Got a Breach Letter in December? What the Calendar Changes About Your Next Move

A breach notice is a sheet of paper with a date on it, and the date does more work than most households give it credit for. The text is close to interchangeable from one company to the next: a paragraph about an unauthorized third party, a paragraph about what categories of information were involved, a paragraph offering monitoring, and a phone number staffed by a vendor who is not the company that lost the data. What changes is the week you receive it. A notice that arrives the second week of December sets off a different sequence than the same notice arriving in late February, because your money is doing different things in those two weeks.

What was in the envelope ten years ago, and what is in it now

The physical object has barely moved. Same window envelope, same PO box in a state where the company does not appear to have offices, same perforated stub carrying an activation code in a font chosen to survive a mail sorter. What has moved is the remedy. Ten years ago the standard offer was twelve months of credit monitoring, and the more useful step, a security freeze at each of the nationwide credit bureaus, generally cost money, varied by state, and often had to be lifted by mail or by phone with a paper PIN you were told never to lose. Households did the arithmetic and skipped it.

Since federal law made freezes free at the nationwide bureaus, that arithmetic collapsed. Placing a freeze is now a free online transaction at each bureau, and lifting one temporarily takes minutes rather than the better part of a business week. That single change reorders the whole response. The monitoring enrollment, which tells you after the fact that something opened in your name, moved from being the main event to being a secondary comfort, and the freeze, which stops the account from opening, moved to the front. The letter still leads with the monitoring code because the monitoring is what the company is paying for.

The other addition is the identity protection PIN. The IRS now makes an IP PIN available to any taxpayer who verifies identity, not only to people who already had a fraudulent return filed against them, and that opens a door that did not exist a decade ago. It is a six digit number, reissued annually, that has to appear on your federal return for the return to be accepted. Ten years ago, a household reading a breach letter in January had no way to preemptively lock the filing. Now the door is standing open, and most letters do not mention it.

December: the reissued card that quietly breaks the month

The week-to-week reality of a December notice is not fraud. It is logistics. If payment card data was involved, the issuer reissues, and the plastic arrives in a plain envelope that looks like an offer and gets thrown out by whoever collects the mail first. Meanwhile the old number is on file in a dozen places you built up without thinking about it: the electric bill, the phone bill, two streaming services, the pharmacy autofill, the storage unit, the kid's lunch account. Every one of those is a separate login on a separate evening, and the failed charges arrive as text messages across the two weeks you are least able to sit down and work through them.

So the December sequence is the reverse of the panicked one. Freeze first, because it is free and takes twenty minutes across three bureaus and does not need to be revisited. Then write down the autopay list before the new card arrives, working from the last two statements rather than from memory, because memory reliably misses the annual charges. Then update in one sitting when the plastic shows up. The holiday complication is that a freeze also blocks the instant store financing pitched at a register in December, which is a small price and, most years, a favor.

January through April: the season when a breach becomes a tax problem

A notice that involves Social Security numbers changes character once W-2s start arriving. The mechanism is simple and has not changed in a decade: someone files a return in your name early, claims a refund, and you find out when your own return is rejected as a duplicate. What has changed is that you are no longer limited to filing early and hoping. The IP PIN closes the filing, and the Federal Trade Commission, which is responsible for the federal identity theft recovery process, maintains the reporting and recovery track that turns a rejected return into a documented case rather than a series of phone calls.

The practical household version is a February evening with the letter, a laptop, and the tax documents already in the folder. Enroll in the IP PIN, note that it is reissued each year and that a new one is needed every filing season, and put the retrieval in the same place you keep the mortgage statement. If a state return is also in play, check whether your state revenue department runs its own PIN program, because several do. The work is an hour. The alternative, when it goes wrong, is a refund delayed for months while identity verification runs.

Summer: the season for thawing, and for the moves that need credit pulled

The reason people used to avoid freezes was the fear of being locked out of their own borrowing, and that fear is now mostly out of date. A temporary lift can be scheduled for a date range, or aimed at a single bureau if the lender tells you which one it pulls, and it takes minutes online. This matters most in the summer, when leases turn over, cars get bought, and utility accounts get opened in a new town, all of which trigger a credit pull. The move to make is asking the lender or the utility which bureau it uses before you lift all three.

The seasonal habit that pays off is a short annual review, scheduled somewhere quiet, of what is actually frozen and what is not. Freezes at the three nationwide bureaus cover most new account fraud, but a household that has moved, opened a business line, or added an adult child to the finances usually finds one bureau where a freeze was never placed or was lifted for a car loan and never restored. That is a fifteen minute check. Doing it in July, when nothing is pending, is a great deal easier than doing it in December with a rejected card.

The letter is not really telling you what happened. It is telling you the date on which someone else's decision became your week, and the useful reading is always the one that asks what else is scheduled in that week. A December notice is an autopay problem wearing a security costume. A February notice is a filing problem. The tools available now, free freezes, scheduled thaws, an IP PIN anyone can request, make both of them ordinary maintenance rather than an emergency, which is a genuinely different position than a household was in ten years ago.