Data Breach Notices Are Surging. Here's How to Freeze Your Credit

In late September 2026 the Defense Department confirmed that hackers had stolen records holding the Social Security numbers of about 2.8 million living people from the Defense Manpower Data Center, according to TechCrunch's report of September 30, 2026. For anyone whose number sits in files like those, a free credit freeze at each bureau is the step that blocks new credit accounts in their name. More people are being told to freeze, but the survey evidence on whether more people actually do it is mixed: the broadest year-over-year comparison shows a drop, while two narrower readings show higher use.

Key takeaways

Since September 21, 2018, federal law has required Equifax, Experian and TransUnion to place, lift and remove freezes free of charge.
A freeze requested online or by phone must be in place within one business day, and a lift requested the same way must take effect within one hour.
In the Identity Theft Resource Center's general-consumer survey, the share reporting a freeze fell from 38.1% in 2024 to 25.8% in 2025. Other ITRC surveys found higher figures, and no current count from the bureaus or federal regulators was found, so a clear rise cannot be shown.
Each bureau has to be contacted separately, and Innovis, ChexSystems, NCTUE and LexisNexis offer their own free freezes.
A freeze does not protect existing accounts, tax refunds or medical benefits; those need separate steps.

What it means for you

The right move depends on why the question came up now.

A breach letter just arrived. Freeze at all three nationwide bureaus, enroll in any monitoring the letter offers, and get an IRS Identity Protection PIN, since a freeze does not cover tax filing. Active-duty service members can also add a free active duty alert (see the table under "What federal law guarantees").
A loan, apartment or job application is coming up. Freeze anyway, then lift it briefly at the bureau the lender uses. Federal law exempts tenant and employment screening from the freeze, as explained under "What federal law guarantees"; if a screener says it cannot pull a report, a temporary lift is free.
Parents of children under 16. A parent or guardian can place a free "protected consumer" freeze, usually by mail with proof of authority; the bureau creates a record if the child has no file.
Caregivers of adults who cannot act for themselves. Federal law lets a representative with a court order or a valid power of attorney freeze the file of an adult who is incapacitated or has a court-appointed guardian or conservator. TransUnion and ChexSystems take these requests by mail.
People already hit by identity theft. An identity theft report unlocks a seven-year extended fraud alert, in addition to the freeze.

This article is general education, not legal or financial advice; check each agency's current terms before acting.

Is freezing actually on the rise?

The exposure is rising; whether freezing is rising cannot be shown from the data available. The Identity Theft Resource Center (ITRC), a nonprofit that tracks public breach notices, counted 1,803 data compromises and an estimated 471.2 million victim notices in the first half of 2026, against 297.5 million notices for all of 2025, according to its mid-year release of July 22, 2026. One incident, at the Canvas education platform, accounted for an estimated 275 million of those notices, a total the ITRC says has no confirmed U.S. count. Even without Canvas, the remaining 196.2 million notices in six months would put 2026 on course to pass 2025. A notice count is not a head count: one person can receive several.

The behavior data point in different directions. In the ITRC's 2025 Consumer Impact Report (October 2025), an online survey of 1,033 general consumers, 25.8% said they had frozen their credit, down from 38.1% in the 2024 survey. The ITRC called this a "marked decrease" and suggested security fatigue as one reason. The same report found the opposite trend among people who had contacted the ITRC for help: 46.5% said they had frozen their credit before their incident, up from 35.0% a year earlier. And in a separate ITRC survey of 1,040 adults in November 2025, 42% of those asked about the time before a breach notice said freezing their credit was among their regular habits.

These are self-reported answers from different samples with differently worded questions, so none of them is a census, and they cannot be stacked into one trend. The broadest like-for-like comparison, the general-consumer survey, points down.

