A breach notice that lists your name, driver’s license number, email address and home address looks like a short list. It is a useful one for the wrong person. A license number and an address can get a stranger through a basic identity check. An email address tells them where to send the message that starts the next step. The FTC’s own checklist says it directly: “An identity thief could try to impersonate you using your driver’s license information.”
This guide is for the individual or executive who just received that notice, or found their details in someone else’s leak. It runs in four layers, in order of urgency: lock down credit and accounts, deal with the data broker layer, clean up search results, and prepare for impersonation and phishing in your name. Every rule, date and figure below was read from the primary page on November 14, 2026. Rules change, so check the date on any page before you rely on it.
Layer 1: the free steps that work today
Freeze your credit
The FTC’s page on credit freezes is unambiguous about cost and timing. “There’s no cost to place or lift a credit freeze, and it doesn’t affect your credit score.” You also do not need to wait for misuse: “Anyone can do it, any time.” A freeze “lasts until you lift it,” and while it is in place “nobody can open a new credit account in your name, including you.”
To place one you contact all three credit bureaus (Equifax, Experian and TransUnion). If you need to apply for credit yourself, you lift the freeze temporarily, also at no cost. If you have a child under 16 whose details were exposed, the FTC says to request a free freeze for them too.
A fraud alert is the lighter option. An initial fraud alert lasts one year and can be renewed. You contact one bureau and it “must tell the other two.” An extended alert lasts seven years but requires an FTC identity theft report or a police report. The difference that matters: “Unlike a credit freeze, a fraud alert doesn’t prevent businesses from seeing your credit report.” For a leaked license plus address, the freeze is the stronger control.
Source: FTC, Credit freezes and fraud alerts.
Report the license
For a leaked driver’s license, the FTC’s data breach checklist says: “Contact the nearest DMV branch to report it.” What happens next depends on your state: “The state might flag your license number in case someone else tries to use it, or they might suggest that you apply for a duplicate.” Ask which one applies to you instead of assuming.
Lock the email account and the passwords behind it
Your email address is the reset key for most of your other accounts. The FTC’s guidance: log in, change the password, and “consider using two-factor authentication.” Then: “If you use the same password anywhere else, change that, too.”
Do not answer the follow-up
The FTC advises: “Don’t respond to unexpected calls, texts, or emails. Scammers often pretend to be from the government or a business you know.” And: “If you get an email or text message from an agency or company you do business with don’t click on any links even if you think it might be real. Instead, contact them using a website you know is trustworthy or look up their phone number.”
Three smaller items from the same checklist: accept free credit monitoring if the breached company offers it, check your credit reports (the FTC says you can do so online every week for free at AnnualCreditReport.com), and “Try to file your taxes early, before a scammer can.” If a Social Security number was part of the leak, note the FTC’s warning that in most cases you cannot get a new number “without evidence that someone else is misusing your number.”
Source: FTC IdentityTheft.gov, What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach.
Layer 2: the data broker layer
A breach exposes your details once. Data brokers are the commercial market that keeps them circulating. California law defines the category narrowly: a business that knowingly collects and sells “to third parties the personal information of a consumer with whom the business does not have a direct relationship.” The registration statute also requires brokers to tell the state whether they collect “drivers’ license number, California identification card number, tax identification number, social security number, passport number,” which shows how routine those fields are in this market.
California residents: DROP is free, use it
California built a single deletion form for this problem, the Delete Request and Opt-out Platform (DROP), run by the California Privacy Protection Agency. The agency’s timeline, as published:
- January 1, 2026: “DROP launches. Californians can start submitting requests.”
- August 1, 2026: “Data brokers begin processing requests.” The agency adds that it could take up to 90 days for consumers to see status updates.
- November 2026: “By now, all data brokers in DROP should have completed their initial download and upload cycle. Data brokers must delete data every 45 days.” The agency’s wording is “should have,” so treat it as the schedule, not proof that every broker has finished.
Mechanics worth knowing:
- It is free and limited to California residents. The statute says the mechanism “shall not charge a consumer to make a request.”
- You need only your name, date of birth and ZIP code. The agency says “The more information you enter, the more likely your data will be deleted.”
- Brokers must re-check and delete new matching data at least every 45 days. The agency’s own phrasing is that DROP is ongoing, not a one-time action.
- Two outcomes: “Deleted” (the broker matched you and deleted non-exempt data) or “Opted-out” (the broker could not make an exact match, so it “can no longer sell or share” your data but still holds it).
- After a deletion, the statute bars the broker from selling or sharing new personal information about you, subject to the exceptions in sections 1798.145 and 1798.146.
- Enforcement is financial: $200 per deletion request per day that a broker fails to delete, brought by the agency in an administrative action. The sections we read state no private right of action.
What DROP will not delete, per the agency: “Data given directly to a business (first-party data),” exempted data, and publicly available data. It also says, “Results vary by broker.” That last point matters for a breach victim. DROP does not reach the forum post, paste site or marketplace listing where breached records were dumped, and it does not touch news coverage or public records.
Sources: CalPrivacy, DROP, How DROP works, Civil Code 1798.99.86, Civil Code 1798.99.82, CPPA, Information for Data Brokers.
Everyone else
The DROP page we read says “To be eligible to submit a deletion request in DROP, you must be a California resident.” This post does not cover other states’ broker laws. If you live elsewhere, removal runs broker by broker, with no single form and no 45-day re-check obligation of the kind California imposed. That is the work a managed privacy engagement exists to do, and the reason the monitoring runs continuously instead of once. See Internet Privacy and Data-Broker Removal.
