Passwords leak all the time, often through no fault of yours. This guide explains how it happens and what to do. It is part of Everyday passwords.
- STEP 01Change it
Set a new, unique password on the affected account.
- STEP 02Check reuse
Change it anywhere else you used the same password.
- STEP 03Add 2FA
Turn on two-factor login, starting with email.
- STEP 04Watch out
Expect phishing, and watch your accounts for odd activity.
Something happened: start here
| Situation | Go to |
|---|---|
| A company told you about a breach | What to do after a data breach |
| You want to check for leaks | How to check if your password was leaked |
| Your email was hacked | Email recovery steps |
| You are not sure | Signs your account has been hacked |
| You typed a password into a fake site | Phishing: what to do |
How passwords get stolen
Start with what a data breach is. Once a password is out, criminals use several methods:
- Cracking stolen password data with guessing tools.
- Credential stuffing, trying leaked logins on other sites.
- Phishing, using fake login pages.
- Fake reset emails and alerts.
- Keyloggers and password stealers on your own device.
What protects you
Most of these attacks fail against three simple habits: a unique password for every account, using a password manager, and two-factor login on anything that matters. Together, they turn a breach from a disaster into a chore.
If money or identity is involved
Call your bank straight away. In the US, IdentityTheft.gov gives a recovery plan, and IC3 takes reports. Elsewhere, contact your national fraud or cyber agency.
Crypto theft moves faster and is usually final. See what to do in the next hour.