Measure (source, survey date)	Figure	Type of data
Adults who had ever frozen credit (ITRC, December 2021)	Fewer than one-third; 3% froze after a breach notice	Survey, 1,050 adults
General consumers reporting a freeze (ITRC, 2024 and 2025 surveys)	38.1% in 2024, 25.8% in 2025	Online survey, 1,033 adults in 2025
ITRC help-seekers who had frozen before their incident (2024 and 2025 surveys)	35.0% in 2024, 46.5% in 2025	Self-selected victims who contacted the ITRC
Received a breach notice in past 12 months (ITRC, November 2025)	80%	Online survey, 1,040 adults
Froze credit after their most recent notice (ITRC, November 2025)	19%	Same survey, people asked about their latest notice
Victim notices, January–June 2026 (ITRC, July 2026)	471.2 million	Count of public breach notices

The ITRC's 2021 freeze study found that 11% of respondents had never placed a freeze because they wrongly believed it would hurt their score or cost money. In the November 2025 survey, published in the ITRC's 2025 Annual Data Breach Report (January 2026), people responding to their latest notice most often changed the affected password (59.8%), changed passwords on similar accounts (53.7%) or signed up for free credit monitoring (47.1%); 19% froze their credit. Monitoring reports a new account after it appears; a freeze is meant to stop it from being opened. No current freeze counts from the bureaus or federal regulators were found in public sources as of October 10, 2026.

What federal law guarantees

A security freeze, under 15 U.S.C. 1681c-1(i), bars a nationwide bureau from releasing a credit report to a lender reviewing a new application. Section 301 of the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 made it free, and the FTC's consumer alert on free freezes confirms the start date of September 21, 2018. The bureau must place a freeze within one business day of an online or phone request, or three business days after receiving a mailed one; lifts take one hour online or by phone, three business days by mail. A freeze stays until the consumer removes it, and the FTC's freeze and fraud alert guide notes that it does not affect a credit score.

The law also lists who can still see a frozen file: companies where the consumer already has an account (for account reviews and collections), government agencies acting under court orders or collecting taxes and child support, insurance underwriters, employers, landlords and background screeners, credit monitoring services the consumer subscribes to, and identity checks that are not for granting credit. Those exemptions cover the three nationwide bureaus; the smaller agencies described below set their own terms.

	Security freeze	Fraud alert	Credit lock
Legal basis	Federal law	Federal law	Bureau product and contract
Cost	Free to place, lift and remove	Free	Varies; Experian's CreditLock comes with a paid membership
Effect on new credit	Lenders cannot see the report	Lenders can see it but must take steps to verify identity	Works much like a freeze, on the bureau's own terms
Duration	Until removed	Initial: 1 year; extended: 7 years with an identity theft report; active duty: 12 months	Set by the product's terms
Where to request	Each bureau separately	One bureau, which must notify the other two	Each bureau's own service

The FTC's 2018 alert put the trade-off plainly: locks work in a similar way but may carry monthly fees, and a freeze is the option guaranteed free by federal law. Experian's freeze center lists CreditLock as part of a paid membership. The extended alert also removes the consumer from prescreened marketing lists for five years, and the active duty alert for two.

How each nationwide bureau handles it

Equifax: online through a myEquifax account (age 18 or older) or by phone at (888) 298-0045; freezes for minors under 16 and incapacitated adults use separate request forms with proof of authority.
Experian: online with a free account, by phone at 1-888-397-3742, or by mail to Experian Security Freeze, P.O. Box 9554, Allen, TX 75013. Lifts can be scheduled with start and end dates.
TransUnion: online through the Service Center or by phone at 800-916-8800; temporary lifts can be scheduled up to 15 days ahead. Freezes for minors and incapacitated adults go by mail only, to P.O. Box 380, Woodlyn, PA 19094. TransUnion's site blocks automated access, so these details are from its credit freeze page as archived on October 3, 2026.

Illustrative example: a household with two adults and two children aged 6 and 12 wants full coverage at the three nationwide bureaus. The adults need 2 × 3 = 6 freezes, which they can place online; the children need another 2 × 3 = 6, generally sent by mail with copies of documents proving identity and parentage, such as birth certificates. That is 12 requests. Adding Innovis, ChexSystems, NCTUE and LexisNexis for the adults brings 2 × 4 = 8 more, for 20 in total.

