A company emailed me about a breach: what should I do?

Treat the letter as real until you verify it on the company's own site, not via an email link.1 Change that password and any reuse, freeze credit if an SSN or financial data was named, and expect phishing that names the breach.2 Separately, people-search sites may still list your address, phone, and relatives. The notice does not remove those listings.3

Frequently asked questions

Does a breach notification remove my info from people-search sites?

No. The notice is about the company's systems (or a partner). People-search profiles are assembled separately from public records and commercial data, and they stay published until each site's opt-out or removal is filed.

Should I trust a breach email, or is it phishing?

Treat it as real until you check the company's own site or support channel. Do not click links in the message. Legitimate notices are usually posted publicly and do not need urgent logins. Phishing that references a real breach is common after disclosures.

What's the difference between a data breach and data brokers?

A breach is an incident at a company that held your data. Data brokers (including people-search sites) publish findable personal details they collected legally and continuously, often without a hack. The letter does not clear broker listings.

Can Delist remove me from a named breach dump?

No. Delist does not scrub dump archives, Tor markets, or the breached company's systems. A free scan reports open-web exposure Delist checks: people-search, public records, brokers, and breach-source signals (a signal is not a public listing). Paid coverage files eligible open-web removals you authorize, not dump membership, not emergency forensics.

Is a free scan the same as removals?

No. The free scan is an exposure report. Removals need a paid plan and separate authorization. There is no emergency SLA or hack-forensics product.