data-breach-response

Data Breach Response Skill

The breach notification letter arrives months late, written by lawyers to minimize alarm and liability in the same paragraph — and the reader's real question is buried: what did they get, and what do I actually do? The answer depends entirely on the first part: a leaked password and a leaked government ID number are different emergencies with different ladders. This skill triages by what leaked, orders the response (some steps are today, most aren't), and decodes the letter itself — including the free-monitoring offer, which is worth taking and worth understanding.

What This Skill Produces

• The triage — what leaked, mapped to what it enables: account takeover, financial fraud, identity theft, targeted phishing
• The ladder — do-today / this-week / ongoing, ordered by damage-prevented-per-minute
• The monitoring plan — what to watch, where, at what cadence — calibrated, not paranoid
• The letter decode — what the notification actually admits, and what the monitoring offer covers

Required Inputs

Ask for these if not provided:

• What leaked — from the letter or breach-lookup: email? passwords (hashed or plain — the letter usually says)? card numbers? government ID / SSN? medical? The whole response keys off this list
• The account's blast radius — was that password reused? (The honest answer decides half the ladder) Is the breached account an identity anchor (primary email)?
• Jurisdiction, loosely — credit freezes, fraud alerts, and ID-theft reporting are country-specific; the ladder names the step types with verify-locally flags
• What's been noticed — any weird charges, logins, or mail already? That upgrades the response from preventive to active-incident

Framework: The Leak-to-Ladder Map

1. Passwords leaked → today: change it, then everywhere it was reused (the breach's real payload is credential-stuffing every other site), enable 2FA on the anchors (email first — it resets everything else), and check the account's forwarding/recovery settings if it's email (persistence tricks outlive password changes).
2. Card numbers → today: freeze/reissue via the bank app, review recent transactions, set transaction alerts. Painless, fast, and the bank's problem-handling here is mature.
3. Government ID / SSN → this week, and it's the big one: a credit freeze at the bureaus (the strongest single move where available — free in many jurisdictions, verify locally; it blocks new-account fraud at the source), fraud alerts as the lighter alternative, tax-filing and benefits-fraud awareness where relevant. The ID number can't be rotated like a password — which is why the freeze, monitoring, and calibrated long-term watchfulness are the response.
4. Email + context leaked → the phishing upgrade: breach data fuels targeted scams that reference real details ("your recent order at…") — the ladder includes the expectation-setting line: incoming messages referencing this breach are now more suspicious, not more credible (route to [scam-message-decoder](../scam-message-decoder/SKILL.md)).
5. The letter decode: "no evidence of misuse" means "we haven't seen it yet," not "you're safe" · the free credit monitoring is worth activating (it's detection, not prevention — it tells you after something happened; the freeze is prevention) · class-action notices are separate and slow · and the offer's enrollment deadline is a real date worth catching.

Output Format

Breach Response: [breach/company] — leaked: [the list]

What This Enables

[The leaked items → the specific risks, plainly — no vague "your data may be at risk"]

The Ladder

Today: [the leak-keyed items] · This week: [freeze/alerts (verify-locally), monitoring enrollment before its deadline] · Ongoing: [the calibrated watch: statements cadence, credit-report cadence, the phishing expectation]

The Letter, Decoded

["No evidence of misuse" translation · what the monitoring offer does and doesn't do · deadlines in the letter, extracted]

If Something's Already Wrong

[Active-fraud branch: dispute processes, the ID-theft report path (jurisdiction-flagged), the paper trail to start]

> Freeze mechanics, fraud-alert rules, and identity-theft reporting vary by country — verify the flagged steps locally. A freeze blocks new credit, not existing-account fraud; the ladder covers both for that reason.

Quality Checks

• [ ] Every response item traces to a specific leaked data type — no generic hygiene dump
• [ ] The reuse question was asked and its answer shaped the ladder
• [ ] Freeze vs. monitoring is explained as prevention vs. detection
• [ ] Jurisdiction-specific mechanisms are typed and flagged, not asserted
• [ ] The active-incident branch exists and upgrades the response when triggered

Anti-Patterns

• [ ] Do not respond to every breach identically — a forum password and an ID number are different events
• [ ] Do not present the monitoring offer as protection — it's a smoke detector, not a lock; take it anyway
• [ ] Do not induce panic or dismiss — the calibrated middle is the product
• [ ] Do not skip the email-anchor check — the account that resets all others is the one that matters most
• [ ] Do not let "no evidence of misuse" close the case — the ladder runs on what leaked, not on the letter's comfort