Received a Data Breach Letter? How to Verify It

A letter or email saying your personal information was involved in a data breach is unsettling, and it raises an immediate question: is this real? Most breach notices are genuine. State laws require organizations to send them. But scammers know these notices make people anxious and ready to act, so they copy them, especially after large, well-publicized breaches.

The short answer: verify a data breach letter using sources you find yourself, not the phone numbers, links, or QR codes printed in the notice. Confirm that the organization announced the breach, look for the notice on an official breach list, compare the letter with what a legitimate notice contains, and never pay or hand over full account details to “confirm” you were affected.

This guide walks through each check, explains what to do once you know the letter is real, and covers what to do if you already responded to a fake. For a closer look at the contents of a genuine notice, see our explainer on what a breach notice actually tells you.

Why scammers copy data breach letters

A real breach gives criminals a ready-made story. People expect to hear from the company, so a convincing fake gets attention. After the 2017 Equifax breach, the Cybersecurity and Infrastructure Security Agency relayed the Federal Trade Commission’s warning that consumers should “be wary of calls or emails purporting to be from Equifax agents” (CISA).

Fake data breach letters usually want one of three things: for you to call a number the scammer controls, to click a link to a look-alike website, or to “verify” sensitive details such as your Social Security number or bank account. Some ask for a fee to activate credit protection or release a settlement payment.

There is a second risk even when the letter is genuine. Once a breach is public, the exposed information can be used to make follow-up phishing messages more convincing. A real notice is a reason to be more careful for the following months, not less.

Step 1: Pause and set aside the contact details in the letter

Before you call, click, or scan anything, treat the contact information in the notice as unverified. The FTC’s advice for any unexpected message is to “contact the company using a phone number or website you know is real” rather than the details in the message itself (FTC phishing guidance).

Keep the original: the letter, the envelope, and any email in its unedited form. If you later need to report a scam or dispute fraud, the original notice and its postmark or email header details help show what you received and when. Our Digital Evidence Checklist explains what to save.

Step 2: Identify who actually sent the notice

A legitimate data breach letter can come from an organization you don’t recognize. Your information may have been held by a vendor working for a company you do business with, such as a payroll processor, benefits administrator, billing company, or medical lab. The breached vendor or the company you know may send the notice, and many organizations use a mailing or call-center service to handle notices on their behalf.

California’s breach list makes the same point: the organization that sent a notice may not be the organization that was breached. Its example is a bank notifying customers about a breach at a merchant where they used their cards (California Attorney General).

What to do: search for the organization’s name together with “data breach” or “security incident.” Then go to its official website by typing the address yourself, and look for a posted notice, often titled “Notice of Data Security Incident” or similar. If the letter names a company you’ve never heard of, ask your employer, health care provider, or bank whether they use that vendor.

Step 3: Look for the notice on an official breach list

Several government agencies publish breach notices or breach reports. Finding the organization on one of these lists is strong confirmation that the incident is real.

Where to check	What it covers	What you can confirm
California Attorney General breach list	Sample notices from organizations that notified more than 500 California residents	Organization name, breach dates, reported date, and a copy of the sample letter
Washington Attorney General notifications	Breaches requiring notice to more than 500 Washington residents	Date reported, breach date, number of Washingtonians affected, and types of information exposed
HHS Office for Civil Rights breach portal	Health information breaches affecting 500 or more people, reported under HIPAA	Whether a health provider, insurer, or business associate reported a breach
SEC EDGAR filings	Public companies’ disclosures of material cybersecurity incidents (Form 8-K, Item 1.05)	Whether a publicly traded company disclosed the incident to investors
Your state attorney general’s website	Many states publish breach notices or annual breach reports	Search “[your state] attorney general data breach notices”

Timing matters. California requires a sample copy of the notice to reach the attorney general within 15 calendar days after consumers are notified (Cal. Civ. Code § 1798.82). Washington requires notice to the attorney general within 30 days after the breach was discovered when more than 500 residents are affected (RCW 19.255.010). Public companies generally must file an Item 1.05 Form 8-K within four business days after determining an incident is material (SEC).

If you can’t find it, that doesn’t prove the letter is fake. Smaller breaches may fall below a state’s reporting threshold, some states don’t publish notices online, and lists can lag behind the letters themselves. Treat a missing listing as a reason to move on to Step 5, not as a verdict. Our Breach Notice Tracker lists incidents we have verified against primary sources.

Step 4: Compare the letter with what a real notice includes

State laws set out what a breach notice must say, and California’s rules are the most specific. Notices to California residents must be titled “Notice of Data Breach,” use the headings “What Happened?” “What Information Was Involved?” “What We Are Doing,” “What You Can Do,” and “For More Information,” and be printed in type no smaller than 10 point (Cal. Civ. Code § 1798.82).

The same law requires, at a minimum:

• the name and contact information of the organization sending the notice;
• the types of personal information involved;
• the date or estimated date range of the breach, if known, and the date of the notice;
• the toll-free numbers and addresses of the major credit reporting agencies, if a Social Security number or driver’s license or state ID number was exposed.

Other states set different requirements, but many organizations follow a similar structure nationwide. A letter that is missing most of this information isn’t automatically fraudulent, but it is a reason to verify more carefully before you act on it.

A note on credit monitoring offers: enrolling in free credit monitoring usually requires identity details, so asking for information isn’t a red flag on its own. The safe approach is to confirm the enrollment website and activation code with the organization first, then type the enrollment address yourself rather than following a link.

