Identity Theft After a Data Breach

A data breach and identity theft are related, but they are not the same event.

A breach occurs when personal information is accessed, acquired, disclosed, or exposed without authorization. Identity theft occurs when someone actually uses another person’s personal information to impersonate them or commit fraud.

The distinction matters. Millions of people may have information exposed in a cybersecurity incident without every affected person experiencing identity theft. When stolen information is later used to open accounts, file tax returns, obtain medical care, take over online accounts, or commit other fraud, the connection between the breach and that misuse can become an important legal question.

Net Law Advocates represents individuals nationwide in identity theft and data breach litigation. When identity theft follows a breach, we examine the information compromised, the nature and timing of the misuse, and the available evidence to determine whether the events may be connected.

How Can a Data Breach Lead to Identity Theft?

Organizations maintain enormous amounts of personal information.

Depending on the organization and the affected systems, a breach may involve:

• Social Security numbers
• Names and dates of birth
• Driver’s license information
• Bank account information
• Credit and debit card numbers
• Tax and payroll records
• Health insurance information
• Medical records
• Email addresses and passwords
• Online account credentials

Not every category of information presents the same identity-theft risk.

A breached email address by itself creates a different situation from the exposure of a name, Social Security number, date of birth, and financial information together.

The more information an attacker possesses, the more opportunities there may be to impersonate the victim or defeat identity-verification systems.

Exposure Is Not the Same as Misuse

Receiving a data breach notice does not establish that someone has stolen your identity.

The notice may tell you that information was accessed, acquired, or potentially compromised. Whether the information was actually used is a separate issue.

This distinction is especially important when evaluating harm.

Someone whose Social Security number was exposed but never misused presents different facts from someone who later discovers a fraudulent loan, tax return, or employment record using that same number.

Our Social Security Number Data Breach page addresses the exposure side of that issue, while Social Security identity theft concerns actual unauthorized use of the SSN.

What Types of Identity Theft Can Follow a Data Breach?

The type of misuse often depends on the information compromised.

Financial Identity Theft

Names, Social Security numbers, dates of birth, addresses, and other identifying information can potentially be used to open fraudulent credit accounts or loans.

Financial identity theft may first become apparent through an unfamiliar account, credit inquiry, collection notice, or unexpected change to a credit report.

Credit Card and Bank Account Fraud

Payment-card information or banking credentials can potentially be used to conduct unauthorized transactions.

Existing-account fraud presents different issues from opening an entirely new account under a stolen identity. Unauthorized activity involving existing financial accounts is addressed separately in our discussion of credit card and bank account fraud.

Account Takeover

A breach involving usernames, passwords, authentication data, or other credentials may lead to an account takeover.

An attacker may gain control of email, banking, shopping, social media, healthcare, or other online accounts and use that access to obtain additional information or commit fraud.

Tax Identity Theft

A compromised Social Security number and related identifying information may be used to file a fraudulent tax return.

Tax identity theft may be discovered when a legitimate tax return is rejected because another return has already been filed under the same SSN.

Employment Identity Theft

Someone may use another person’s Social Security number to obtain employment.

This form of employment identity theft can create inaccurate wage, tax, or Social Security records.

Medical Identity Theft

Healthcare breaches can expose combinations of identifying, insurance, and medical information.

When another person uses that information to obtain medical treatment, prescriptions, insurance benefits, or submit claims, the result may be medical identity theft.

Identity Theft May Not Happen Immediately After the Breach

The absence of immediate fraud does not establish that breached information was never obtained or will never be used.

Stolen personal information can remain useful after the original security incident.

This is particularly true of persistent identifiers such as Social Security numbers. A compromised password can be changed. A payment card can be replaced. A person’s SSN generally remains associated with that person.

Identity theft may therefore be discovered weeks, months, or potentially longer after the underlying breach.

At the same time, a long gap between a breach and later fraud can make causation more complicated. Personal information may have been exposed through multiple incidents or obtained from another source.

Timing is relevant, but timing alone rarely answers the entire causation question.

How Do You Determine Whether Identity Theft Came From a Particular Breach?

There is no universal test.

An investigation generally considers the relationship between the information exposed and the information later used.

Suppose a breach notification states that a person’s name, Social Security number, date of birth, and address were compromised. Several months later, a fraudulent credit account is opened using those same identifiers.

That factual relationship may warrant investigation.

Relevant questions can include:

• What information was compromised in the breach?
• Was the information merely exposed, or is there evidence it was acquired?
• What information was required to commit the identity theft?
• Does the misused information match the breached data?
• When did the breach occur?
• When did the fraudulent activity begin?
• Has the victim experienced other breaches involving the same information?
• Was the stolen information published, sold, or otherwise made available?
• Did other people affected by the same breach experience similar fraud?

No single factor necessarily proves where the identity thief obtained the information.

The objective is to determine whether the available evidence supports a reasonable connection between the breach and the later misuse.

A Breach Notice Can Be Important Evidence

Keep the original breach notification.

It can establish what the organization disclosed about the incident at the time, including potentially:

• The date or approximate period of the breach
• When the organization discovered it
• What systems were affected
• What categories of information were involved
• Whether the company believes information was accessed or acquired
• What protective services were offered
• What steps affected individuals were advised to take

The wording can matter.

