Your Social Security number was leaked

A breach notice that names your Social Security number is different from a password leak. Changing logins helps for accounts. It does nothing for a number that never expires and that lenders, tax systems, and employers still treat as proof of who you are.

You do not need to buy anything in the next hour. You need three free moves in order: freeze credit, protect tax filing, and watch for new accounts. The steps below assume you are in the United States.

Step 1: Freeze your credit at all three bureaus

A credit freeze stops most new credit cards, loans, and store accounts from opening in your name until you lift it. It is free. It does not hurt your credit score. You can thaw it temporarily when you apply for credit yourself.

Do this at each bureau (about five to ten minutes each):

• Equifax: equifax.com credit freeze
• Experian: experian.com/freeze/center.html
• TransUnion: transunion.com/credit-freeze

Step 2: Get an IRS Identity Protection PIN

If someone files a tax return using your Social Security number before you do, the IRS may reject your real return and you spend months unscrambling it. An Identity Protection PIN (IP PIN) is a six-digit code you enter when you file. Without it, a thief cannot e-file in your name.

Start at the IRS IP PIN page: irs.gov Identity Protection PIN. You will need to verify your identity. If online verification fails, follow the IRS mail option rather than giving up.

Step 3: Lock down Social Security and your email

Create or sign in to your my Social Security account so someone else cannot claim it first. Use a unique password and turn on any extra verification the site offers.

Then secure the email address tied to banking, brokerage, and tax accounts. That inbox is the recovery path for almost everything else. Use a unique password and an authenticator app for two-factor, not SMS alone if you have the choice.

Step 4: Watch for fraud for 90 days (and after)

Pull your free weekly credit reports at AnnualCreditReport.com and scan for accounts you did not open. Watch mail for unfamiliar cards or collection notices. If something looks wrong, dispute it with the bureau and the lender, and consider an FTC IdentityTheft.gov report.

A freeze blocks most new credit. It does not stop every misuse of your number (medical billing fraud, wage reporting issues, and some government impersonation still happen). Keep watching even after the first month.

What you can skip for now

You do not need to replace your Social Security card unless it was physically stolen. You do not need paid "credit lock" products that duplicate a free freeze. And you do not need to freeze and unfreeze daily; leave the freeze on until you have a real reason to lift it.

If your breach notice also mentioned bank or investment logins, continue with the investment account exposure guide. If you want a wider inventory of what else may still be exposed, use the personal security audit checklist. More starting points live on the Protect hub.