# Data Breach: What to Do and How It Affects Reputation

Data breach what to do: secure accounts, freeze credit, report, and know what search engines and sites will and will not remove about your exposed data.

---


If your personal data appears in a breach, the first job is not reputation. It is to make the exposed details useless: change the passwords that were in it, switch on a second step for sign-in, put a freeze or alert on your credit file, and treat every message that quotes your details as a possible trap. Reputation work comes second, and it is narrower than most people expect.

A breach touches your name in a particular way. The data itself is rarely a story about you. The damage comes from what other people do with it: a stranger who writes to your contacts as you, a scammer who uses your real details to sound convincing, a forum thread that reposts a list with your name on it, or an account opened in your name that later shows up as a debt. Each of those is a separate problem with a separate route, and none of them is solved by one request.

This guide is for the individual whose details were exposed, not for the company that lost them. It is protective only: it explains what to secure, which official routes exist, and what search engines and websites will and will not remove. It says nothing about how leaked data is found or traded, and it never will. Everything quoted from an agency or a search engine was read on the page named, as it stood for this guide, and those pages change. This is information, not legal advice.

<div class="box"><b>The short version</b>
<ul><li>Secure first: change the credentials that were exposed, add a second sign-in step, and ignore links in any message that mentions the breach until you have checked it through a contact route you already trust.</li><li>In the United States, a credit freeze is free and lasts until you lift it; an initial fraud alert lasts one year. Reporting actual identity theft to the FTC opens a recovery plan and unlocks a longer alert.</li><li>Search engines can remove some results that show sensitive personal details, but only from search. The page stays online until its host acts, and the same data may sit on other sites.</li><li>Your reputation risk is impersonation and phishing in your name, not the breach itself. Warn the people who might receive a message from "you".</li></ul></div>

<figure class="keyfacts">
<div class="keyfacts-grid">
<div><b>1 year</b><span>how long a US initial fraud alert lasts, after which it can be renewed</span></div>
<div><b>7 years</b><span>how long a US extended fraud alert lasts once identity theft has been reported</span></div>
<div><b>10 months</b><span>the point after submission when the UK regulator says complaints needing a detailed look are assigned to a case officer</span></div>
</div>
<p class="fig-src">Sources: the US Federal Trade Commission (FTC) page on credit freezes and fraud alerts, and the UK Information Commissioner's Office (ICO) page on data protection complaints, both read for this guide.</p>
</figure>

## A breach harms your name through what others do with the data

The data in a breach is usually ordinary: an email address, a phone number, a postal address, a date of birth, a password or a customer record. On its own it does not describe you. It becomes a reputation problem when someone puts it to use, and there are only a few ways that happens.

The first is impersonation: someone uses your name and a few true details to approach your contacts or clients. The second is phishing built on your real details: a message that quotes something true about you is far more convincing than a generic one. The FTC's page on phishing describes the pattern plainly: scam emails and texts are used to steal passwords, account numbers or Social Security numbers, and often look as if they come from a bank, card issuer or utility. The third is financial misuse, such as credit applied for in your name. The fourth is republication: a post, a forum thread or a paste that lists your details next to your name and sits where a search engine can index it.

Notice what is missing from that list. A breach, by itself, does not make you look bad. A reader who finds your email address in a list of thousands of other people learns nothing about your conduct. Where a breach does touch reputation, it is through the second-order effects: a client who received a fraudulent invoice "from you", a recruiter who finds your home address on a page that should not carry it, or a debt on your credit file that you never took.

## The first hour: secure what the data could open

Start with the accounts the exposed details could unlock, not with the search results that show them. A password that was in a breach is a password someone else may hold, and the same password reused elsewhere opens those accounts too. The order below puts the highest-risk items first.

<figure class="fig">
<figcaption><b>The first hour after you learn your data was exposed</b></figcaption>
<ol class="fig-steps">
<li><b>Confirm the source of the notice</b>Breach notices are themselves a favorite disguise for phishing. Do not follow a link in the message. Go to the organization's own website, typed by hand or from a bookmark, or use a phone number you already have, and look for the notice there.</li>
<li><b>Change the exposed credentials</b>Change the password for the affected account first, then every account that shares it. Use a different password for each, ideally from a password manager, so one future breach cannot open the rest.</li>
<li><b>Add a second sign-in step</b>Turn on multi-factor authentication for email, banking, your phone account and anything that can reset other accounts. Email comes first, because it resets almost everything else.</li>
<li><b>Take what the organization offers</b>The FTC's data breach advice says to take free credit monitoring or identity theft insurance if the company offers it. It costs nothing and adds a second pair of eyes on your file.</li>
<li><b>Place a credit freeze or fraud alert</b>Choose between them using the table in the next section. This is the single step that stops new credit being opened in your name.</li>
<li><b>Write down what you did and when</b>Keep the notice, the date, and a line for each step. If you later need to dispute an account or report a crime, a dated record saves days.</li>
</ol>
</figure>

If the breach exposed a phone number, call your mobile provider and ask what extra protection they can add against a number being moved to another SIM. If it exposed a government ID number, the next two sections matter more than anything about search results. The sources read for this guide do not cover SIM protection, so ask your provider what it offers.

