Your personal response plan after a data breach

Open the organisation’s app, use a saved bookmark or type its known address. Read the full notice rather than relying on a headline or forwarded screenshot. Record the incident date, notification date, affected service, stated data categories and any unanswered questions. If the notice says only “personal information”, ask the organisation to clarify which fields relate to your account.

Create a small incident worksheet with four columns: finding, action, confirmation and next review. For example, “payment card exposed” should lead to a bank contact and a recorded outcome, not simply a tick beside “read notice”. Keep uncertainty visible: write “password exposure not confirmed” instead of assuming either safety or compromise.

Use the table to choose parallel tasks if several categories were exposed. If you are helping a relative, agree who will contact each provider and who will maintain the log. This is an editorial way to organise the work; it is not a requirement to finish every task before asking a bank for urgent help.

Work from an account list instead of changing unrelated passwords at random. Mark which services used the exposed password, including close variations, and which depend on the affected email address. Use a password manager to create and store different passwords. CERT Polska recommends unique passwords and changing a password when compromise is suspected, rather than routine changes without a reason.

For email, inspect forwarding rules and filters, then check the account’s recovery email address, telephone number and security settings. Sign out other devices and apps using the service’s security controls. The exact menus differ between providers, so use their help pages and record whether the action succeeded. A new password alone is not a complete recovery record.

If messages were sent from your account without permission, warn contacts through a channel you still control. State which messages to disregard and how to verify future requests. If provider recovery fails, make a migration list for essential services tied to the old address; avoid abandoning it without considering those dependencies.

Tell the bank what was exposed and distinguish an unfamiliar transaction from a suspicious message that has not led to a payment. Ask which cards or access methods need blocking, how to submit a dispute and how to provide evidence securely. Record the bank’s instructions and any follow-up date. Do not assume a temporary card lock resolves every consequence of exposure.

In Poland, the official Gov.pl service explains how adults with a PESEL number can reserve it online or through an office. The service is free and immediate. You can also arrange automatic reservation after a temporary reversal. Check the official instructions before an intended transaction that may require lifting the reservation.

For US credit protection, the FTC explains that a freeze must be placed with Equifax, Experian and TransUnion separately. A fraud alert is a different measure and can be initiated through one bureau. Keep the confirmations in your worksheet. If you live elsewhere, identify the local equivalent rather than assuming either the Polish or US process applies.

Start with email, then accounts that matter most to your finances, work or personal communications. Make a simple record of the available authentication method, where recovery instructions are kept and which device or authenticator is required. Do not put recovery codes in the same shared incident worksheet used to track support calls.

A hardware security key is an optional tool, not a prerequisite for beginning recovery. Check that the service supports the intended sign-in method and that the key works with your devices. The generic product reference here is not a claim about a particular model’s compatibility, certification or performance. A supported passkey may already meet your needs without another purchase.

Test the new method while you still have a working recovery route. Our suggested acceptance check is practical: can you sign in, explain the fallback process and locate the provider’s recovery instructions? If the answer is unclear, resolve that uncertainty before removing a working method. Stronger authentication reduces particular attack opportunities; it cannot retrieve records already copied from an organisation.

Separate original evidence from your working notes. Preserve the message or notice as received, then add a dated explanation of what you observed and which action you took. Share documents only through a verified reporting channel and provide the information requested, rather than circulating a full identity-document copy with every enquiry.

Use a manageable editorial schedule: review unresolved tasks the next day, reassess the worksheet after a week, and add recurring financial and account checks over the following months. These are planning prompts, not official deadlines or a point at which exposure becomes harmless. Bring the next review forward whenever a new notice, unfamiliar login or disputed transaction appears.

Prepare a short response script for unexpected contact: “I will contact the organisation through its published channel.” Personal details can make a fraudulent request sound convincing. At each review, also ask whether unused accounts or unnecessary stored information can be reduced. Close a task when the specific action is confirmed; keep unresolved disputes and provider investigations open.