Data breach notifications tell us that our personal data has been compromised. In 2024 alone, major data breaches occurred in National Public Data, Change Health and Ticketmasterwhich puts millions of consumers at risk of financial fraud and identity theft.

“On average, we see eight to nine data breach incidents per day,” it said Weiqing Sundirector of the master’s programs in cybersecurity at the University of Toledo. “More frequent and more significant data breaches are occurring and will continue to affect each and every one of us.”

If you receive a data breach letter in the mail, do not ignore it. This will notify you that an unauthorized party has gained access to internal company data and may have your personally identifiable information such as your name, phone number, Social Security Number and so on.

Here’s everything you need to know about data breach notifications.

What’s in a data breach notification?

Data breach notifications typically include the following information:

• Details of how and when the breach occurred
• A list of your personal data that may have been leaked by hackers
• An explanation of what the company is doing to protect your data afterwards
• Tips to help you keep your identity safe

Companies often pay for free identity theft or credit monitoring service for affected customers. Activation codes are provided in the mail, but you must create your own account to take advantage of the offer. Depending on the severity of the violation, free coverage lasts up to two years in most cases.

Identity theft protection services help monitor your sensitive data on the dark web. Sometimes, these services can alert you that your data has been compromised before you receive a notification. Most importantly, they come with identity restoration services if your identity is stolen.

“Try to take advantage of the services to get protection,” said Sun.

When and how should a company send a data breach notification?

All states, the District of Columbia, Puerto Rico, and the US Virgin Islands have passed laws requires companies to notify customers of data breaches. The length of time varies by state, but notifications are usually sent within 60 days after the data leak is discovered.

Data breach notifications arrive in the mail. If you receive a notification by email, text or phone callit’s probably a scam. If you have any doubts about the legitimacy of a notification claiming that your sensitive data has been compromised, contact the company directly or search online for coverage of the breach, Sun said.

In addition to affected customers, companies that suffer a cyberattack can alert state attorney general offices, law enforcement, the three major credit bureaus, and the Securities and Exchange Commissiondepending on the severity of the violation or state regulations.

What should I do if I receive a letter in the mail?

If you receive notification of a data breach in the mail, follow the advice to the letter and take it seriously. You should be on the lookout for phishing attacks and regularly check your Experian, TransUnion and Equifax credit reports for unauthorized accounts opened in your name.

If the company offers free identity theft protection, sign up for it. After the membership expires, you must decide whether to pay to continue the service or subscribe to another provider.

If your data is involved in another data breach in the future, you can sign up for additional free services offered to you later.

What are some steps I can take to protect my data?

Even if you don’t use an ID theft protection service, here are four things you can do for free to protect yourself:

1. Change your password on the breached account, along with any other accounts with the same login credentials.

2. Review your credit card and debit card statements at least once a month and look for any abnormalities

3. Freeze your credit so no one can apply for a line of credit in your name (you have to unfreeze it yourself if you want to open a new account)

4. Be careful with phishing attacks by cybercriminals using your leaked information to trick you into sharing financial account information or other sensitive data