## Credit freeze, fraud alert or extended alert: which one fits

In the United States, you have three free tools on your credit file, and they do different jobs. The FTC's page on [credit freezes and fraud alerts](https://consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alerts) sets out the differences, and the choice turns on whether you are protecting against a risk or responding to a crime that has already happened.

<div class="tablewrap"><table><thead><tr><th>Tool</th><th>What it does</th><th>Lasts</th><th>How to place it</th></tr></thead><tbody>
<tr><td><strong>Credit freeze</strong></td><td>Blocks new credit accounts in your name, including ones you apply for yourself</td><td>Until you lift it</td><td>Contact all three bureaus: Equifax, Experian and TransUnion</td></tr>
<tr><td><strong>Initial fraud alert</strong></td><td>Businesses must check with you before opening new credit</td><td>One year, renewable</td><td>Contact one bureau, which must tell the other two</td></tr>
<tr><td><strong>Extended fraud alert</strong></td><td>Same checks, plus removal from unsolicited credit and insurance offer lists for five years</td><td>Seven years</td><td>One bureau; requires an FTC identity theft report or police report</td></tr>
</tbody></table></div>

All three are free, according to the FTC page. A freeze is the stronger protection and the more inconvenient one: because it blocks you as well as a thief, you lift it before you apply for a loan, a mortgage or a phone contract, and place it again afterward. An initial alert is lighter. It suits a breach that exposed contact details but nothing that opens credit. If a breach exposed your Social Security number, the FTC's advice is to check your free credit reports and consider a freeze or an alert; a freeze is the stronger of the two.

## Reporting identity theft and what the report gives you

If you find a sign that someone has used your details, the route changes from precaution to report. The FTC lists the signs: a bill you normally receive stops arriving, which may mean a billing address was changed; charges for purchases you did not make; withdrawals you did not authorize; and accounts on your credit reports that you do not recognize.

To see the last of those, order your free credit reports. The FTC's page on free credit reports says only AnnualCreditReport.com is authorized to fill orders, and warns that imitation sites use names like "free report". The same page says the three nationwide bureaus let you check your report weekly for free there, and that federal law entitles you to a free copy from each bureau every 12 months. It also lists an extra free report if you have a fraud alert on your file or if your report is inaccurate because of fraud. Check all three, because each bureau may hold different data.

If something is wrong, report it to the FTC at IdentityTheft.gov. The FTC's page [What to know about identity theft](https://consumer.ftc.gov/articles/what-know-about-identity-theft) says you receive a free personal recovery plan, you can track your progress, and you can print pre-filled letters and forms for credit bureaus, businesses and debt collectors. It adds that the site covers more than 30 types of identity theft, plus guidance if your information was exposed in a data breach.

The report matters beyond the plan. The FTC states that an extended fraud alert requires either an FTC identity theft report filed at IdentityTheft.gov or a police report, and that renewing it means resubmitting that report. So reporting is how a one-year alert becomes a seven-year one. Keep the report with the record you started in the first hour.

For a breach with no sign of misuse yet, you do not need to file a report. The FTC's data breach advice for a Social Security number is more modest: check your free credit reports for accounts you do not recognize, and consider a freeze or alert. Reserve the report for when there is something to report.

## Outside the United States: your regulator and your own claim

The credit tools above are American. Elsewhere the structure differs, and this guide only describes the one regulator whose page was read in full. Outside the United Kingdom and the United States, find your own country's data protection authority and consumer fraud service, because the names, deadlines and remedies differ.

In the United Kingdom, the ICO handles complaints about how an organization handled personal data. Its [complaints page](https://ico.org.uk/make-a-complaint/data-protection-complaints/) asks for a copy of your complaint to the organization and of any request you made to it, so raise the matter with the organization first. It also says that complaints needing a more detailed review are assigned to case officers around 10 months after submission, a figure that reflects the page as read for this guide and may change.

The same page is blunt about a point that surprises people: the ICO cannot award compensation, even where it gives its opinion that an organization has broken data protection law. You can seek compensation from the organization directly or through a court claim, and the ICO recommends independent legal advice before going to court. A complaint to the regulator is therefore a route to accountability and corrections, not to payment.

