What is the first thing to do after a breach notification?

Identify exposed accounts and reset reused credentials immediately from a trusted device, then enforce MFA and monitor related services.

When should I use an identity theft planner after a breach?

Use it whenever exposed data includes personal identity attributes, government identifiers or financial account details that could be reused for fraud.

Pillar guide

Data breach response playbook 2026

This playbook helps users and security teams move from breach notification to practical containment and identity-risk reduction.

First 24 hours

Identify which accounts and data elements were exposed.
Reset reused passwords and enforce MFA on the most sensitive accounts.
Capture evidence: breach notice, incident date, affected service and support case IDs.
Monitor bank, payment and mailbox activity for suspicious actions.

24 to 72 hours

Check linked services that may share the same identity or mailbox recovery chain.
Review fraud indicators such as unknown account openings and password-reset attempts.
Update high-value account recovery methods and remove outdated trusted devices.

Next 7 days

Continue monitoring account activity and credit indicators where applicable.
Rotate additional credentials and third-party app tokens tied to exposed services.
Document lessons learned and hardening changes for future incidents.

Recommended breach and identity workflows

Breach checker to prioritize actions by account type and exposure context.
Identity theft planner for structured fraud mitigation steps.
Data breach alerts archive for active incidents and ongoing updates.