What to Do After a Data Breach: A Beginner’s Security Checklist

A data breach can expose information such as email addresses, usernames, passwords, phone numbers, addresses, payment information, or other personal data.

However, every data breach is different.

The correct response depends on exactly what information was exposed.

If only an email address was included, your response may be different from a breach involving passwords, banking information, government identification, or other sensitive personal data.

This beginner-friendly guide explains what to do after a data breach, how to secure affected accounts, when to change passwords, how to review suspicious activity, and when additional identity-protection steps may be appropriate.

1. Confirm That the Breach Notice Is Real

Scammers sometimes use real data breaches as an opportunity to send fake security messages.

Before clicking anything in a breach notification:

Check who sent the message
Look carefully at the sender's email address
Avoid unexpected links
Do not enter passwords through the message
Open the company's official website or app yourself
Look for an official breach notice or security announcement

A message saying:

“Your account was breached. Click here immediately to secure it.”

should not automatically be trusted.

Verify independently first.

2. Find Out What Information Was Exposed

This is one of the most important steps.

Look for the company's official breach notice.

Try to determine whether the exposed information included:

Email address
Username
Password
Password hash
Phone number
Home address
Date of birth
Payment card information
Bank information
Government identification
Security questions
Other personal information

Your response should be based on the actual exposed data.

Do not assume that every type of information was compromised unless the breach notice says so.

3. Change the Password for the Affected Account

If the password associated with the breached account may have been exposed, change it.

Use the company's official website or app rather than a link in an unexpected email.

Create a password that is:

New
Unique
Not used on another website

Google recommends changing unsafe passwords when its Password Checkup identifies them as compromised.

Do not simply add a number to the old password.

For example, changing:

Summer2025!

to:

Summer2026!

is not a strong response to a known compromise.

4. Change Reused Passwords on Other Accounts

This step is critical.

If you used the same password on multiple websites, change those accounts too.

Attackers may try stolen email-and-password combinations on:

Email accounts
Shopping accounts
Social media
Banking services
Cloud storage
Streaming accounts
Other websites

This is sometimes called credential stuffing.

The safest approach is to use a unique password for every important account.

5. Prioritize Your Email Account

Your email account deserves special attention.

Why?

Because email is often used to reset passwords for other services.

If someone gains access to your primary email account, they may be able to attempt password resets elsewhere.

Review:

Your email password
Recent sign-ins
Recovery email
Recovery phone number
Forwarding rules
Connected applications
Unknown devices

If anything looks unfamiliar, secure the account immediately.

6. Enable Multi-Factor Authentication

After changing important passwords, enable multi-factor authentication where available.

MFA requires another form of verification in addition to a password.

CISA recommends MFA because it adds meaningful protection even if a password becomes exposed.

Options may include:

Authenticator app
Security key
Passkey
Device prompt
SMS code

Where possible, stronger phishing-resistant methods such as passkeys or security keys may provide additional protection.

7. Review Recent Account Activity

Changing a password is important, but you should also check whether the account was already used by someone else.

Review recent activity for:

Unknown sign-ins
New devices
Password changes
Recovery-information changes
Messages you did not send
Security-setting changes
Unknown connected apps

Google recommends reviewing recent security events when you suspect account compromise.

Microsoft similarly provides recent-activity information and recommends securing the account when unfamiliar activity appears.

8. Sign Out Unknown Devices or Sessions

If the account provides a device or session list, remove anything you do not recognize.

Do not assume a password change always removes every active session immediately.

Review:

Phones
Tablets
Browsers
Computers
Smart devices
Third-party applications

Sign out anything suspicious.

9. Check Recovery Information

An attacker who accesses an account may try to change recovery options.

Review:

Recovery email
Recovery phone
Security questions
Backup codes
Trusted devices

Make sure the information belongs to you.

Remove anything unfamiliar.

10. Review Connected Apps and Services

Some services allow third-party apps to access account information.

Check connected applications and remove ones that:

You do not recognize
You no longer use
Request excessive access
Were added around the time of suspicious activity

A password change may not automatically remove every connected application's access.

11. Use a Password Manager

A password manager can make unique passwords much easier to maintain.

It can help you:

Generate strong passwords
Store unique credentials
Reduce password reuse
Autofill logins
Identify weak or reused passwords

The goal is not merely to create complicated passwords.

The goal is to avoid using the same password everywhere.

12. Check Whether Other Accounts May Be Exposed

A breach notification may identify only one company, but your reused credentials can affect other accounts.

You can also use reputable breach-notification services to see whether your email address has appeared in known breach data.

Remember:

A breach lookup tells you that information appeared in known breach data.

It does not prove that every account using that email has been hacked.

Use the information as a reason to review account security.

13. Be Ready for More Phishing After a Breach

Exposed personal information can make phishing messages more convincing.

