What Happens to Your Data in a Breach
A data breach occurs when unauthorized individuals access a company's database containing user information. Depending on what that company stored, your exposed data might include your email address, hashed or plain-text passwords, name, phone number, mailing address, or payment details.
Stolen data rarely sits unused. It is typically sold on underground markets or used directly in automated attacks. Even if only your email was exposed, that information can be used to craft targeted phishing messages or combined with data from other breaches to build a detailed profile of you.
Understanding the actual risk of what was taken — the breach notification should specify — helps you prioritize your response. A leaked email address warrants vigilance; exposed payment information or Social Security numbers require faster, more extensive action.
Check If Your Email Was Exposed
Free services like Have I Been Pwned (haveibeenpwned.com) let you enter your email address to see which known data breaches included your information. Checking this periodically — and especially after news of a large breach — helps you act before attackers do. You can also set up breach alerts so you're notified automatically if your address appears in future leaks.
For a broader look at account security habits to build year-round, see our annual digital security audit checklist.
What You Need Before You Start
What you will need
Password Manager
Generates and stores unique, complex passwords for every account so you never need to reuse one.
Authenticator App
Provides time-based one-time codes for two-factor authentication, more secure than SMS codes.
Credit Monitoring Service
Alerts you to new accounts or changes on your credit report that could signal identity theft.
Step-by-Step: Securing Your Accounts
Password Reuse Is the Biggest Risk
If you used the same password on the breached account as on other accounts — email, banking, or social media — those accounts are now at serious risk too. Attackers routinely test stolen credentials across hundreds of popular sites automatically (a technique called credential stuffing). Change every duplicate password immediately, starting with your most sensitive accounts.
Confirm the breach is real
Before taking any action, verify that the breach notification is legitimate. Check the official website of the company directly — do not click links in emails. Cross-reference news from credible technology outlets or government consumer protection sites. You can also use a reputable breach-checking tool to confirm your email was included.
Change the breached account's password immediately
Log in to the affected account and update your password right away. Create a long, random password — at least 16 characters mixing letters, numbers, and symbols. Do not use personal information such as birthdays or pet names. If you use a password manager, let it generate and save the new password for you.
Update passwords on every account that shared that password
Think carefully about where else you used the same or a very similar password. Email, banking, shopping sites, and social media accounts are priority targets. Change each one to a unique password. This step is tedious, but it is essential — attackers rely on the fact that most people reuse passwords.
Enable two-factor authentication (2FA)
Two-factor authentication adds a second verification step — usually a code sent to your phone or generated by an app — so that a stolen password alone is not enough to access your account. Enable 2FA on the breached account first, then turn it on across all your other important accounts. An authenticator app is generally more secure than receiving codes by text message.
Review account activity for unauthorized access
Most platforms provide a log of recent logins, including device type and location. Check this in your account security settings and look for sessions you do not recognize. If you find unfamiliar activity, sign out all other sessions (platforms typically offer a 'Sign out everywhere' option) and report it to the platform.
Monitor your financial accounts and credit
If financial information — card numbers, bank details, or your Social Security number — was exposed, monitor your bank and credit card statements closely for unauthorized transactions. You are entitled to free credit reports from the major bureaus; reviewing them helps you spot accounts opened in your name without your knowledge. Consider placing a credit freeze with each bureau, which prevents new credit from being opened in your name without your direct authorization. This is free and can be lifted at any time.
Watch for Breach-Related Phishing Scams
After a major breach, fraudsters send fake emails impersonating the affected company, urging you to click a link to 'secure your account.' These links lead to convincing fake login pages designed to steal your new credentials. Always navigate directly to a site by typing the address into your browser rather than clicking email links during this period.
Staying Safer Going Forward
A breach is a useful — if unwelcome — prompt to audit your broader security posture. Credential reuse and weak passwords remain the most common reason one breach leads to multiple account compromises. Building the habit of unique passwords and 2FA across all your accounts dramatically reduces this risk.
For practical, everyday device and account hygiene, our guide on security practices worth making habitual covers simple routines that compound over time. You may also want to revisit common misconceptions about online privacy — understanding what actually protects you (versus what doesn't) shapes smarter decisions. For a thorough review of all your accounts and permissions, the Online Safety From the Ground Up guide is a comprehensive starting point.
If financial data was involved in the breach, keep an eye on your credit health over the following months. Our Credit & Banking hub offers clear explanations of credit reports, freezes, and what to watch for.
The content on this site is for informational purposes only and is not a substitute for professional advice. Always consult a qualified professional for guidance specific to your situation.