Your Password Was in a Data Breach - Do This Now

The email arrives - From the company itself, from Have I Been Pwned, or from your browser's password-check feature: your credentials were in a data breach. What you do in the next hour matters more than anything the breached company does in the next year. Breached credentials get packaged into combo lists and replayed against other sites fast, so the goal is simple: make everything the attackers now know about you worthless before they use it.

Here's the exact order of operations. Work the list top to bottom - It's arranged by how quickly each item can hurt you.

Step 1: Change the breached password - And every reused copy

Change the password on the breached account first, from a device you trust. Generate a fresh random one with a password generator rather than inventing a variation - Attackers explicitly try mutations like OldPassword2026! because humans "change" passwords by decorating them.

Then the step most people skip: change that same password everywhere else you ever used it, including close variants. This matters more than the original breach. Automated credential stuffing replays leaked pairs against hundreds of other services within days, and it only works on reused passwords. One breach plus reuse is how people lose ten accounts in a week.

While you're in the account's settings, look for a "sign out of all sessions" or "log out other devices" option and use it - A changed password doesn't always evict someone who already logged in.

Step 2: Lock down your email before anything else

If the breached password was your email password - Or the same one - Stop and fix email first. Your inbox is the master key: nearly every other account resets its password via email. An attacker who controls it doesn't need any of your other passwords; they can simply request resets.

Do all of this in your email account's security settings:

• Change the password to a strong unique one, and end all other active sessions.
• Turn on two-factor authentication if it isn't already on.
• Check for attacker persistence: unfamiliar forwarding rules, filters that auto-delete or hide security alerts, added recovery emails or phone numbers, and connected apps you don't recognize. These are the standard tricks for keeping quiet access after a password change.

Step 3: Find out what else is exposed

Check your email addresses at haveibeenpwned.com, which indexes billions of breached accounts and tells you which breaches included which data types. To test the passwords themselves, our password breach check compares each one against the same leak corpus without ever sending the full password. This turns panic into a to-do list: every breach listed for your address means the password you used on that service at that time should be considered public, along with whatever else leaked.

What leaked determines what happens next:

Step 4: Turn on two-factor authentication where it counts

Every account on today's cleanup list should come out of it with a second factor enabled - Starting with email, banking and anything that stores a payment method. 2FA is the difference between "my password leaked" being an emergency and being a non-event: Microsoft's long-cited finding is that multi-factor authentication blocks over 99.9% of automated account-compromise attacks.

Prefer an authenticator app over SMS where the choice exists (SIM swapping makes texted codes the weakest option). If you're curious what's happening under the hood of those six-digit codes, our 2FA code generator demonstrates TOTP live in your browser. And save each account's backup codes when you enable 2FA - In your password manager, not in a screenshot on the breached device.

Step 5: Handle financial and identity fallout

If the breach included payment or identity data, extend the cleanup beyond passwords:

• Cards: tell your bank, get the card reissued, and skim statements for small "test" charges - Fraudsters verify cards with tiny amounts before selling them.
• Credit: if SSN or government-ID data leaked, freeze your credit with Equifax, Experian and TransUnion. It's free, takes minutes each, and blocks the new-account fraud that makes identity theft expensive. Unfreeze temporarily whenever you actually apply for credit.
• Phone: if your number leaked alongside identity data, add a security PIN with your carrier to resist SIM-swap attacks. Make it random - A PIN generator beats your birth year, which is likely in the same breach.
• Ongoing fraud: if you find actual misuse, in the US file a report at identitytheft.gov, which generates a recovery plan and the documentation banks will ask for.

Step 6: Expect the second wave - Phishing

Breach data has a second life: personalization fuel. In the weeks after a major breach, victims receive convincing emails referencing the breach itself - "As a precaution, verify your account" - Or using leaked details (your name, plan type, partial card digits) to establish false trust. Some impersonate the breached company offering "free protection."

Treat every security-themed message about a breached service as hostile until proven otherwise, and never log in through links in email - Go to the site directly. The full field guide to these tricks is in our phishing protection guide.

Rule of thumb: after a breach, the real danger usually isn't the hacker who stole the database - It's the thousand people who bought it and the phishing wave that follows.

Step 7: Turn cleanup into permanent immunity

You're already resetting passwords; spend one extra hour making this the last stressful breach you experience.

• Adopt a password manager and let it generate a unique random password for every account, so any future breach is contained to a single site by construction. Our password manager guide covers choosing and migrating.
• Use a passphrase for the master password - The one secret you must remember should be long, random and memorable, which is exactly what Diceware-style word phrases are built to be.
• Fix security questions. Your mother's maiden name is unchangeable and increasingly public. Fill answer fields with random strings stored in your manager - Nothing requires the answers to be true.
• Stop rotating on a calendar. Modern NIST guidance says to change passwords when there's evidence of compromise - Like today - Not on a schedule, because forced rotation breeds weak patterns. The reasoning is unpacked in how often you should change your password.

FAQ

How do I know if my password was actually in a breach?

Check your email address at haveibeenpwned.com, and heed the built-in warnings from Chrome, Safari, Firefox and most password managers, which screen your saved logins against known-breached databases. Notification letters from companies are real too - But verify by going to the company's site directly, since fake breach notices are a phishing staple.

My password was leaked but it was hashed. Am I safe?

Safer, not safe. Hashes can be cracked offline - Weak and reused passwords fall quickly, and if the site used a fast algorithm like MD5, even decent passwords are at risk. Since you can't verify how competently a site hashed, treat any breached password as burned and replace it everywhere it was used.

Should I pay for identity theft protection after a breach?

Usually not. The highest-value protections are free: credit freezes at the three bureaus, 2FA, unique passwords and your own statement review. Paid monitoring mostly alerts you after the fact. If the breached company offers free credit monitoring, accept it - But the freeze is what actually blocks new-account fraud.

The breach happened years ago. Is it still a problem?

Yes. Combo lists never expire - Credentials from decade-old breaches are still replayed in stuffing attacks today, because attackers bet (correctly) that many people never changed anything. If a password from that era is still in service anywhere, retire it now.

Can I sue or get compensation for a data breach?

Sometimes - Large breaches often produce class-action settlements paying small cash amounts or providing monitoring, and residents of some jurisdictions (under GDPR, CCPA and similar laws) have stronger claims. Watch for legitimate settlement notices, but treat unsolicited "claim your breach compensation" messages skeptically: scammers impersonate settlement administrators too.