For example, a scammer may already know:

Your name
Email address
Phone number
Company you use

That does not mean the message is legitimate.

Be especially cautious with messages claiming:

Your account needs verification
You must reset a password immediately
You are owed breach compensation
Your bank needs confirmation
You must provide a verification code
You need to download a security tool

Open the official website yourself instead of following an unexpected link.

14. Do Not Give Anyone a Verification Code

One-time authentication codes should remain private.

A legitimate support agent should not unexpectedly ask you to send them a login verification code.

If someone asks for:

SMS code
Authenticator code
Recovery code
Security-key approval

treat the request with caution.

These codes may be the last barrier preventing account takeover.

15. If Payment Card Information Was Exposed

If a breach involved payment card information, monitor the affected account carefully.

Review:

Recent transactions
Pending charges
Unrecognized purchases

Contact the card issuer using an official number if you see suspicious activity or if the breach notice recommends replacing the card.

Do not use a phone number contained in an unverified breach email.

Use the number on your card, official banking app, or official website.

16. If Bank Information Was Exposed

A breach involving bank-account credentials, online banking passwords, or other sensitive financial information deserves immediate attention.

Contact your financial institution directly.

Ask what actions they recommend.

This may include:

Password change
Monitoring
Account restrictions
Replacement credentials
Additional fraud controls

Do not delay if unauthorized transactions are already appearing.

17. If Sensitive Identity Information Was Exposed

Some breaches involve information beyond email addresses and passwords.

Examples include:

Government ID number
Social Security number
Date of birth
Driver's license information
Tax information

This creates identity-theft risk.

For U.S. consumers, the FTC says a credit freeze can make it harder for identity thieves to open new accounts in your name.

The appropriate identity-protection steps depend on your country and the type of information exposed.

18. Understand Credit Freezes

A credit freeze restricts access to your credit report.

In the United States, a freeze can make it harder for someone to open a new credit account using your identity.

The FTC states that credit freezes are free and can be useful after identity theft or a data breach.

A freeze does not mean you can never apply for credit again.

It can be temporarily lifted when needed.

19. Understand Fraud Alerts

A fraud alert is different from a credit freeze.

It tells businesses checking your credit that they should take additional steps to verify your identity.

For some people, a fraud alert may be appropriate after suspected identity theft or exposure.

The best option depends on the situation.

20. Monitor Financial Statements

After a breach involving sensitive personal or financial information, review:

Bank statements
Credit card statements
Payment apps
Loan accounts
Other financial activity

Look for small unfamiliar transactions too.

Attackers may sometimes test stolen payment information with smaller charges before attempting larger ones.

21. Watch for New Accounts You Did Not Open

Identity theft can involve more than unauthorized purchases.

Watch for:

Credit cards you did not apply for
Loans you did not request
New phone accounts
Unknown utility accounts
Debt-collection notices
Unexpected credit inquiries

Investigate anything you do not recognize.

22. Save the Official Breach Notification

Keep a copy of the legitimate breach notice.

It may contain important information such as:

Date of the breach
Type of information exposed
Company contact information
Free monitoring services
Recommended security steps
Deadlines

This can be useful if problems appear later.

23. Be Careful With Free Credit Monitoring Offers

Some organizations provide identity or credit monitoring after serious breaches.

If the offer is legitimate, it may be useful.

However, scammers may also imitate these programs.

Go to the company's official breach-information page rather than using an unexpected link.

Read:

What service is being offered
How long it lasts
What information you must provide
Whether payment will be required later

Do not enter identity information into a site you have not verified.

24. Check Your Devices if Account Activity Looks Suspicious

Sometimes stolen credentials come from a breach.

Other times, suspicious account activity may be connected to malware on a device.

If you also notice:

Malware warnings
Browser redirects
Unknown software
Security tools disabled
Strange pop-ups

scan the device.

Microsoft recommends clearing malware from a PC when recovering a hacked or compromised Microsoft account.

25. Do Not Change Important Passwords on a Device You Believe Is Infected

If you suspect credential-stealing malware, use a trusted device for important password changes when possible.

Otherwise, a malicious program could potentially capture the new password too.

First investigate the suspicious device.

Then secure accounts from a trusted environment.

26. Update Your Devices

Keep:

Windows
Browsers
Phones
Applications
Security software

updated.

CISA recommends keeping systems current with security patches as a basic exposure-reduction measure.

A data breach itself may not have been caused by your device, but good device security reduces other risks.

27. Check Password-Security Alerts

Browsers and password managers may alert you when saved credentials appear in known breach data.

Take those warnings seriously.

Do not merely delete the saved password entry.

Change the password on the actual affected website.

Google advises changing unsafe passwords identified by its Password Checkup.

