Five Records to Open the Week a Breach Letter Arrives, and What Each One Proves

The letter arrives folded in thirds, printed on the vendor's letterhead, and it usually says less than you want and more than you expect. Most people read it once, feel briefly annoyed, and put it somewhere that is not a file. That is the mistake, and it is not a mistake of vigilance. It is a mistake of record keeping. What you do in the week after a notification rarely stops fraud, because the data left months ago, but it decides whether a dispute you file next spring takes one phone call or eleven months of proving what you already know.

1. The notification itself, with the date you received it

Keep the letter whole, envelope included, and write the delivery date on it in pen. The postmark and the letter's own date often differ by weeks, and that gap matters: several state notification laws and most free-monitoring offers run their clocks from a date printed by the sender, not the day the mail reached you. Note the incident window the vendor describes, the categories of data involved, and the enrollment deadline for whatever service they are funding. Scan it. A photograph of the page on your phone counts, provided the reference number and the toll-free line are legible.

2. A single running log of every call you make

One page, in one place, is worth more than a drawer of confirmations. For each contact, record the date, the company, the name or badge number of the person, the reference number they gave you, and what they said would happen next. This is dull work that pays twice. It pays when a bank asks you to prove you reported the compromise before the disputed charge, and it pays when a second representative contradicts the first and you can quote the earlier call precisely. A spreadsheet is fine, a notebook is fine, and a note app you actually open is better than a system you admire and ignore.

3. Your credit freeze confirmations and the PINs attached to them

Freezes at Equifax, Experian and TransUnion are free, individually placed, and separate from any monitoring the breached company is offering. Each bureau issues a confirmation and, depending on how you file, a PIN or an online account credential you will need in order to lift the freeze when you refinance, apply for a card, or let a landlord run a check. Store those three items together, because the frustrating part of a freeze is never the freezing. It is the temporary lift on a Friday afternoon with an underwriter waiting, when nobody in the household can find the number.

4. The identity theft report, if anything has actually happened

Notification alone is exposure, not harm, and filing a report before there is anything to report clutters your file. Once you see an account you did not open or a charge you did not make, the picture changes. The Federal Trade Commission is responsible for the federal identity theft reporting system, and the report it generates functions as the document banks, collectors and credit bureaus ask for when you tell them a debt is not yours. Print it, keep the report number in your call log, and take it to your local police department if a creditor insists on a separate local report as well.

5. An inventory of which accounts touched that vendor

The practical question after a breach is narrow: where else did this email address, this password, or this card number get used? Open your password manager and search the vendor's domain, then search for reuse of whatever credential the letter says was exposed. If the compromised item is a card, list the recurring charges that will decline when you replace it, because the utility autopay you forget is the one that produces a late fee three weeks later. Write the list down before you change anything. Reconstructing it afterward, from memory and declined-payment emails, takes an evening you will resent.

What the file is actually for

None of this is defensive theater. Each record answers a question somebody will ask you later, usually a stranger on a recorded line who has no reason to take your word for anything. The letter proves you were exposed and when. The log proves you acted and who told you what. The freeze confirmations prove your file was locked before the fraudulent application appeared. The identity theft report converts your account into a document a creditor's process can accept. Together they turn a slow argument into a short one, which is the whole return on an hour of filing.

Put the six items in one folder, physical or digital, and label it with the vendor's name and the year. You will either never open it again or open it under pressure, and the second case is why it exists.