What to do after a data breach notice: fraud alerts and credit freezes in Canada

A letter or email saying your personal information was involved in a data breach is unsettling, but most of the risk can be reduced with a few hours of work. This guide walks through what to do in the first day, how to put a fraud alert or credit freeze on your file with Equifax Canada and TransUnion Canada, and what to watch for in the months that follow.

Under the federal private-sector privacy law, PIPEDA, a business must notify you as soon as feasible when a breach of its security safeguards creates a real risk of significant harm to you. The Office of the Privacy Commissioner of Canada (OPC) says the notice should tell you what information was affected, what the organization has done to reduce the risk and what you can do yourself.

Step 1: Check that the notice is real

Breach news is a favourite lure for phishing. Before you click anything:

1. Do not use links or phone numbers in the notice until you have confirmed it is genuine. Go to the company's website by typing the address yourself, and look for a statement or a breach page.
2. Be suspicious of any message that asks for your password, full card number, social insurance number (SIN) or a payment to "secure" your account.
3. If in doubt, call the company using a number from a bill, statement or the back of your card. The OPC notes that the notice should name a contact, often the privacy officer.

Step 2: Read it carefully and keep a copy

The OPC advises reading the notice closely and keeping it somewhere safe. Write down:

• which types of information were exposed (name, email, password, date of birth, SIN, driver's licence, banking or card details, health information);
• when the breach happened and when it was discovered;
• any free credit monitoring offered, the enrolment code and the deadline to sign up;
• the contact person for questions.

What was exposed decides what you do next. An email address alone mostly means more phishing. A SIN, date of birth and address together are what criminals need to open credit in your name.

Step 3: Secure your accounts

1. Change the password for the affected account, and for any other account where you used the same or a similar password. A password manager makes unique passwords practical.
2. Turn on multi-factor authentication, starting with email and banking. Your email account is the key to resetting everything else.
3. If card or bank details were exposed, call your bank or card issuer. Ask whether to replace the card and whether they can add extra checks to your accounts.
4. Review recent transactions and set up account alerts for purchases and transfers in your banking app.

Step 4: Add a fraud alert to your credit files

Canada has two national credit bureaus, Equifax and TransUnion. They do not share alerts, so contact both.

• Equifax Canada calls its fraud alert an Identity Alert. To place one, call 1-800-465-7166, choose your language and follow the prompts for fraud. The alert asks lenders to verify your identity, typically by calling you, before opening new credit.
• TransUnion Canada: use the contact options on transunion.ca and ask to add a fraud alert to your file.

Be ready to prove who you are. Have your ID and recent addresses handy, and a phone number you can always be reached at.

Step 5: Freeze your credit if you live in Quebec or Ontario

A credit freeze (Equifax calls it a Credit Lock) stops a bureau from sharing your credit report, score and identifying information with a lender considering new credit. Most lenders will not approve credit they cannot check, so a fraudster's application stalls. Existing creditors can still see and report on your file, and a freeze does not affect your score.

• Quebec residents have been able to place free freezes with both bureaus since February 2023, under the province's Credit Assessment Agents Act.
• Ontario residents gained the right on July 1, 2026, under amendments to the Consumer Reporting Act. Equifax Canada says the service is free and can be placed, suspended or removed online through myEquifax, by phone or by mail.
• British Columbia passed legislation in October 2025 that is expected to bring credit freezes in 2027. Elsewhere, fraud alerts are the main tool for now.

To place a freeze:

1. Create or sign in to your myEquifax account at equifax.ca and choose the option to lock your credit file, or call Equifax.
2. Do the same with TransUnion through transunion.ca. Each bureau must be frozen separately.
3. Save any confirmation, PIN or password the bureaus give you. You will need it to lift the freeze.
4. Before you apply for a mortgage, car loan, credit card or phone plan, suspend or remove the freeze at both bureaus, then turn it back on.

Step 6: Watch for misuse

1. Check your credit reports from both bureaus. Both offer free access to your own report. Look for accounts, inquiries or addresses you do not recognize.
2. Enrol in any free monitoring the breached company offers before the deadline. It is not a substitute for a fraud alert or freeze, but it can warn you sooner.
3. Stay alert for months. The OPC warns that fraudsters may wait before using stolen data. Expect targeted phishing that mentions the breach.
4. If your SIN was exposed, contact Service Canada at 1-800-O-Canada (1-800-622-6232) for advice, and the Canada Revenue Agency at 1-800-959-8281 to ask about extra protection on your CRA account.

If someone has used your identity

1. Report it to your local police and get a file number.
2. Report it to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca or 1-888-495-8501.
3. Tell both credit bureaus and ask them to correct fraudulent accounts. Give them your police file number.
4. Contact the lenders where fraudulent accounts were opened.

If you are not satisfied with the company's response

Contact the company's privacy officer first. If that does not resolve it, you can file a complaint with the OPC, or with the Commission d'accès à l'information if the business is regulated by Quebec's private-sector privacy law. Some provinces, including Alberta and British Columbia, also have their own commissioners for businesses under provincial law.

Sources

• Office of the Privacy Commissioner of Canada: What to do when you receive a privacy breach notification
• Office of the Privacy Commissioner of Canada: Identity theft
• Equifax Canada: Contact us
• Equifax Canada: Equifax Canada introduces Credit Lock to empower Ontarians (June 11, 2026)
• Ontario e-Laws: O. Reg. 168/25, General, Consumer Reporting Act
• Neo Financial: How to freeze your credit and avoid credit fraud in Canada
• Wikipedia: Credit freeze (Canada section)
• Canadian Anti-Fraud Centre: What to do if you're a victim of fraud