Who sends it: A company, health provider, bank or agency that held your information, after a breach.
What this letter is
When a company, hospital, bank, store or agency learns that someone got into its records, state laws generally require it to tell the people affected. The letter says what happened, when, what kind of information was involved, and what the company is doing about it.
It often offers free credit monitoring or identity protection for a period of time, with an enrollment code and a deadline to sign up.
What to look for first
- Which information was exposed. A Social Security number, bank account, card number, medical record or password each needs a different response.
- Which company it is. Sometimes it is a vendor you never heard of that worked for a company you do use.
- The deadline to sign up for any free service offered
- The phone number for questions
What to do
- If your Social Security number was exposed, think about a credit freeze at Equifax, Experian and TransUnion. It is free and makes it much harder for someone to open new credit in your name.
- If a card number was exposed, call the number on the back of the card and ask for a new card.
- If a password was exposed, change it, and change it anywhere else you used it.
- If medical information was exposed, read your Medicare Summary Notices and Explanations of Benefits for services you did not get.
- Check your credit reports for free at annualcreditreport.com.
- If someone has used your information, go to identitytheft.gov for a step-by-step recovery plan.
About the free monitoring
Credit monitoring alerts you to some changes on your credit report. It does not stop fraud by itself, which is why a freeze is worth thinking about too. If you sign up, use the website or phone number in the letter only after you have checked that the letter is real.
How to tell a real one from a fake
A real letter names the company, describes what happened in some detail, and does not ask you to confirm your Social Security number, card number or password. To check, look up the company's phone number yourself, or search the company's name and the words data breach. Many state attorney general websites post copies of breach letters.
Be careful with any letter, call or email that pushes you to act right away or to pay for protection.
Have one in front of you?
Take a clear photo and text it to Uncle at +1 208 214 0093. He tells you in plain words what it says, what it wants from you, and anything that looks wrong. How to take a clear photo.
This page explains what this kind of letter usually means. Your letter is the final word on your dates and amounts. For a decision about taxes, health coverage or a legal matter, call the office that sent it, using the number on its official website, or ask a professional you trust.
Read next
Written by the Textuncle team. Last updated October 3, 2026.
Text Uncle