After a breach notice, the right first steps depend on what leaked

The FTC advises staying calm and matching the response to the type of data exposed: logins, financial details or ID documents. DigiCert and DreamHost serve as worked examples, though public details on both remain thin and mostly secondhand.

A breach notice is a prompt to act, but not every notice calls for the same action. The Federal Trade Commission's guidance is to stay calm and then follow steps matched to the type of information that was exposed. A leaked password, a leaked card number and a leaked passport scan lead to different first moves.

Two disclosures reported on November 5, 2026 show how far apart those cases can be. DigiCert confirmed a breach of an internal business system that held customer contact details and identity documents, according to a cybersecuritynews.com report. DreamHost confirmed that attackers collected customer FTP and SFTP logins and some webmail sessions, according to BleepingComputer. This article uses both as worked examples and says plainly where the public evidence is thin.

A notice is a warning, not proof of fraud

Receiving a notice does not mean identity theft has happened. The FTC treats its precautionary steps for people whose data was exposed as separate from its recovery steps for people who find actual misuse. That distinction shapes what a sensible first day looks like: protective moves come first, and a full recovery plan comes only if something suspicious turns up.

The FTC's consumer video guidance starts with a deliberate pause. It tells people to take a deep breath, then visit IdentityTheft.gov/databreach for steps specific to what was exposed. It also says to accept free credit monitoring or identity theft services if the breached company offers them. The agency's template notice for businesses says the site builds an individual recovery plan based on the type of information exposed.

Speed is a reasonable instinct, but the evidence for it is limited. The only timing statement in the material reviewed comes from the Internal Revenue Service, in guidance addressed to tax professionals. It says that if identity theft is reported quickly, the IRS can take steps to block fraudulent returns. No study reviewed here measures how much acting within a day or two reduces harm for ordinary consumers, so the 48-hour frame is a convenience and not a finding.

Notices also tend to arrive long after the intrusion itself. DigiCert's staff first noticed suspicious accounts on June 18, 2026, and confirmed unauthorized access only on October 19, 2026, according to the cybersecuritynews.com report. DreamHost's intrusion ran from about August to October 23, 2026, the day it was discovered. Anyone holding a notice should assume the data may have been in an attacker's hands for months, which is one reason a precaution that blocks future misuse is worth more than one that only reports it afterward.

Two current breaches at opposite ends of the spectrum

DigiCert: contact details and identity documents

According to cybersecuritynews.com, the affected system stored customer contact details and identity documents. A small minority of affected accounts also held passports, driver's licenses, utility bills or other documents showing names and addresses. A republished copy of the story on cryptika.com describes the exposed data as archived information, including names, business email addresses, phone numbers and business addresses.

The report says an initial internal review wrongly concluded that accounts without an assigned application could not access data. DigiCert confirmed the access on October 19 and filed a preliminary incident report the next day. The company says its Certificate Authority services, CertCentral and DigiCert ONE were unaffected. Its public report gives no total for affected people, organizations or documents.

Notification is still under way. A DigiCert email, shared publicly by researcher Troy Hunt on X, said the company was reviewing identity documents to identify affected individuals and would notify them when that review finished. Some people whose documents were included may therefore not know it yet. Every DigiCert detail here traces to a single news article, and DigiCert's own incident report was not available for this piece, so the specifics deserve confirmation against it.

This is a different event from an April 2026 DigiCert incident, which began on April 2 when an attacker impersonated a customer in a support chat. According to CyberInsider, DigiCert revoked 60 certificates issued during the exposure window, 27 of them directly linked to the attacker's activity. That episode concerned code-signing certificates and is not the personal-data breach now in the news.

DreamHost: logins and session information

BleepingComputer reports that attackers had access for about two months to the server running DreamHost's web-based File Manager, and took FTP and SFTP usernames and passwords. The intruder may also have reached webmail systems, exposing session information, including credentials, for a limited number of users. In a small number of cases, mailbox contents may have been viewed, according to SQ Magazine, which cited DreamHost's filing with the California Attorney General.

