Data Breach Response

Data Breach Response Skill

The breach notification letter arrives months late, written by lawyers to minimize alarm and liability in the same paragraph — and the reader's real question is buried: what did they get, and what do I actually do? The answer depends entirely on the first part: a leaked password and a leaked government ID number are different emergencies with different ladders. This skill triages by what leaked, orders the response (some steps are today, most aren't), and decodes the letter itself — including the free-monitoring offer, which is worth taking and worth understanding.

What This Skill Produces

• The triage — what leaked, mapped to what it enables: account takeover, financial fraud, identity theft, targeted phishing
• The ladder — do-today / this-week / ongoing, ordered by damage-prevented-per-minute
• The monitoring plan — what to watch, where, at what cadence — calibrated, not paranoid
• The letter decode — what the notification actually admits, and what the monitoring offer covers

Required Inputs

Ask for these if not provided:

• What leaked — from the letter or breach-lookup: email? passwords (hashed or plain — the letter usually says)? card numbers? government ID / SSN? medical? The whole response keys off this list
• The account's blast radius — was that password reused? (The honest answer decides half the ladder) Is the breached account an identity anchor (primary email)?
• Jurisdiction, loosely — credit freezes, fraud alerts, and ID-theft reporting are country-specific; the ladder names the step types with verify-locally flags
• What's been noticed — any weird charges, logins, or mail already? That upgrades the response from preventive to active-incident

Framework: The Leak-to-Ladder Map

1. Passwords leaked → today: change it, then everywhere it was reused (the breach's real payload is credential-stuffing every other site), enable 2FA on the anchors (email first — it resets everything else), and check the account's forwarding/recovery settings if it's email (persistence tricks outlive password changes).
2. Card numbers → today: freeze/reissue via the bank app, review recent transactions, set transaction alerts. Painless, fast, and the bank's problem-handling here is mature.
3. Government ID / SSN → this week, and it's the big one: a credit freeze at the bureaus (the strongest single move where available — free in many jurisdictions, verify locally; it blocks new-account fraud at the source), fraud alerts as the lighter alternative, tax-filing and benefits-fraud awareness where relevant. The ID number can't be rotated like a password — which is why the freeze, monitoring, and calibrated long-term watchfulness are the response.
4. Email + context leaked → the phishing upgrade: breach data fuels targeted scams that reference real details ("your recent order at…") — the ladder includes the expectation-setting line: incoming messages referencing this breach are now more suspicious, not more credible (route to scam-message-decoder).
5. The letter decode: "no evidence of misuse" means "we haven't seen it yet," not "you're safe" · the free credit monitoring is worth activating (it's detection, not prevention — it tells you after something happened; the freeze is prevention) · class-action notices are separate and slow · and the offer's enrollment deadline is a real date worth catching.