28. Be Careful With Security Questions

If answers to security questions were exposed, change them where possible.

Avoid answers that are easy to discover through:

Social media
Public records
Family information
Personal websites

Some users treat security-question answers like additional passwords by using answers that are not publicly guessable.

Store them securely if necessary.

29. Watch Your Email for Password-Reset Attempts

After a breach, you may see unexpected password-reset messages.

Do not automatically click them.

Instead:

Open the service directly.
Check account security.
Review recent activity.

If you did not request the reset, someone else may be attempting account access.

30. Be Cautious With Phone Calls

A scammer may call and claim to represent:

The breached company
Your bank
Microsoft
Google
A credit-monitoring company
Government authorities

Do not trust the caller simply because they know your name or email address.

Data from a breach may give scammers enough information to sound convincing.

Hang up and contact the organization using an official number.

31. Do Not Pay for “Data Removal” Without Verification

After public breaches, you may see services claiming they can:

Erase leaked information instantly
Remove every breach record
Guarantee no identity theft
Recover stolen passwords

Be skeptical of guarantees.

Once information has been copied by attackers, no company can necessarily retrieve every copy.

Focus on reducing future risk instead.

32. Consider Replacing an Exposed Password Completely

Do not create a new password based on the old one.

Avoid patterns such as:

MyPassword1

MyPassword2

MyPassword3

A new credential should be genuinely different.

A password manager can make this much easier.

33. Check Important Accounts First

If many accounts need attention, prioritize.

Start with:

Primary email
Banking
Password manager
Microsoft/Google/Apple account
Cloud storage
Social media
Shopping accounts
Less important services

Securing the email account first is particularly important because it may be used for password recovery elsewhere.

34. Do Not Panic if Only Your Email Address Was Exposed

An exposed email address is not the same as an exposed password.

Your email may already be publicly known.

However, after an email-address breach, you may receive more:

Spam
Phishing
Scam messages
Fake breach notices

Remain cautious.

Do not change every account password solely because an email address appeared in a breach unless there is additional reason.

35. What If the Company Says Passwords Were Hashed?

A hashed password is not the same as a plain-text password.

Hashing is designed to protect stored passwords.

However, weak passwords or weak hashing configurations can still create risk if attackers obtain password hashes.

If the breached company recommends a password change, follow that advice.

If you reused the same password elsewhere, changing reused passwords is also sensible.

36. What If You No Longer Use the Breached Account?

If the service allows it, you may choose to:

Change the password
Remove unnecessary stored information
Delete the account

Before deleting an account, make sure you do not need:

Receipts
Purchase history
Files
Subscription information
Recovery access

Deleting an old unused account can reduce the amount of personal information you leave online.

37. Review What Information Companies Store About You

A breach can be a useful reminder to reduce unnecessary stored data.

For accounts you keep, consider whether they need to store:

Old addresses
Saved cards
Phone numbers
Personal documents

Remove unnecessary information where the service allows it.

Data that is not stored cannot be exposed from that account later.

38. Avoid Password Reuse Going Forward

Password reuse is one of the biggest reasons a single breach can affect multiple accounts.

Going forward:

Use unique passwords
Use a password manager
Enable MFA
Prefer passkeys where available

This turns a future breach into a smaller problem.

39. Keep Recovery Codes Safe

If you enable two-factor authentication, some services provide recovery codes.

Store them securely.

Do not keep the only copy:

In an unsecured text file
In a public cloud document
In an email draft with no extra protection

Recovery codes can sometimes bypass the normal second authentication factor.

Treat them like passwords.

40. A Beginner’s Data Breach Checklist

After learning that your information was involved in a breach:

41. What You Usually Do Not Need to Do

A data breach does not automatically mean you need to:

Replace your computer
Change every password you have ever used
Cancel every credit card
Reset your phone
Delete every online account

Your actions should match the information exposed.

A thoughtful response is better than panic.

42. Final Verdict

A data breach is not automatically the same as an account takeover or identity theft.

However, it is a warning that some of your information may now be available to people who should not have it.

Start by verifying the breach and identifying exactly what was exposed.

If passwords were involved, change them and replace reused passwords.

Protect your email account, enable multi-factor authentication, review recent activity, and remove unfamiliar devices or connected applications.

If financial or sensitive identity information was exposed, monitor your accounts closely and consider additional protections appropriate to your country.

Most importantly, use the incident to improve long-term security.

Unique passwords, MFA, careful phishing awareness, updated devices, and reduced storage of unnecessary personal information can make future breaches much less damaging.

Guide note: This article reflects FTC, CISA, Google, and Microsoft security guidance available in August 2026. Identity-theft and credit-protection procedures vary by country. Follow the official breach notice and the official consumer-protection guidance for your location when highly sensitive identity or financial data is exposed.