## Impersonation and phishing exposure: the reputation risk that follows

This is where a breach becomes a reputation matter. If someone holds your name, email address and a few facts about your life, the realistic risk is a message that looks like it comes from you or about you. Only the breach-specific part is covered here.

After a breach, assume messages that mention your details are more likely to be fraudulent, not less. The FTC says legitimate companies will not send you a link by email or text to update your payment information. When a message claims to be from a company you deal with, the FTC advice is to contact the company using a phone number or website you already know is real, not the contact details in the message. If you gave out a Social Security, card or bank number, it points you to IdentityTheft.gov for steps matched to what you lost. If you only clicked a link or opened an attachment, it says to update your security software, run a scan and remove anything it flags. To report a phishing message, the FTC lists ReportFraud.ftc.gov, forwarding to the Anti-Phishing Working Group, and forwarding texts to 7726.

Then protect the people around you. If your contact list or email address was in the breach, tell the people most likely to be targeted: relatives, close colleagues, clients and anyone who handles money on your behalf. Say what you would never ask by message, such as gift cards, a change of bank details or a code sent to their phone. A short note costs a minute, and a client who has read it will treat a fraudulent invoice as the oddity it is.

<aside class="callout">
<span class="callout-label">Warning</span>
<h4>Do not pay anyone who offers to remove your data from the internet</h4>
<p>Nobody can delete a leaked file from every site, copy and private archive. A service that promises to do so is selling a result it cannot deliver, and a message that threatens to publish your details unless you pay is extortion, to be reported and kept as evidence, not answered.</p>
</aside>

## What search engines will and will not remove

Once the security work is done, you can turn to visibility. This is the narrowest part of the response, and the part where expectations are most often wrong. Google's help page, [Remove my private info from Google Search](https://support.google.com/websearch/answer/9673730), sets the scope for its Search, and most other search engines have their own comparable pages that should be checked directly.

Google says it can remove from Search results: personal contact details, government ID numbers such as Social Security or tax IDs, bank account or card numbers, pictures of your signature or ID, private records such as medical files, and confidential login credentials. It can also act on doxxing content, meaning content that pairs your personal information with threats or harassment, or aggregates a large amount of it with no legitimate purpose. A page that simply lists an email address among thousands may fall outside that last rule, so do not assume a long list of data counts as doxxing.

The limits are as important as the list. Google's page states that it can only remove things from Google Search results, not from the site hosting them.  It generally removes content that breaks its rules, but it may keep content about newsworthy or important topics, and it weighs whether the content serves the public interest. Even after removal, the page may still be reachable through links, social media or other search engines.

The Results about you tool is the easiest starting point for the data types above. Its [help page](https://support.google.com/websearch/answer/12719076) says it checks for your name plus the personal information you enter and lets you request removal of matching results, with a status of In progress, Approved, Denied or Undone for each request. One request per URL is enough even if the page shows several types of information. The page says confirmation emails arrive within a few hours and that there can be a delay between approval and removal. Approval usually means the URL is hidden from all searches or only from searches containing your name. The page also says Google generally will not remove results from government, educational or newspaper sites because they are valuable to the public, that some features are rolling out to users over 18 in certain markets, and that results showing someone under 18 go through a detailed removal form.

<div class="tablewrap"><table><thead><tr><th>What the result shows</th><th>Search-engine request</th><th>Likely outcome</th><th>What remains</th></tr></thead><tbody>
<tr><td><strong>Password or login in a dump</strong></td><td>Confidential credentials category</td><td>Eligible for removal</td><td>Page still online; change the credential regardless</td></tr>
<tr><td><strong>Government ID, bank or card number</strong></td><td>Personal information request</td><td>Eligible for removal</td><td>Number still valid until the issuer replaces it</td></tr>
<tr><td><strong>Email or phone among a long list</strong></td><td>Contact details request</td><td>Possible, judged case by case</td><td>The list can sit on other sites and search engines</td></tr>
<tr><td><strong>News article about the breach naming you</strong></td><td>Generally not available</td><td>Public-interest content may stay</td><td>Ask the publisher about accuracy only</td></tr>
<tr><td><strong>Your own profile or post</strong></td><td>Not applicable</td><td>You can edit it yourself</td><td>Delete the source instead</td></tr>
</tbody></table></div>

The row about a password is the simplest case and also the one where removal matters least. The danger of a leaked credential is the credential, and changing it ends that danger whether or not the page stays indexed. Removal is housekeeping that follows the security step, never a substitute for it.

## What sites and hosts will and will not remove

A search removal hides a page from one search engine. The page itself is the problem, and only whoever hosts it can take it down. That is slower and less certain, and the honest answer is that the outcome depends on who the host is.