Step 5: Contact the organization through a channel you find yourself

Find a phone number or web address on the organization’s official website, a recent statement, or the back of a card you already have. When you reach them, ask:

1. Did you send breach notices about this incident?
2. Was my information included, and which types?
3. What is the official website or phone number for any credit monitoring or identity protection you’re offering?
4. Is there a reference name or number for the incident I should keep?

If the organization confirms the notice, you can rely on the letter’s instructions. If it has no record of the incident, treat the letter as a likely scam.

If the letter is real: what to do next

The right steps depend on what was exposed. The FTC’s guidance, Data Breaches: What to Know, What to Do, breaks them down this way:

Your Social Security number

• If the organization offers free credit monitoring, the FTC suggests taking advantage of it.
• Check your credit reports. You can get free reports from each of the three nationwide credit bureaus every week at AnnualCreditReport.com, the only site authorized for free reports (FTC).
• Consider a credit freeze, which is free and makes it harder for someone to open new accounts in your name. You contact each bureau separately. A fraud alert is the alternative: it lasts one year, and contacting one bureau covers all three (FTC). Our guide on choosing a credit freeze or fraud alert compares the two.
• File your taxes early to reduce the risk that someone files a return using your number.

An online login or password

• Change the password, and the username if you can. Change it on any other account where you used the same password.

Bank account, credit card, or debit card information

• Contact your bank or card issuer to close the account or replace the card, and review recent transactions for charges you don’t recognize.

A breach notice tells you your information was exposed, not that it has been misused. If you see accounts, charges, or tax filings you don’t recognize, follow our first steps after identity theft and report it at IdentityTheft.gov.

If the letter is fake, or you already responded

If you only received it: don’t respond. Report it to the FTC at ReportFraud.ftc.gov. For a phishing email, use your email provider’s option to report phishing.

If you clicked a link, called, or shared information: act on what you gave away.

• A password: change it immediately, along with any other account that uses it.
• Your Social Security number: go to IdentityTheft.gov for a recovery plan and consider a credit freeze.
• Bank or card details, or a payment: contact your bank or card issuer right away and ask about stopping or disputing the transaction.

Common situations and how to handle them

“The letter is from a company I’ve never heard of.”

This is common when a vendor held your information for an employer, insurer, health provider, or retailer. Use Step 2 to identify the connection, and confirm through the organization you do know.

“I got an email, not a letter.”

Some organizations notify people by email. The same checks apply. Don’t click links in the message: go to the organization’s website by typing the address, and look for the notice there.

“Someone called me about a breach.”

Hang up and call back using a number from the organization’s official website or your account statement. Never give a caller your full Social Security number, passwords, or one-time codes.

“The notice arrived months after the breach.”

That can happen with genuine notices. Investigations take time, legal deadlines usually run from when a breach is discovered rather than when it happened, and law enforcement can ask organizations to delay notice. The delay alone doesn’t mean the letter is fake.

“The letter mentions a settlement or payment.”

A breach notice and a settlement notice are different documents. A breach is not automatically a lawsuit, and a lawsuit is not automatically a settlement. Verify any settlement claim through the official settlement website named in court-approved notices, and never pay a fee to receive a payment. Our lawsuits and settlements coverage tracks verified cases only.

Frequently asked questions

Are data breach letters real or scams?

Most data breach letters are real, because state laws require organizations to notify people whose personal information was exposed. Scammers copy them, though, so verify any notice through contact details you find yourself before acting on it.

Why did I get a data breach letter from a company I don’t know?

Your information may have been held by a vendor working for a company you deal with, such as a payroll, billing, or benefits provider. Ask the company you know whether it uses that vendor.

Should I call the number on a data breach letter?

Not until you have confirmed it. Find the organization’s phone number on its official website or a statement you already have, and use that number instead.

Is it safe to sign up for the free credit monitoring in a breach notice?

It can be, once you have confirmed the offer with the organization. Type the enrollment website yourself, and never pay to enroll in a service described as free.

Does a data breach letter mean my identity was stolen?

No. It means your information was exposed, not that someone has used it. Check your credit reports and accounts, and consider a credit freeze if your Social Security number was involved.

Does getting a breach letter mean I can join a lawsuit or settlement?

Not automatically. A lawsuit may or may not be filed, and a settlement exists only if a court approves one. Rely only on official, court-approved settlement notices.

Sources

• Federal Trade Commission, Data Breaches: What to Know, What to Do
• Federal Trade Commission, How to Recognize and Avoid Phishing Scams
• Federal Trade Commission, What To Know About Credit Freezes and Fraud Alerts
• Federal Trade Commission, Free Credit Reports
• CISA, Potential Phishing Scams Related to Equifax Data Breach (2017)
• California Attorney General, Search Data Security Breaches
• California Civil Code § 1798.82
• Washington Attorney General, Data Breach Notifications
• Revised Code of Washington 19.255.010
• U.S. Department of Health and Human Services, OCR Breach Portal
• U.S. Securities and Exchange Commission, Press Release 2023-139 (cybersecurity disclosure rules)
• IdentityTheft.gov
• ReportFraud.ftc.gov

This guide is general information, not legal advice. Laws differ by state and change over time. Read how we research and update our guides in our Editorial Standards, and see our Corrections Policy to report an error. More coverage: Data Breaches.