Statements such as “accessed,” “acquired,” “exfiltrated,” “viewed,” and “potentially exposed” do not necessarily describe the same factual circumstances.

Preserve later updates from the organization as well.

Does “No Evidence of Misuse” Mean the Information Is Safe?

Not necessarily.

A company may state that it has found no evidence that compromised information has been misused. That statement describes what the organization knows or has identified at that point.

It does not establish that misuse is impossible.

Likewise, the fact that identity theft later occurs does not automatically prove the company’s earlier statement was false. The organization may genuinely have had no evidence of misuse when the notice was issued.

The later fraud should be evaluated based on the evidence available at that time.

What Should You Do If Identity Theft Happens After a Breach?

Address the identity theft itself first.

The Federal Trade Commission’s IdentityTheft.gov resource provides individualized recovery plans based on the type of identity theft involved. Current FTC guidance recommends contacting businesses where fraud occurred, securing affected accounts, reviewing credit reports, and reporting identity theft to the FTC.

Depending on what happened, additional steps may include freezing credit, disputing fraudulent accounts, contacting a bank or credit-card issuer, correcting tax or employment records, or securing compromised online accounts.

A credit freeze can make it harder for an identity thief to open new credit accounts, although it does not prevent every type of identity theft.

Preserve Evidence of the Identity Theft

The records created after fraud occurs can become important in determining whether a breach caused actual harm.

Preserve documents such as:

• The original breach notice
• Credit reports
• Fraudulent account records
• Credit inquiries
• Bank and credit-card statements
• Collection notices
• IRS correspondence
• Medical bills or insurance records
• Account-security alerts
• Password-reset notifications
• FTC identity-theft documentation
• Communications with creditors and other businesses
• Records of out-of-pocket losses
• Documents showing time spent correcting the problem

Do not discard these records simply because an individual fraudulent account has been closed.

Additional misuse may later reveal a broader pattern.

What If Several Data Breaches Exposed the Same Information?

Causation becomes more difficult when the same person has been affected by multiple breaches.

Social Security numbers, email addresses, passwords, payment information, and other data can also be obtained through phishing, malware, scams, stolen documents, or account compromise.

An attorney evaluating a potential claim may therefore need to compare multiple incidents.

A more recent breach is not necessarily the source of the identity theft merely because it occurred closest in time to the fraud.

Likewise, an older breach should not automatically be dismissed if the compromised information remained usable.

Does Identity Theft Make a Data Breach Lawsuit Stronger?

Actual identity theft can materially change the legal analysis, but it does not automatically create a successful lawsuit.

Federal courts require plaintiffs seeking damages to establish concrete harm, among other standing requirements. The Supreme Court has made clear that a risk of future harm alone does not necessarily establish Article III standing for damages. Actual monetary loss and other concrete injuries can present materially different circumstances.

Identity theft may provide evidence of actual misuse and concrete injury.

A plaintiff still must address other elements, including whether the defendant’s conduct can be connected to that injury and whether the applicable law provides a cause of action.

Can a Third-Party Vendor Be Involved?

Yes.

Organizations frequently rely on payroll providers, cloud services, billing companies, healthcare vendors, financial technology providers, software companies, and other third parties to process or store personal information.

The company with which the consumer has a direct relationship may not be the organization whose systems were initially compromised.

That can make the factual investigation more complicated.

Potential responsibility depends on what each organization did, what duties applied, how the breach occurred, and what legal claims are available.

Can You Sue for Identity Theft After a Data Breach?

Potentially.

A viable lawsuit generally requires more than showing that a breach occurred and identity theft happened later.

The investigation may need to establish what the defendant did or failed to do, what information was compromised, how the identity theft relates to that information, what injury occurred, and what law applies.

Actual identity theft can provide significant evidence of harm. Whether it supports a claim against a particular organization depends on the complete circumstances.

The broader requirements for bringing an identity theft lawsuit involve additional questions concerning legal duties, causation, standing, damages, and available remedies.

When May Attorney Review Be Appropriate?

Attorney review may be worthwhile when documented identity theft follows a known breach involving the same types of information used in the fraud.

The factual relationship may be particularly significant when:

• A Social Security number or other persistent identifier was compromised
• Fraud began after the breach
• The information used matches the breached data
• Multiple forms of identity theft occurred
• Significant financial or credit harm resulted
• Other affected individuals experienced similar misuse
• The organization disclosed that data was acquired or exfiltrated

These circumstances do not guarantee that a legal claim exists. They can, however, provide a meaningful basis for investigating the connection.

Speak With Net Law Advocates About Identity Theft After a Data Breach

Identity theft can transform a data-security incident from an exposure of personal information into documented misuse of a person’s identity. Determining whether the two events are connected requires examining the information compromised, the nature and timing of the fraud, and the available evidence.

Net Law Advocates represents plaintiffs nationwide in identity theft, data breach, and privacy matters. If your identity was stolen after a data breach and you want to understand whether the organization that maintained your information may bear legal responsibility, contact Net Law Advocates at 888-913-2318 for a free, confidential consultation.