Got a Breach Letter? What Responding Actually Costs You, in Dollars and in Hours

The envelope does not come with an invoice, which is why most people assume the whole episode is free. It is not free, but the cost sits in odd places: a replaced driver's license, a notary fee on an affidavit, two hours on hold with a card issuer, a morning spent proving to a collections agent that an account opened in your name was never yours. The dollar figures are mostly small. The hours are not, and they are the part nobody budgets for, because the letter is written to sound like an update rather than an assignment.

The three parts of the bill, and which one usually dominates

Break the cost into fees you pay out, documents you replace, and time you spend, and the shape of the answer gets clear fast. Fees are now the smallest piece for most households, because credit freezes at the three nationwide bureaus are free and because the monitoring offered in the letter, whatever its actual worth, costs you nothing but an enrollment code. Document replacement is modest but real: a new license at the DMV, a replacement card, occasionally a notarized statement. Time is where the money actually goes, and it compounds with every account that shared the exposed credential.

Count the hours honestly before you decide how hard to work the letter. A single exposed email address and a password you used nowhere else is perhaps forty minutes: change it, turn on two-factor authentication, note the date. A Social Security number plus a date of birth is a different job, and the work arrives in installments over months rather than in one sitting. If you bill your own time at anything, the second case costs more than any product mentioned in the notice, and that gap is the reason to triage rather than treat every letter the same way.

What drives the number up

Four things move the cost, and only one of them is under your control. The first is the data type: an email and password combination is cheap to contain, while a Social Security number cannot be changed and therefore turns into monitoring rather than repair. The second is reuse, which is entirely yours: if the leaked password also opened your bank, your email and your pharmacy portal, you have multiplied one breach into four remediation jobs. The third is whether money or credit actually moved. The fourth is whether a government-issued document or a medical record was involved.

That last driver is the one people underestimate. A breach involving a health plan or a provider can surface later as a bill for care you never received, and unwinding that means writing to the provider, the plan, and sometimes a collections agency, each of which wants its own version of the same explanation. A driver's license number in the file can mean a replacement license and a written statement to the issuing state. Neither is expensive per item. Both are slow, and both are far easier when you already hold dated copies of what you sent.

What changed recently, and why it matters to your timeline

Three shifts have altered how these letters land. Security freezes at the nationwide credit bureaus became free across the country by federal law, which removed the old per-state fee and killed the argument for waiting. Many states have tightened their notification windows, so letters that once arrived vaguely now arrive inside a defined number of days after discovery, with the discovery date often stated in the notice itself. And public companies now disclose material cybersecurity incidents to the Securities and Exchange Commission within a short window of deciding the incident is material, which means the news frequently reaches you before the mail does.

The practical consequence is a reordered sequence. You will often learn of an incident from coverage, then receive a letter weeks later with a narrower description of what was taken. Write down the date you first heard, the source, and what that early account said the exposure was, because the letter's version may be broader or narrower and the difference is worth having on paper. The Federal Trade Commission is the federal body responsible for identity theft reporting and recovery planning, and its intake process expects dates, not impressions.

The file, and what belongs in it

Start a single folder the day the letter arrives and photograph the notice front and back, including the envelope with its postmark, because the mailing date is sometimes the only evidence of when the clock started. Log every call with the date, the time, the company, the name or badge number of the person, and one sentence on what they committed to. Convert anything important into writing afterward: a short email confirming what was agreed, sent the same day, is worth more six months later than a clear memory. Keep the enrollment code even if you decline the monitoring.

When you dispute a charge or a new account, send the dispute by a method that produces a receipt, and keep the receipt with the copy of what you sent. Certified mail costs a few dollars and settles arguments about whether a letter arrived. Note the date each freeze was placed and the PIN or login that lifts it, since a freeze you cannot lift becomes an obstacle the week you apply for a car loan. None of this is complicated work. It is simply work that must exist on paper rather than in recollection.

The realistic budget for a well-handled breach notification is a few dollars in postage, one replaced document if you are unlucky, and somewhere between one afternoon and several spread across a year. Spend the first hour on the file and the freeze, in that order, and the rest of the work stays small and dated instead of becoming an argument you have to win from memory.