A data breach recovery tracker turns a stressful breach notification into a manageable process. Use this guide to record what was exposed, secure affected accounts, apply credit and identity protections, and schedule follow-up checks at 30, 90, and 365 days.
Overview
A breach notice is not always a complete account of the risk. The exposed information may be clarified later, and criminals may use stolen data months after an incident. Your response should therefore be organized as a series of actions and reviews rather than a single password change.
Start by creating a private tracker in a document, spreadsheet, or password manager. Do not put sensitive information such as full account numbers, passwords, security answers, or government identification numbers in an unencrypted note. Record only what you need to manage the response: the affected organization, notice date, types of data involved, actions completed, follow-up date, and evidence such as confirmation numbers or support case references.
If you are unsure whether a notice is genuine, do not use links or telephone numbers in the message. Verify the incident through the organization’s known website or a trusted statement. The guide How to Verify a Data Breach Notification provides a safer process for checking a breach alert before taking action.
What to track
Organize the tracker by risk category. A useful record can include the following fields:
- Incident details: organization name, date you received the breach notification, incident or reference number, and the organization’s stated support contact.
- Exposed data: email address, password, phone number, address, payment information, account details, government identification information, medical information, or other data named in the notice. Mark information as “confirmed,” “possible,” or “not stated” rather than assuming the broadest risk.
- Affected accounts: list every account that used the exposed email address, password, phone number, or security questions. Include accounts that may not have been named in the breach notice.
- Password and passkey status: record whether the password was changed, whether it was reused elsewhere, and whether a passkey or authenticator-based sign-in is available. Never record the new password itself.
- Multifactor authentication: note whether multifactor authentication is enabled, which method is used, and whether backup codes were generated and stored safely.
- Sessions and recovery settings: record whether active sessions were revoked and whether recovery email addresses, phone numbers, forwarding rules, and trusted devices were reviewed.
- Credit and identity protections: track whether you requested a credit freeze or fraud alert where appropriate, the date of the request, and any confirmation or removal instructions.
- Financial monitoring: note which bank, card, payment, investment, or benefits accounts need transaction review. Record suspicious activity separately from ordinary account activity.
- Documents and replacements: if an identity document or other sensitive record was exposed, record whether the issuing organization was contacted and whether replacement or additional safeguards are available.
- Reports and disputes: keep dates and reference numbers for reports to financial institutions, relevant authorities, credit reporting organizations, or identity-theft support services.
Use a simple status system: Not started, In progress, Complete, and Monitor. Add a “next review” date to every item that is not permanently resolved. For a broader walkthrough, see What to Do After a Data Breach: A Personal Recovery and Credit-Freeze Guide.
Cadence and checkpoints
First 24 to 72 hours
Prioritize accounts that can be used to take over other accounts or move money. Change reused passwords, beginning with your primary email account, financial accounts, password manager, and mobile or telecommunications account. Use a unique password for each account and avoid changing passwords through links in an unverified message.
Enable multifactor authentication, preferably with a method resistant to password-only takeover when the service supports it. Review recent sign-ins, revoke unfamiliar sessions, and check account recovery settings. If payment data may be exposed, contact the relevant bank or card provider through a known channel and ask what monitoring or replacement steps are appropriate.
By day 30
Confirm that high-risk accounts remain secure. Review bank and card transactions, email forwarding rules, account recovery information, mobile-account settings, and notifications for password resets or new-device sign-ins. If personal identification information was exposed, assess whether a credit freeze, fraud alert, or other identity protection is appropriate in your jurisdiction. A freeze is different from a fraud alert, so read the provider’s instructions and record exactly what you requested.
Check the breach notice again for updated information. Organizations may provide additional details, revised guidance, or enrollment instructions after the initial notification. Do not assume that an offer of monitoring eliminates the need for your own account and transaction checks.
By day 90
Run a second review of affected accounts and look for delayed signs of misuse: password-reset messages you did not request, unfamiliar account recovery changes, new credit activity, unexpected bills, or messages that use breach details to create urgency. Reconfirm that backup codes and recovery methods are under your control. Remove old sessions and unused third-party applications where practical.
By day 365
Complete an annual review even if nothing suspicious has appeared. Check whether any temporary fraud alert or monitoring enrollment has an expiration or renewal condition. Review credit reports and financial accounts through trusted channels, update your tracker with the final status, and preserve the breach notice and relevant records according to your personal recordkeeping needs.
How to interpret changes
Not every unexpected message proves identity theft, but several changes deserve prompt attention. Treat an unrequested password reset, new multifactor authentication device, unfamiliar login, changed recovery address, or bank notification as a possible account-compromise signal. Do not respond to the message itself. Open the account through a known bookmark or type the organization’s address manually, then contact support using verified information.
Separate exposure from misuse in your tracker. An exposed email address may increase phishing risk without showing that an account was accessed. An exposed password is more urgent if it was reused. Payment information calls for transaction monitoring and contact with the payment provider. Government identification or medical information may require specialized guidance from the issuing organization or relevant provider.
Be cautious of follow-up scams. Attackers may impersonate the breached company, a bank, a delivery service, or a support representative and ask for verification codes, remote access, payment, or a password. A legitimate recovery process should not require you to disclose a one-time authentication code to an unsolicited caller or text sender. For related examples, see Package Delivery Scam Alerts.
When to revisit
Revisit the tracker monthly during the first three months, then at least quarterly until the risk is reasonably closed. Update it sooner when the breached organization issues a new notice, identifies another exposed data type, changes its support instructions, or reports a second incident. Also reopen the tracker after a suspicious login, failed password-reset attempt, unfamiliar credit inquiry, unexplained bill, or contact from someone claiming to help with the breach.
At each review, ask five practical questions:
- Has the organization published new information about the incident?
- Are all affected and password-reused accounts protected with unique credentials?
- Are multifactor authentication, recovery settings, and active sessions still under control?
- Have financial, credit, and identity records been checked through trusted channels?
- Does every unfinished task have an owner, status, and next review date?
Keep the tracker current, but do not let recordkeeping delay urgent action. If money has been taken, an account is compromised, or identity theft is suspected, contact the affected provider promptly and preserve messages, transaction details, and case numbers. For a plain-language explanation of a breach notice, use Breach Letter Explained. A consistent 30-, 90-, and 365-day review routine gives a breach response structure—and makes it easier to notice when the situation changes.