DreamHost said it found no evidence that the attacker reached control-panel login information or billing and payment details, which an outside provider handles. "No evidence" is not proof of no access, a limit worth keeping in mind. A DreamHost spokesperson, relayed by ua.news from TechCrunch, said "substantially fewer than 10%" of customers were affected, out of roughly 400,000 paying customers. BleepingComputer says its questions about exact account numbers went unanswered.

The mechanism explains why one breach reached so many logins. Customers typed FTP credentials into a single web front end, so one compromised server could collect logins from everyone who passed through it. The DreamHost-derived accounts also differ somewhat from other reports, which mention stolen "files". The DreamHost facts rest on secondary reports that appear to draw on the same company notice, so they are not independent confirmations.

If passwords or logins leaked

For exposed credentials, the guidance is simple and consistent. The FTC's list of immediate steps, written for people who have found misuse, includes changing logins, passwords and PINs for affected accounts. The National Institute of Standards and Technology (NIST) takes the same view from the service side: its digital identity guidelines say a service must force a password change when there is evidence of compromise, such as a breach of a password database.

Reuse is the multiplier. A password stolen from one service is only as dangerous as the number of other places it works, and NIST's FAQ advises a unique password for every account. The FAQ says NIST does not explicitly recommend password managers, but points to their ability to generate random, unique, complex passwords for each account and wants services to allow pasting so people can use them. In practice, changing the password at the breached service and at any other account sharing it is the core of the first day.

Sessions and tokens are a separate problem

The DreamHost case adds a wrinkle. A stolen session token may let someone log in as the user without knowing the password at all. That is why the company's response, according to cryptika.com, included both resetting passwords and ending active sessions on October 23. The same report says affected users need their account owner to reset passwords through DreamHost's control panel.

Where mailbox contents may have been viewed, the exposure could extend beyond the login itself. The reviewed sources do not say what those mailboxes held, so what follows is inference: anyone whose email contained sensitive documents or account information has reason to treat that as a second exposure, and to apply the steps for financial details or ID documents below.

Expect follow-up phishing

Breach notices are themselves a scam template, and DreamHost's reported advice reflects that. Customers should type panel.dreamhost.com directly into a browser instead of following login links in unexpected messages. The company says its incident emails never request passwords or ask recipients to sign in through a link. The same habit applies to any breach notice: go to the organization's site by typing its address, not by clicking.

NIST finalized a revised version of its password guideline, SP 800-63B Rev. 4, which reportedly bars periodic forced changes and requires screening against known-breached passwords. Those details come only from secondary summaries, which also disagree on minimum password length. The standard is aimed at service providers and not consumers, so it matters mainly as background on why compromise, not a calendar, is the trigger for changing a password.

If financial details leaked

Neither current case involved reported theft of bank or card numbers. DreamHost said billing data was not accessed, and the DigiCert breach reports do not say payment data was taken. DigiCert's privacy policy does list "certain payment details" among the business contact information it collects, but that is a description of its data practices and not a statement about what was stolen. The financial branch is therefore best understood through the FTC's general steps.

Under the FTC's recovery steps, the first move is to call the fraud department of the company where fraud occurred and ask it to close or freeze the affected accounts. Once an account is closed or frozen, no one can add new charges unless the account holder agrees. The same list tells people to change logins and PINs for affected accounts.

The next step is to look at credit reports. The FTC says reports can be checked every week for free at AnnualCreditReport.com, which gives a way to spot accounts that no one recognizes. Reviewing statements for unfamiliar transactions belongs here too, though the sources reviewed do not set out a schedule for it.

Two questions are left unanswered by the sources reviewed: how much of an unauthorized charge a consumer can be held responsible for, and how long it takes to get a replacement card. Those turn on federal rules and issuer policies that were not examined, so no figures are given here. The card issuer's fraud department is the practical place to ask.

