TaxSlayer data breach: what happened and what to do

What to do if you were in it

1. 1

   Change any password you reused

   The attack worked because logins from another service also opened TaxSlayer. Give every account its own password, ideally from a password manager, and change the old shared one everywhere.

2. 2

   Turn on two-factor login

   Use two-factor authentication on tax, bank and email accounts, so a stolen password alone doesn't open them.

3. 3

   Freeze your credit at all three bureaus

   A credit freeze stops lenders from seeing your credit report, which blocks most new accounts in your name. The FTC says it's free and you place it separately at Equifax, Experian and TransUnion. You lift it temporarily when you apply for credit yourself.

4. 4

   Look at your credit reports and statements

   Order your free credit reports and look for accounts or inquiries you don't recognize. Read your bank, card and insurance statements for charges or claims you didn't make. The FTC's IdentityTheft.gov/databreach page walks through the steps for the type of data that leaked.

5. 5

   Take the free credit monitoring if it's offered

   If the organization offers free credit monitoring or identity theft protection, the FTC recommends taking it. Use the enrollment instructions in the letter you received, not a link in an unexpected message.

6. 6

   Check whether your email or phone is in this and other breaches

   Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when something new turns up. It can't remove data that has already leaked, so the steps above are still the fix.