For affected individuals
Draft: pending legal review.
Official and nonprofit resources for people whose information was exposed, and a place a business can point the people it notifies. We do not recommend paid credit monitoring.
Steps for an affected person
General information with the official source for each step. Not legal or financial advice.
Report the identity theft and get a recovery plan at IdentityTheft.gov, which the site describes as step-by-step advice to limit damage, report identity theft and fix credit.
Official sourceConsider a fraud alert (one bureau notifies the others) or a credit freeze (each bureau separately); the FTC says both are free.
Official sourceReview credit reports; the FTC names AnnualCreditReport.com as the only authorized site for free reports.
Official sourceIf a Social Security number was exposed, the IRS says tax accounts may be at risk; keep filing returns and see Form 14039 guidance if there is IRS identity theft correspondence or a duplicate-SSN rejection.
Official sourceThe IRS offers an Identity Protection PIN to keep others from filing with your SSN or ITIN; it says the IRS never asks for it.
Official sourceFor a child, the FTC describes free credit freezes for under 16s and asking the bureaus to search for a credit report in the child's name.
Official sourceEquifax and Experian publish their own freeze pages; Equifax states freezes are free.
Official sourceThe CFPB accepts complaints about credit reports and other financial products.
Official source
Official resources
If you are a business notifying people, point them here.
18 of 18
IdentityTheft.gov
Federal Trade CommissionThe FTC site where a person can report identity theft and get a recovery plan (page's own description: step-by-step advice to limit damage, report identity theft and fix credit).
Some details couldn't be verified. Confirm on the official page.
FTC: Credit freezes and fraud alerts
Federal Trade CommissionExplains that a freeze blocks new accounts until lifted, and that initial (1 year), extended (7 years, needs an identity theft or police report) and active duty (1 year) fraud alerts ask businesses to verify identity.
free (page states freezes and all three fraud alert types are free)
Some details couldn't be verified. Confirm on the official page.
FTC Data Breach Response: A Guide for Business (notify individuals and model letter)
Federal Trade CommissionBusiness guide whose notification section and model letter (written for stolen Social Security numbers) cover what happened, what was involved, what the business is doing, and what recipients can do, and suggests offering at least a year of free credit monitoring and pointing people to IdentityTheft.gov.
Some details couldn't be verified. Confirm on the official page.
FTC: How to protect your child from identity theft
Federal Trade CommissionDescribes free credit freezes for children under 16 (16 and 17 year olds can request their own), and asking all three bureaus for a manual search to see whether a child has a credit report.
credit freeze for a child under 16 is free; cost of manual search not stated
Some details couldn't be verified. Confirm on the official page.
Equifax security freeze
EquifaxEquifax's page for placing, temporarily lifting or removing a security freeze on an Equifax report; a freeze at Equifax does not cover Experian or TransUnion.
Phone: (888) 298-0045
free (page states placing, lifting and removing a freeze is free)
Some details couldn't be verified. Confirm on the official page.
Experian security freeze and fraud alert
ExperianExperian's page on its security freeze (blocks most inquiries until removed, no effect on score) and fraud alert; online freeze via a free Experian account.
Phone: 1-888-397-3742
security freeze and fraud alert listed as free
Some details couldn't be verified. Confirm on the official page.
TransUnion credit freeze and fraud alert
TransUnionTransUnion's own credit freeze and fraud alert pages.
Some details couldn't be verified. Confirm on the official page.
AnnualCreditReport.com
Equifax, Experian, TransUnion (per FTC: the authorized site)Per the FTC, the only authorized site for ordering free credit reports; FTC says each bureau's report can be checked weekly for free and a free copy is also available every 12 months by request.
Phone: 1-877-322-8228 (printed on FTC page, not on the site itself)
free per FTC page
Some details couldn't be verified. Confirm on the official page.
IRS: Identity theft guide for individuals
Internal Revenue ServiceLists steps for tax-related identity theft: stop engaging the thief, follow IRS letters, report it, follow IdentityTheft.gov steps, get an IP PIN, keep records, keep filing, and when to use Form 14039.
Phone: 800-908-4490 (identity and return verification line; 800-829-1040 for tax account questions)
Some details couldn't be verified. Confirm on the official page.
IRS Identity Protection PIN (IP PIN)
Internal Revenue ServiceA six-digit number that keeps someone else from filing a return with your SSN or ITIN; available through the IRS online account or app, Form 15227, or in person.
Some details couldn't be verified. Confirm on the official page.
IRS: Data breach information for taxpayers
Internal Revenue ServiceTax-season guidance after a breach: tax accounts are mainly at risk when SSN and financial data are exposed; file Form 14039 if you get IRS identity theft correspondence or a duplicate-SSN rejection; keep filing even on paper.
Some details couldn't be verified. Confirm on the official page.
Social Security: my Social Security and blocking electronic access
Social Security AdministrationSSA guidance on protecting your Social Security record, including requesting a block on electronic access.
Some details couldn't be verified. Confirm on the official page.
CFPB: Submit a complaint
Consumer Financial Protection BureauComplaint intake for problems with products such as credit reports, credit cards, bank accounts, debt collection and loans.
Phone: (855) 411-2372 (TTY (855) 729-2372), 9am-6pm ET Mon-Fri except federal holidays
Some details couldn't be verified. Confirm on the official page.
Identity Theft Resource Center
Identity Theft Resource Center (nonprofit)Nonprofit victim assistance for identity theft.
Some details couldn't be verified. Confirm on the official page.
No More Ransom
No More Ransom Project (Dutch police, Europol EC3, Kaspersky, McAfee per its About page)Site describing itself as a repository of keys and applications that can decrypt data locked by some ransomware, run as law enforcement and IT security partners; it advises not paying and says not every ransomware has a solution.
Some details couldn't be verified. Confirm on the official page.
FBI Internet Crime Complaint Center (IC3)
Federal Bureau of InvestigationFBI-run intake for cyber-enabled crime and fraud; victims are encouraged to file even if unsure, IC3 cannot respond to every report, and child exploitation goes to NCMEC.
Some details couldn't be verified. Confirm on the official page.
HHS OCR health information privacy complaint
HHS Office for Civil RightsComplaint route for alleged HIPAA Privacy, Security or Breach Notification Rule violations by covered entities or business associates.
Some details couldn't be verified. Confirm on the official page.
NAAG: Find my AG
National Association of Attorneys GeneralDirectory of each state, DC and territory attorney general, who is the chief legal officer; click to open profiles.
Some details couldn't be verified. Confirm on the official page.
We have no affiliation or commercial relationship with any organization listed here. A listing is not an endorsement or a ranking. Contact details come from each organization's own website (checked 2026-11-03) and may change. We list a phone number or email only when we read it on an official page. Spot an error? Tell us. General information only, not legal advice: see the disclaimer.
More resources: all directories · Who to report to · Platform contacts · Choosing an incident-response firm