Your checklist after a ransomware breach notice
Look at your notice to see what was taken, then follow the steps for each type. Freezing your credit is free and is the single most useful thing you can do.
Social Security number
- Freeze your credit at all three bureaus.
- Get an IRS Identity Protection PIN so no one else can file a tax return as you.
- Create your my Social Security account before someone else does.
Medical or health insurance information
- Read every Explanation of Benefits from your insurer for care you did not get.
- Ask your providers for a copy of your records if something looks wrong.
Bank account or card numbers
- Call your bank or card issuer and ask for a new number.
- Turn on alerts for every transaction.
Driver’s license or passport
- Contact your state DMV or the passport office about a replacement.
- Watch for accounts opened in your name.
Email, username or password
- Change the password, and any place you reused it.
- Turn on two-factor sign-in.
- Be suspicious of emails that mention the breach. Scammers use them.
Then ask whether you have a claim
If the company did not protect your information properly, you may be able to recover money for your losses and your time. The legal team will look at your notice for free.
Where to read more about an attack
Outside sites that follow ransomware groups and the companies they target.
- GovernmentCISA #StopRansomware alertsOfficial U.S. government advisories and statements on active ransomware threats.
- Leak-site trackerRansomware.liveA free tracker of victim posts on ransomware group leak sites.
- Leak-site trackerComparitech ransomware trackerA map and database of ransomware attacks on organizations around the world.
- Leak-site trackerSOCRadar ransomware victimsA free intelligence tool listing organizations named by ransomware groups.
- Leak-site trackerRansomDBA searchable database of ransomware groups and the victims they claim.
- Leak-site trackerRansomFeedA feed that monitors ransomware leak sites and logs new claims as they appear.
- ResearchGroup-IB ransomware notesA library of ransom notes left by known ransomware families.
- NewsThe Hacker News: ransomwareSecurity news coverage of ransomware attacks, groups and arrests.
- NewsSuspectFileIndependent reporting on ransomware incidents and data leaks.
Outside sites, not affiliated with us. Leak-site trackers repeat what criminal groups claim; a listing there is not proof that a company was attacked or that your information was taken. Your company’s official breach notice and its state filing are the record that matters for a claim.
General information, not legal advice. Attorney advertising.