A breach notice can be alarming, but the response follows a simple order. Work through it calmly, and you will close most of the risk in under an hour. This how-to is part of our guide to data breaches and hacked accounts.
- STEP 01Change it
Set a new, unique password on the affected account.
- STEP 02Check reuse
Change it anywhere else you used the same password.
- STEP 03Add 2FA
Turn on two-factor login, starting with email.
- STEP 04Watch out
Expect phishing, and watch your accounts for odd activity.
Step 1: Confirm it is real
Scammers send fake breach warnings. Go to the company's site by typing its address, and look for an official notice. Do not click links in the message. Read about fake security alerts.
Step 2: Change the password
Log in directly and set a new password, using a password manager to generate a long, unique one. If the breach exposed your security questions, change those too, because they work like passwords.
Step 3: Fix anywhere you reused it
This matters most. Criminals automatically try leaked passwords on other sites, a trick known as credential stuffing. Change every account that used the same or a similar password, starting with your email and bank.
Step 4: Turn on two-factor login
Add it to the breached account, then to your other key accounts. Our list of which accounts need 2FA first gives you the order.
Step 5: Look for damage
- Check recent logins and active devices.
- Review your recovery email and phone number.
- Look at your email for forwarding rules you did not set.
- Check bank and card statements.
If something looks wrong, go to signs your account has been hacked.
Step 6: Protect your identity and money
What you do next depends on what leaked:
| Data exposed | What to do |
|---|---|
| Card numbers | Call your bank and ask for a new card |
| Bank details | Tell your bank and watch for odd activity |
| Social Security number (US) | Freeze your credit with the three bureaus |
| Passport or ID | Follow your government's guidance |
| Medical data | Check your statements and insurance letters |
In the US, IdentityTheft.gov gives a personal recovery plan. Elsewhere, look for your national consumer or cyber agency.
Step 7: Stay alert
Attackers use breach details to make messages convincing. For months after a breach, treat unexpected emails, texts and calls with suspicion, even if they mention real details about you. Learn how phishing works.
After the dust settles
Most of this pain comes from reused passwords. Once each account has its own password, the next breach becomes a five-minute job. Set up a password manager if you have not already.