What to do after a data breach
A company you use has been breached, or you've had a warning that your details leaked. Work through these steps in order; most take a few minutes.
1. Check what actually leaked
Read the company's own notice, ideally on its website rather than via a link in an email, because breach news is a favourite subject for phishing. It should say whether passwords, payment cards, addresses or ID numbers were exposed. You can also look up your email address at Have I Been Pwned, a long-running free service that tracks known breaches.
2. Change that password, and every place you reused it
Change the password on the breached site first. Then, crucially, change it on every other site where you used the same or a similar password: attackers try leaked passwords everywhere else, often within hours. Use a new random password for each site, and let a password manager remember them.
3. Turn on two-factor authentication
Two-factor authentication (an authenticator app, a security key, or a passkey) stops someone who has your password from getting in. Turn it on for the breached account and, above all, for your email, which can be used to reset everything else. Prefer an app or security key over text messages where you can.
4. Check the account for changes
- Sign out of all other sessions or devices, if the site offers it.
- Check the recovery email and phone number haven't been changed.
- Look for forwarding rules in your email that you didn't create; attackers use them to watch your inbox quietly.
- Review recent orders, payments and messages.
5. Watch out for follow-up scams
After a breach, criminals send convincing emails, texts and calls that mention the breach or use your real details. Don't click links or give codes to anyone who contacts you. Go to the company's site or app directly, or call the number on your card or statement.
6. If financial or identity details leaked
- Card numbers: ask your bank for a replacement card and watch your statements.
- Government ID numbers (such as a US Social Security number): consider a credit freeze. In the US it's free at each of the three credit bureaus, Equifax, Experian and TransUnion, and stops new credit being opened in your name until you lift it.
- Signs of identity theft: report it to your national fraud agency. In the US that's IdentityTheft.gov.
Next time
Breaches will keep happening, but their damage is mostly limited to the one site involved if every account has its own random password and two-factor authentication. That's the whole goal: one leak, one password to change.