If ID documents or a Social Security number leaked

This branch carries the longest-lasting risk, because a name, an address and a government ID are hard to change. The FTC's checklist for an exposed Social Security number has three parts. Take free credit monitoring if the responsible company offers it, get free credit reports at annualcreditreport.com and look for accounts that are not recognized, and consider a credit freeze. For people who decide against a freeze, the FTC says to at least consider a fraud alert.

Credit freeze versus fraud alert

According to the FTC, while a freeze is in place nobody can open a new credit account in the consumer's name. Placing and lifting a freeze costs nothing and does not affect a credit score. The agency calls it the best protection against an identity thief opening new accounts. A freeze must be requested separately at each of the three national bureaus, Equifax, Experian and TransUnion, and it lasts until the consumer removes it.

A fraud alert works differently. It tells businesses to check with the consumer before opening a new credit account, but unlike a freeze it does not stop them from viewing the credit report. One request to any single bureau is enough, because that bureau must notify the other two. The FTC says a freeze and an alert can be used together.

Older material can mislead on the alert's length. An FTC blog post from 2017 says alerts last 90 days, but an FTC notice records that free freezes and year-long initial alerts took effect on September 21, 2018 under a federal law. The one-year figure is the current one in the FTC's present guidance.

The tax-return angle

A freeze does not block a fraudulent tax return. An IRS Identity Protection PIN, or IP PIN, is a six-digit number that helps prevent someone else from filing a federal return using a taxpayer's Social Security number or individual taxpayer identification number. According to a secondary summary of IRS release IR-2026-119 on getsimplec.com, it is not a substitute for protecting account credentials and business records.

A law-firm explainer from McDermott Will & Emery adds that an IP PIN protects against tax fraud but not other crimes, such as fraudulent loan applications. The IRS page on enrolling was not reviewed for this article, so eligibility rules and the enrollment process should be confirmed at irs.gov before relying on them.

Passports, licenses and utility bills

The DigiCert leak involves documents more than Social Security numbers, and the sourced guidance does not fully cover that. No official FTC or State Department guidance specific to a leaked passport or driver's license, or to a utility bill used as proof of address, turned up in the material reviewed. This article therefore does not assert that replacing a document or contacting a motor-vehicle agency is an official recommendation, though some states and agencies run their own processes.

It is plausible, though not a sourced finding, that documents used to verify identity and address could be misused to impersonate someone. The credit-focused steps above are the ones with official backing, and they address new-account fraud specifically. Anyone notified by DigiCert can reasonably start with those while watching for further instructions from the company.

What these steps do not do

Each protection covers one kind of misuse. Judging from how the tools are defined, a freeze does not stop misuse of accounts that already exist, tax fraud, or medical and benefits fraud. A password reset protects one login and any others sharing it, and nothing else. This reasoning follows from the FTC's own definitions, but no study reviewed here measured it.

Free credit monitoring is a weaker remedy than a freeze, again by design. Monitoring detects trouble after it has happened, while a freeze blocks new accounts in the first place. The FTC still tells people to accept free services when a breached company offers them, and DreamHost is offering affected individuals one year of credit monitoring and identity theft protection through Equifax. The two are not competing choices, since the freeze is free and the monitoring costs the consumer nothing.

If misuse does appear, the FTC's IdentityTheft.gov produces a free Identity Theft Report and recovery plan, which the agency says proves to businesses that someone stole the person's identity. The FTC's phone line is 1-877-438-4338. Without an account on the site, the report and plan must be printed or saved right away, because they cannot be retrieved after leaving the page. If a credit bureau does not handle a freeze or alert properly, the FTC says to report it to the Consumer Financial Protection Bureau at consumerfinance.gov/complaint.

What a notice is worth, and what to watch

The sound core of the guidance is modest: identify what was exposed, close the door that data opens, and be skeptical of anything that arrives afterward. Leaked logins call for new, unique passwords and ended sessions. Financial details call for the issuer's fraud department, and identity documents call for credit reports plus a freeze or alert. None of it depends on a 48-hour clock, though the long gaps between intrusion and notice argue against waiting.