Layer 3: search results, and what Google will and will not remove
Google’s “Results about you” tool lets you monitor and request removal of results that show your contact details. On February 10, 2026, Google announced that the tool can now “find and request the removal of Search results containing your government-issued IDs, like a passport, driver’s license or social security number,” rolling out in the U.S. Availability in your own account may vary. With notifications on, you “get a notification within a few hours” when results match your name and the information you entered.
Know the limits before you spend a week on it:
- It removes results, not the page. Google says: “Google can only remove things from Google Search results. If you want something taken off the website that hosts the content, learn about contacting the website’s owner.” And: “Even if Google removes something from Google Search, it might still be on the internet.”
- It is partial. A removed page “won’t show up on Google search results for any search query that contains your name or identifier. But, it might show up if they search for something else.”
- It will not remove pages that Google judges valuable to the public. Google says it “won’t remove results for web pages that are owned by: Educational or government institutions; Newspapers.” A news article about the breach that names you stays. More broadly, “if the content is about something important or newsworthy, like the news, Google might not take it down.”
- It targets information you do not control. Google’s policy excludes “info that you can remove from the internet yourself, like info on a social media page or a personal blog that you own.”
- Doxxing is a separate path. A URL qualifies if it contains “a significant amount of aggregated personal info without a legitimate purpose” or personal info “along with explicit or implicit threats.”
- Executives should note the professional-information rule. Google’s page says to request removal of “professional info that’s been posted with the intent to harm you” through the detailed removal request form, not the personal-contact flow.
Every request needs URLs. “Only those URLs are reviewed for removal from Search results.” Finding the URLs is the real work, which is why continuous monitoring beats a one-time clean-up. Our write-up on dark forum monitoring covers where breached records tend to surface first.
Sources: Google Search Help, Remove my private info, Results about you, Google blog, February 10, 2026.
Layer 4: impersonation and phishing in your name
After a breach the messages come in two directions. Someone writes to you pretending to be your bank, your employer or a government agency. Someone else writes to people who know you, pretending to be you. The FTC’s consumer alert dated November 12, 2026 gives the scale: “Last year, the Federal Trade Commission got more than 1 million reports about imposter scams, with reported losses of $3.5 billion.”
The FTC’s list of the five most common impersonation methods, published when its impersonation rule took effect, begins with “copycat account security alerts.” A breach notice is the natural setup for that one: the target has just been told their account details are at risk, so a message about “securing your account” arrives into a prepared mind.
Two more data points on the channel. Verizon’s 2026 Data Breach Investigations Report executive summary says that in phishing simulations “the median rate of successful ‘click’ rates in mobile-centric vectors (such as voice and text messaging) is 40% higher than via email” (Verizon, 2026 DBIR Executive Summary). IBM’s 2026 Cost of a Data Breach Report found that “Voice and SMS phishing, used in 17% of attacks, led to the highest average breach costs among attack vectors, USD 5.29 million” (IBM, Cost of a Data Breach Report 2026). The phone is where the pressure now lands.
What the law covers, and what it does not
The FTC’s Impersonation Rule (16 CFR Part 461) took effect on April 1, 2024. Section 461.3 makes it an unfair or deceptive practice to “materially and falsely pose as, directly or by implication, a business or officer thereof,” and the rule defines “Officer” to include “executives, officials, employees, and agents.” So if a scammer poses as your company, or as you in your role as one of its executives, the rule applies, and the FTC can seek money for injured consumers and civil penalties.
The gap: the current text of Part 461 on the eCFR, dated November 12, 2026, contains sections only for definitions, government impersonation and business impersonation. It has no section on impersonating a private individual. The FTC proposed one in a supplemental notice (comments closed April 30, 2024) and announced an informal hearing on it on December 19, 2024. We read no final rule. If someone is impersonating you personally and not in a business role, do not assume that rule is your remedy. Report the incident at ReportFraud.ftc.gov and use each platform’s impersonation reporting.
Sources: 16 CFR Part 461 on the eCFR, FTC press release, April 1, 2024, FTC Legal Library, Impersonation Rule page, FTC consumer alert, November 12, 2026.
A verification protocol you can set up in an hour
This part is our recommendation, not a sourced rule. It follows the FTC’s business guidance, which tells breached companies to explain to affected people how they will contact them in future, partly to blunt phishing tied to the breach.
- Write down a short list of call-back numbers for your bank, your assistant, your finance lead and your family. Store it outside your email.
- Agree one rule with your assistant, finance team and family: no payment, no credential change and no sensitive document goes out on the strength of a message alone. A call to a number from the list confirms it.
- Tell those people exactly what leaked and from where, so they know what an attacker already has.
- Search your name, your company’s name and your address monthly for lookalike profiles, domains and listings. Set up alerts where the platform allows it.
What to do yourself, and what to hire out
Do yourself, today: the three credit freezes, the DMV call, password and two-factor changes, a DROP request if you live in California, and a Results about you profile.
Hire out the work that is continuous or adversarial: finding where the leaked records surface, broker removals outside California’s mechanism with documented re-checks, source-site takedown escalation when Google removal is not enough, impersonation account takedowns, and hardening the family perimeter around an executive. Our Internet Privacy and Data-Broker Removal and Personal Brand Protection engagements are built for that, and Content Removal handles the source-page side.
If you are the business whose breach put someone’s details in the open, the companion posts cover your side: the first 72 hours after a breach goes public, when a vendor is breached and customers blame you, and review backlash and trust recovery.
To see how exposed your own name looks right now, the 90-second audit runs in your browser. The strategy call is free. This article is general information, not legal advice.