What to Do When You Get a Data-Breach Notice
Matthew Leo · Published October 9, 2026 · Guides
A data-breach notice is not a reason to change every password and freeze every account blindly. Start with the information the organization says was exposed. Your response should match the risk.
A leaked email address creates a different problem from a stolen password, bank account number, Social Insurance Number or copy of an identity document. The notice should explain what happened, when it happened, what information was involved and how to contact the organization.
First, confirm that the notice is real
Do not sign in through a link in an unexpected email or text. A genuine breach often triggers fake follow-up messages designed to steal even more information.
Open the company’s website or app yourself, use a phone number from a statement or card, or search for its official breach announcement. Ask whether the notice applies to you and what exact fields were exposed.
Do not give a caller a one-time code to “protect” your account. Canadian fraud authorities warn that people impersonating bank investigators use claims about compromised accounts to obtain authentication codes.
Match your response to the exposed information
If a password was exposed
Change it on the affected service using the official website or app. If you reused that password anywhere else, change those accounts too. Give your email account priority because it may be used to reset other passwords.
Turn on multifactor authentication where it is available. Save recovery codes somewhere separate from the device you normally use.
If payment or banking information was exposed
Contact the financial institution using a trusted number. Ask whether the card or account number should be replaced and whether additional monitoring is available. Review recent transactions and keep checking after the initial call.
If identity information was exposed
A name and address may support convincing phishing. A Social Insurance Number, driver’s licence, passport record or detailed credit information creates a larger identity-fraud risk.
Check your credit files with both Equifax Canada and TransUnion Canada. The Financial Consumer Agency of Canada recommends asking both bureaus to place a fraud alert on your files. That alert tells lenders to contact you and confirm your identity before approving new credit.
Quebec residents also have access to a security freeze under provincial law. A freeze is stronger than an alert because it restricts disclosure of the credit file for certain new-credit, long-term rental and mobile-service applications. Availability and procedures differ elsewhere in Canada, so do not assume an American “credit freeze” guide applies in your province.
Check more than your bank balance
Watch for new accounts, hard credit inquiries, address changes, mobile-service applications and government-benefit activity you do not recognize. Keep copies of the notice and every confirmation number, email and call note.
If your phone number could be used to receive security codes, consider the extra steps in Mapletechie’s guide to protecting a Canadian number from SIM-swap fraud. You can also check whether your email appeared in other known breaches, but remember that breach databases do not contain every incident.
Report actual fraud, not just exposure
A breach notice means information may have been exposed. Identity fraud means someone used that information. If you find an unauthorized transaction or account, contact the affected institution immediately and report the incident through Canada’s National Fraud Reporting System. Local police may also be appropriate when identity documents or money were stolen.
If the organization’s explanation is incomplete, contact its privacy office and ask:
- Which exact data fields were involved?
- Was the information encrypted or otherwise protected?
- When did unauthorized access begin and end?
- Has the organization confirmed misuse or only exposure?
- What monitoring is being offered, for how long and under what terms?
The Office of the Privacy Commissioner of Canada advises affected people to assess the sensitivity of the information, change relevant passwords, monitor accounts and ask the organization questions. The goal is not to perform every possible security task. It is to close the paths the exposed information could realistically open.
Sources: Office of the Privacy Commissioner of Canada; Financial Consumer Agency of Canada; Canadian Anti-Fraud Centre; Government of Quebec security-freeze information.
Tags: data breach notice, identity theft, fraud alert, Canada, credit report