Both stories are still developing. DigiCert has yet to finish identifying the people whose documents were included, and neither company has published a full count in the sources reviewed. The firmest outcome measures, such as how often breach notices lead to fraud, remain missing from the public record, so the guidance rests on how the protections work rather than on proof of how well they perform.

Frequently asked questions

Does a breach notice mean my identity has been stolen?

No. The FTC separates precautionary steps for people whose data was exposed from recovery steps for people who find misuse. A notice means information was exposed, not that it has been used. Checking credit reports and account statements shows whether misuse has begun.

Is there really a 48-hour window to act after a data breach?

No authority sets one. The FTC advises staying calm and following steps matched to the data exposed. The 48-hour frame is an editorial way to prioritize, and no study reviewed here measures how much speed reduces harm.

Should I freeze my credit or place a fraud alert?

The FTC says a freeze is the best way to protect against new accounts being opened in a person's name, and it is free and does not affect a credit score. It must be placed at each of the three bureaus. A fraud alert needs one request to one bureau and lasts a year, but does not stop lenders from viewing the credit report.

What should I do if only my password leaked?

Change the password at the affected service and at any other account that uses it, and use a unique password for each account, as NIST's FAQ advises. Where session tokens were exposed, as with DreamHost, ending active sessions matters too. Type the company's address directly instead of following links in emails.

Does an IRS IP PIN protect against all identity theft?

No. An IP PIN is a six-digit number that helps prevent someone else from filing a federal tax return with a taxpayer's Social Security or taxpayer identification number. A law-firm explainer says it does not guard against other crimes such as fraudulent loan applications. Eligibility and enrollment details should be confirmed on the IRS website.

Sources

1. DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents , cybersecuritynews.com (2026-11-05)
2. DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents (republication) , cryptika.com (2026-11-05)
3. DigiCert suffers breach, stolen certificates used to sign malware , CyberInsider
4. DigiCert privacy policy , DigiCert
5. DreamHost confirms data breach exposed FTP logins and webmail sessions , BleepingComputer (2026-11-05)
6. DreamHost Confirms Hackers Stole Session Tokens and Logins , SQ Magazine (2026-11-05)
7. DreamHost confirms theft of customer files and emails (relaying TechCrunch) , ua.news (2026-11-05)
8. DreamHost Confirms Data Breach , cryptika.com (2026-11-05)
9. What To Do After a Data Breach , Federal Trade Commission
10. Data Breach Response: A Guide for Business , Federal Trade Commission
11. Data Breaches: What to know, What to do , Federal Trade Commission
12. IdentityTheft.gov - Recovery Steps , Federal Trade Commission
13. Identity Theft: A Recovery Plan , Federal Trade Commission, via US Attorney's Office (DOJ)
14. Credit Freezes and Fraud Alerts , Federal Trade Commission
15. Is a credit freeze or fraud alert right for you? , Federal Trade Commission
16. Free credit freezes and year-long fraud alerts (notice) , Federal Trade Commission
17. Fraud alerts vs. credit freezes: FTC FAQs (2017, superseded on alert length) , Federal Trade Commission (2017-09-01)
18. Identity theft information for tax professionals , Internal Revenue Service
19. NIST SP 800-63 Digital Identity Guidelines FAQ , National Institute of Standards and Technology
20. NIST Password Guidelines 2026: What SP 800-63B-4 Forbids , CyberTechVault
21. NIST password guidelines: SP 800-63B explained , Netwrix
22. IRS Shares Practical Steps to Protect Tax Data During Cybersecurity Awareness Month , getsimplec.com
23. Protect Yourself: Action Steps Following the Largest-Ever IRS Data Breach , McDermott Will & Emery

This article was drafted with the help of AI and reviewed by Jaroha editors before publication.