After a Data Breach
You get the email: 'we experienced a security incident.' Your data — email, password, maybe more — is in criminal hands, and the clock is ticking. Panic helps no one; procedure helps everyone. These are the steps in order: contain, change, watch. Do them today, in this sequence.
TL;DR / Quick Fix
Quick fix: change the breached site's password immediately — and everywhere you reused it. Turn on two-factor authentication on the important accounts. Then place a fraud alert and watch your statements. Speed matters most in the first 24 hours; do these in order.
Follow these steps
- Change the breached password now. Go to the breached site and change the password immediately — before reading the full breach notice. Every hour of delay is an hour of criminal access.
- Change it everywhere you reused it. List every site where you used the same password and change each one to something unique. Reuse is how one breach becomes ten — this step stops the cascade.
- Turn on two-factor everywhere important. Email, banking, cloud storage — enable authenticator-based two-factor on each. Even with your password stolen, the second factor blocks the attacker.
- Check what was taken. Read the breach notice carefully: was it emails and passwords, or also Social Security numbers and payment data? The response scales with the data — SSNs mean freezes and alerts.
- Place a fraud alert. Contact one credit bureau for a fraud alert — it propagates to all three. If SSNs leaked, add the credit freeze too. Financial identity protection starts here.
- Watch for a month. Monitor bank statements, email login alerts, and unexpected password-reset emails for weeks. Breach fallout often arrives late — vigilance is the final step.
What NOT to do
- Do not wait to 'see what happens.' The first 24 hours decide how bad it gets — act immediately, analyze later.
- Do not change only the breached password. Reused passwords are the cascade vector — every reuse must change too.
- Do not trust breach emails blindly. Phishers mimic breach notices — go to the site directly, never via the email's links.
- Do not skip the fraud alert for 'small' breaches. Email-plus-password pairs enable credential stuffing everywhere — small breaches cascade.
Frequently asked questions
How do I know if my data was breached?
Breach-notification services let you check your email against known breaches. The breached company must also notify you directly in most jurisdictions.
Should I delete the breached account?
Not necessarily — change the password and enable two-factor first. Deletion is a separate decision; security comes first.
What if my Social Security number leaked?
Place a credit freeze at all three bureaus plus the fraud alert, and consider multi-year monitoring. SSN exposure is the serious tier.