Beyond the big three bureaus

Other consumer reporting agencies feed decisions on bank accounts, phone plans and identity checks. The ITRC's H1 2026 Data Breach Report recommends freezing at Innovis and ChexSystems alongside the big three. Each agency's freeze applies only to its own file, and the terms below are the agencies' own; ChexSystems and LexisNexis tie theirs to state law.

Agency	What its file covers	Freeze cost, per the agency	How to request
Innovis	Credit reports; the ITRC counts it as a fourth national credit bureau	No charge to add, lift or remove	Online, phone 1-866-712-4546 or mail; a 10-digit PIN arrives by mail
ChexSystems	Checking and savings account screening	No fee to place or lift, though it reserves the right to charge where a state allows	Consumer Portal, 800-887-7652 or mail; requests for someone else go by mail
NCTUE	Telecom, pay TV and utility accounts	Free to place, lift or remove	Online portal, 1-866-349-5355 or mail
LexisNexis Risk Solutions	LexisNexis Consumer Disclosure Report	No fee to apply, lift or remove	Online forms (including for minors under 16), mail or 1-800-456-1244

ChexSystems' site blocks automated access; its fee policy is from its notice of rights as archived on April 10, 2026, and its contact options from its freeze page as archived on August 31, 2026.

What a freeze will not stop

A freeze targets one crime: new credit opened in someone else's name. In the ITRC's November 2025 survey, 16% of respondents said someone had opened a new fraudulent account in their name after a breach notice, while 28% reported a successful takeover of an existing account and 23% fraudulent charges on existing accounts. A freeze does nothing for those last two, which depend on passwords, multi-factor sign-in and watching statements.

Tax refund fraud. The IRS Identity Protection PIN, a six-digit number valid for one calendar year, stops others from filing a return with your Social Security number. Anyone with an SSN or ITIN who can verify their identity can get one, fastest through an IRS online account.
Medical identity theft. The FTC's medical identity theft guide lists an Explanation of Benefits statement for services you didn't get as a warning sign, so each one is worth reading.
Scams where the victim pays. The FBI's 2025 Internet Crime Report, released on April 6, 2026, logged 1,008,597 complaints and $20.877 billion in reported losses, with investment fraud causing the largest losses. These scams usually involve no new credit application, so a freeze does not stop them.

Frequently asked questions

Does a credit freeze hurt my credit score?

No. The FTC states that a freeze does not affect a credit score, and federal law still lets you get your own report and score while it is in place. Existing lenders can also keep reviewing your accounts, because the freeze restricts who can see the file, not what lenders report to it.

Will a freeze stop prescreened credit card offers?

Not by itself. The law exempts prescreening from the freeze, so offers can keep arriving. Each nationwide bureau's freeze webpage must also let consumers opt out of prescreened offers, which is a separate request.

Can my spouse freeze or unfreeze my credit for me?

Rules differ by agency. TransUnion lets spouses add or remove freezes for each other by phone at 888-909-8872. ChexSystems requires a written request with a notarized power of attorney or notarized signed instructions from the consumer.

Must all three freezes be lifted to apply for credit?

Only the bureau or bureaus the lender will check need to be open, so it is reasonable to ask the lender which ones it uses. A lift can be set for a fixed period: TransUnion lets you schedule one up to 15 days ahead, and Experian lets you pick start and end dates.

Does a freeze on a child's file ever expire?

No. A protected consumer freeze stays until it is removed. The parent or guardian can remove it, and under federal law the child can request removal once they are 16 or older. The protected consumer route only covers requests made before a child turns 16; for a 16- or 17-year-old, each agency's own rules apply.

Setting up freezes, step by step

Create accounts and freeze online at Equifax, Experian and TransUnion; each bureau must send confirmation within five business days.
Store any PINs and logins in a password manager or another secure place; Innovis mails a 10-digit PIN, and ChexSystems sends one by mail or to its Consumer Portal.
Add Innovis, ChexSystems, NCTUE and LexisNexis if new bank, phone or utility accounts are a concern.
Mail protected consumer requests for children under 16, with copies, not originals, of identity documents.
Request an IRS Identity Protection PIN and retrieve the new one from the online account each year.
Before applying for credit, ask which bureau the lender uses and schedule a short lift there.