What is a data breach? The best tools to protect yourself after a cyberattack

It’s not just you — cyberattacks are becoming more common. According to the Identity Theft Resource Center, companies and organizations reported 3,322 data breaches in 2025, a massive 79% uptick since 2020. The exposure of personally identifiable information (PII) resulted in nearly 279 million notifications being sent to U.S. consumers that year.

The financial toll of cyberattacks is climbing, too: The average cost of a data breach in the United States reached a record $11.5 million in 2025, according to data from IBM.

Having your information exposed in a data breach can significantly increase your risk of identity theft and financial fraud. Here’s what you need to know about data breaches and how you can protect yourself both before and after they happen.

A single data breach can expose millions of sensitive personal records, leading to widespread fraud or identity theft. According to the Federal Trade Commission, there were almost 500,000 reports of identity theft in the second quarter of 2026 alone.

Data breaches can happen for several reasons, including:

• Cyberattacks, such as hacking, ransomware or malware infections.
• Phishing scams, where employees or customers are tricked into revealing login credentials.
• Insider threats, including employees who intentionally or accidentally expose data.
• Lost or stolen devices, such as laptops or smartphones containing unencrypted information.
• Security flaws, like improperly secured cloud databases or software vulnerabilities.
• Human error, such as a company mistakenly releasing private information.

Laws in all 50 U.S. states and Washington, D.C. require companies that have suffered a data breach to notify affected customers. Most states also require companies to notify the state’s Attorney General or a designated state agency if a certain number of residents are affected

According to tracking data analyzed by Law360, more than 3,000 data breach-related lawsuits were filed in the U.S. in 2025,most of which were class-action suits. That’s approximately double the volume seen in 2024.

Most complaints allege affected companies failed to adequately safeguard personal information or notify affected customers in a timely manner.

• Freeze your credit reports: Freezing your credit reports with Equifax, TransUnion, and Experian prevents anyone from opening new accounts, such as credit cards or loans, in your name until you unfreeze them. You can contact the credit agencies yourself, or sign up for Aura, an identity monitoring service that will freeze your accounts for you. It also includes a password generator, email aliases, a VPN, robocall filters and malware protection.

• Change your passwords: Even if your passwords weren’t exposed, create new, unique ones. The best passwords include special characters, upper- and lowercase letters, and numbers, and have nothing to do with your identity or the account or service.

  A password manager like Keeper or Dashlane can create secure ones for you, and add features like dark-web monitoring and email masking.

• Place a fraud alert on your credit reports: Contact the credit bureaus to request a fraud alert, which tells lenders to verify your identity before opening any new accounts.
• Be on the alert for phishing emails, messages or phone calls: Bad actors may target you for a phishing scam, getting you to click an unsecured link that collects more sensitive information.
• Enroll in identity theft protection: Identity theft protection services include a variety of services, including virus protection, password managers and credit monitoring. Norton Advantage with LifeLock 360 is one of our top picks, offering alerts for bank and credit card activity, dark web monitoring, security for up to 10 devices and up to $1.2 million in insurance coverage.

• Your credit card company or bank may provide updated credit score information for free.
• Get free copies of your reports from each of the three major bureaus at AnnualCreditReport.com.
• For regular updates on all three reports, consider subscribing to a paid identity theft protection service like PrivacyGuard® or Experian IdentityWorks℠.

• Contact your bank, credit card issuer and other financial institutions to report any fraudulent activity, secure your accounts and dispute any unrecognized charges.
• Report the incident to the Federal Trade Commission. Depending on the nature and extent of the fraud, you may need to notify law enforcement.
• Freeze your credit reports if you haven’t done so already.

Why trust CNBC Select?

At CNBC Select, our mission is to provide our readers with high-quality service journalism and comprehensive consumer advice so they can make informed financial decisions. Every cybersecurity article is based on rigorous reporting by our team of expert writers and editors. While CNBC Select earns a commission from affiliate partners on many offers and links, we create all our content without input from our commercial team or any outside third parties, and we pride ourselves on our journalistic standards and ethics.