Skip to main content
All of CanadaUpdated September 2026

I received a data breach notification. What do I do?

Step-by-step response when an organization tells you your information has been compromised.

TL;DR

The notification has to describe what was exposed and the steps being taken; the protective steps it suggests (password changes, MFA, fraud alerts) are the usual response, and a record of what was done is what a later complaint to the OPC or a provincial commissioner relies on.

Immediate steps

Within the first 24 hours:

  • Change passwords on any affected account and enable multi-factor authentication.
  • If financial data was involved, call your bank and credit card companies.
  • Place fraud alerts on your credit files with Equifax and TransUnion.
  • Save the notification and take screenshots of any related emails.

Follow-up steps

Within the first week:

  • Monitor bank and credit card statements closely for at least 12 months.
  • Sign up for free credit monitoring if offered by the organization.
  • Fraud alerts at Equifax and TransUnion are free for reported victims and stay on the file for six years.

If the response is inadequate

A complaint can be made to the OPC or the applicable provincial commissioner. Civil claims and class actions also exist, although Ontario courts have held that intrusion upon seclusion does not lie against an organization that was itself hacked by a third party (Owsianik v. Equifax, 2022 ONCA 813); such claims usually rest on negligence or contract.

Related topics

Ask AI