If a company I have data with gets breached, what should I actually do?

With so many companies getting hacked lately, what's the actual playbook if I get a breach notification letter or hear a company I use got hit?

First, don't act on rumors or news headlines alone — wait for the official notification from the company itself, since that's what will actually tell you whether your specific data was involved and what they're offering (many breached companies offer free credit monitoring or identity theft protection for a period afterward, and it's worth enrolling if offered). In the meantime, it's reasonable to be more alert: watch your account statements and, if health information was involved, your insurance Explanation of Benefits (EOB) statements for anything unfamiliar, since medical identity theft can mean someone else's treatment showing up on your record or fraudulent claims filed in your name. Checking your credit reports (free at annualcreditreport.com in the US) is worth doing periodically regardless. Be especially cautious of unsolicited calls, texts, or emails referencing the breach and asking you to "verify" personal information or click a link — legitimate breach notifications don't typically ask you to confirm sensitive details this way, and scammers often piggyback on real breach news with fake follow-up contact. If financial or Social Security information was involved, a credit freeze (also free) is a stronger option than monitoring alone, since it blocks new accounts from being opened in your name entirely.