date.

Monitoring offered in a notice is typically free. It often comes with an enrollment code and a deadline, so note the date. After breaches, class action settlements commonly offer a flat cash payment, reimbursement for documented losses or pay for time spent dealing with the problem. The class is usually everyone who received the notice, so employees are often included. The sources do not give claim deadlines, so read any settlement notice closely.

Last red flag. Be wary of unexpected calls, texts or emails, even ones that mention your breach. They may be phishing that uses the breach as a hook. Contact the organization using a number or address you already have, never one supplied in the message.