After a data breach, the right move is calm and methodical: change the password for the affected account, change it anywhere else you reused it, turn on two-factor authentication and watch for suspicious activity. The exact steps depend on what was exposed, so the first job is to find out what the company says was taken.
First, confirm what actually happened
Breach notices are a favourite disguise for scammers, so do not trust a message just because it mentions a breach. If you receive an email or text about one, avoid its links. Instead, go to the company’s official website or app yourself and look for an announcement there. Reputable services generally explain what happened, what information was involved and what you should do.
Our guide on how to spot phishing emails is useful here, because fake breach alerts are designed to make you panic and click.
You can also check whether your email address appears in known leaks using a well-regarded breach-notification service. Be careful to use the service by typing its address yourself and never enter a password into such a tool.
What to do after a data breach, step by step
- Change the password on the breached account, using a new, unique one. Do this on the real website, reached by typing the address.
- Change reused passwords. If the same password, or a slight variation, is used elsewhere, change it there too, starting with email, banking and shopping accounts.
- Turn on two-factor authentication. It protects you even when a password is already in criminals’ hands. See two-factor authentication explained for how to choose a method.
- Review account settings. Check recovery email addresses, phone numbers, forwarding rules and connected apps, and remove anything you do not recognise.
- Log out of other sessions if the service lets you, so anyone already signed in is removed.
- Watch your statements and inbox for unfamiliar charges, password reset emails you did not request, or sign-in alerts.
Match your response to what was exposed
Different kinds of leaked data create different risks. This table gives a rough guide.
| Data exposed | Main risk | Sensible response |
|---|---|---|
| Email and password | Account takeover, credential stuffing | Change passwords, use unique ones, enable a second factor |
| Payment card details | Fraudulent purchases | Contact your card provider, ask about replacing the card, check statements |
| Phone number or address | Targeted scams, spam, phishing | Be sceptical of unexpected calls and messages |
| Government ID or similar numbers | Identity theft | Contact the relevant authority and consider credit monitoring options available in your country |
| Health or private messages | Privacy harm, blackmail attempts | Keep records, be wary of threats, seek advice on your rights locally |
If financial information was involved
Speed helps here, since card providers can often block a card quickly once you tell them.
Call your bank or card provider on the number printed on your card or shown on their official website. Ask what protections they offer. Rules about fraud, liability and credit freezes differ between countries and providers, so rely on them and on official consumer-protection information rather than on general advice.
If identity details were involved
Government-issued identifiers cannot be changed as easily as passwords. Look up the official guidance in your country about monitoring or restricting credit and reporting identity theft. Keep a record of every call and message, including dates, names and reference numbers.
Prepare for follow-up scams
Panic is the scammer’s friend, so take a breath. Most breaches lead to nothing worse than extra spam, and a few sensible steps keep it that way.
After a breach, criminals often use leaked details to make their messages more convincing. You might get a call from someone who knows your name and a recent order, or an email offering compensation. Remember a few rules.
- Never share codes, passwords or full card numbers with someone who contacts you first.
- Hang up and call the company back on an official number.
- Treat links in messages about the breach with suspicion.
- Be cautious of offers to “recover” lost money for a fee.
Make the next breach less painful
You cannot prevent companies from being breached, but you can limit the damage to yourself.
- Use unique passwords. A password manager makes this realistic.
- Share less. Give services only the information they truly need, and consider a separate email address for sign-ups.
- Delete old accounts you no longer use. Data that a company does not hold cannot leak.
- Keep devices updated so that your own equipment is not the weak point.
- Review your accounts regularly, including which apps have access to them.
Other practical protections can be found in the rest of our cybersecurity section.
Where to start
If you have just learned of a breach, begin with the account involved: verify the notice through the official site, change the password, and switch on a second factor. Then check where else you used that password. Those three actions handle most of the immediate risk, and you can work through the rest calmly over the following days.
Frequently asked questions
How do I know if my data was in a breach?
Check the company's official announcement, and use a reputable breach-notification service by typing its address yourself. Never enter a password into such a tool.
Do I need to change all my passwords after a breach?
Change the breached account first, then any account where you used the same or a similar password. Start with email and financial accounts.
Should I trust an email saying my account was breached?
Be cautious, since scammers imitate breach notices. Avoid its links and check the company's official website or app instead.
What if my card details were exposed?
Contact your bank or card provider using an official number, ask about replacing the card and review your statements for unfamiliar charges.