Write to the site operator first, using the contact or abuse route on the site, naming the exact URL and the exact data, and explaining the harm in two sentences. Operators that publish exposed data for profit rarely respond. Where a hosting company or a platform is involved, its own rules on private information give you a stronger ground than a general complaint. For content that is also copied to social platforms, each platform has its own report form for private information, and the reports go faster when they quote the platform's own policy.

Three situations call for a different route. If the page publishes intimate images, that is a separate removal path with its own laws and tools, and our [leak removal](/leak-removal) service covers it. If the content threatens you or publishes your home address with hostile intent, treat it as harassment and keep the evidence for the police. If the content is false and damaging, the route is correction or a legal letter, not a privacy request.

What you cannot expect is complete disappearance. A dump that has been copied several times will not vanish because one copy goes. The realistic aim is narrower: remove the copies that appear for searches on your name, make sure nothing sensitive can be used to open or reset an account, and monitor for new copies so the next one is dealt with in days, not months. Anyone promising more than that is describing an outcome the sources do not support.

For you as an individual, the practical line is that you cannot control the company's record, only your exposure within it.

## A realistic timeline and a worked scenario

These ranges are ours, written as experience, not as promises. They assume you act in the first week and that nothing has been misused. Regulators and hosts set their own pace.

<div class="tablewrap"><table><thead><tr><th>When</th><th>What to do</th><th>What usually happens</th></tr></thead><tbody>
<tr><td><strong>Day 1</strong></td><td>Verify the notice, change credentials, add a second step, place a freeze or alert</td><td>Immediate effect on new credit; account access closed to the exposed password</td></tr>
<tr><td><strong>Week 1</strong></td><td>Order free credit reports, tell your close contacts, search your name privately, file search-engine requests for eligible results</td><td>Requests often resolve within days to a few weeks; hosts rarely answer fast</td></tr>
<tr><td><strong>Month 1</strong></td><td>Chase non-responsive hosts, re-check credit reports, review any fraud alerts</td><td>New copies of the data may appear; reports show whether anything was opened</td></tr>
<tr><td><strong>Months 2 to 6</strong></td><td>Monitor your name and your credit file; renew an initial alert before the year ends if you use one</td><td>Most cases settle into quiet; a regulator complaint, if filed, is still waiting</td></tr>
</tbody></table></div>

Here is an invented scenario with generic parties. A woman receives a notice from an online retailer saying a customer database was accessed. It lists her name, email address, postal address and an old password. She is not sure the email is real, so she opens the retailer's website directly and finds the same notice. She changes that password and the three other accounts that used it, turns on a second step for her email, and places a freeze with all three bureaus. Two weeks later a friend forwards a message that seems to come from her and asks for a small urgent transfer. She had already warned her family and two colleagues, so no one pays. A private search on her name shows one paste site listing her address. A Results about you request is approved within days for searches on her name, the page stays online, and the site never answers her. Her reputation was never damaged, because the one message that could have done it did not land.

## Your next step, and when to ask for help

Once the first hour and the credit step are done, the remaining question is whether anything about your name is visible and whether it is changing. For most people that is a private search on their name and an hour with the removal tools, repeated monthly, or handed to a [monitoring service](/reputation-monitoring) that watches search and AI answers. If you are an executive or a public figure, or the exposed details include a home address, the work deserves a methodical audit.

<div class="box hot"><b>If this is happening to you now</b>
<p>If your details are showing up in search results or in messages sent in your name, we can review what is visible and what is removable in a private audit. Reputation Partners works through the order described above and tells you plainly which results are eligible for removal and which are not. <a href="/audit">Request a private audit</a>.</p></div>

## Questions people ask

### Should I contact the company that lost my data?

Yes, but through its official website or a number you already trust, not through a link in the notice. Ask what was exposed, whether it offers credit monitoring, and whether you can ask for your data to be deleted. Keep the reply. If the answer is poor, the regulator in your country is the next step; in the United Kingdom that is the ICO.

### Does a credit freeze stop all misuse of my breached data?

No. The FTC describes a freeze as blocking new credit accounts in your name. It does not stop someone using an existing card number, logging in with a leaked password, or sending messages in your name. Treat it as one layer: freeze credit, change passwords, add a second sign-in step and watch for impersonation.

### Can I get my information deleted from a breach dump website?

Sometimes, but not reliably. You can ask the site operator or its host, and you can ask a search engine to stop showing the page. Search removal does not delete the page. Rules on deletion differ by country, and a dump copied to several places will not disappear from all of them.

### What if someone threatens to publish my data unless I pay?

Do not pay and do not negotiate. Keep every message with its date, change the credentials involved, tell the people who could be contacted, and report it to the police and to your country's fraud reporting service. Payment does not end the risk, because nothing stops a second demand.