What to Do After a Data Breach: A Calm Checklist

Getting a breach notice is unsettling, but most breaches only need a few fixes. What you do depends on what leaked. An email address alone is a small problem. A password you reuse everywhere is a bigger one. Government ID numbers or card details are the most serious. Work through the steps below in order and stop when the rest no longer applies to you.

Step 1: Find out what leaked

Read the company's notice, or look the breach up in a checker like those in our Have I Been Pwned alternatives guide. Note which data types were exposed: email, password, phone, address, date of birth, ID numbers, payment cards. That list decides the rest of this checklist.

Step 2: Change the password, then fix reuse

Change the password on the breached site first. Then think about where else you used the same password, or a close variation. Attackers try leaked email and password pairs on other sites, a technique called credential stuffing. A password manager's security report will show reused passwords for you.

Step 3: Turn on two-factor authentication

Add two-factor authentication to your email first, because your email can reset everything else. Then do your bank, your main social accounts and anything that stores a card. An authenticator app or a passkey is stronger than SMS codes.

Step 4: Find accounts you forgot about

Old accounts are where reused passwords hide. If you used the same handle for years, run it through our free username search to see where it still exists. Then log in and change the password, or delete the account. Our guide to securing old accounts walks through it.

Step 5: If ID numbers or money details leaked

• Payment cards: ask your bank for a new card number and check recent transactions.
• US Social Security numbers: place a credit freeze with Equifax, Experian and TransUnion. Freezes are free by federal law and you can lift them when you need credit.
• Signs of identity theft: in the US, report and get a recovery plan at IdentityTheft.gov, run by the FTC. In Canada, see our guide on identity theft in Canada.

Step 6: Expect phishing

After a big breach, scammers send emails and texts that mention it, offer "compensation" or ask you to "verify" your account. Don't click links in those messages. Go to the company's site by typing the address yourself.

FAQ

My email was in a breach but no password. Do I need to do anything?

Not much. Watch for more spam and phishing, and make sure that email account itself has a strong password and two-factor authentication.

Should I delete the breached account?

If you don't use it, yes. Deleting it means one less place your data sits. Download anything you want to keep first.

Can WhatsMyName Apps check my email for breaches?

Not yet. The email breach check is coming soon. The username search is live today.

A note on responsible use

This checklist is for your own accounts. This is general information, not legal or financial advice. For a case of identity theft, follow the official guidance for your country.