What should I do first after a data breach?

Start with the free steps. Consider placing a credit freeze at all three bureaus, which blocks most new-account fraud and is free, or a fraud alert if you want lenders to verify your identity. Change passwords on affected accounts and enable two-factor authentication. Watch your statements and credit reports closely. For a plan tailored to what was exposed, the FTC's IdentityTheft.gov walks you through recovery steps at no cost.