Your Data Was in a Breach. Now What? A Step by Step Response Plan

The Email Landed. Before You Do Anything, Read What Actually Leaked

"Your data was part of a breach" covers everything from a genuine non event to a house on fire, and the correct response depends entirely on which category of data leaked. Read the notification carefully before reacting, because the order and urgency of your response changes based on the answer:

• Email address only: Expect a rise in spam and phishing attempts. Low urgency, no password action required.
• Email plus password, even if described as hashed: Assume the password is cracked already or will be shortly. Act today, everywhere that exact password is reused.
• Personal details such as name, address, birth date, or phone number: fuel for identity theft, SIM swap attempts, and convincing spear phishing that references real facts about you. Medium urgency with a long shelf life, since this data does not expire.
• Financial data such as card numbers or bank account details: high urgency in the short term, but cards are replaceable and most card fraud is refundable through standard dispute processes.
• Government ID numbers such as a Social Security number or national ID: the most serious category, because these numbers cannot simply be reissued. Mitigation here means credit freezes and ongoing monitoring, not rotation.

Step One: Contain the Password Damage Within the Hour

1. Change the password on the breached site directly, even if the company already forced a reset. Do it yourself so you know with certainty it happened and know the new value.
2. Change that same password everywhere else you reused it. This is the step that actually determines how bad the fallout gets. Attackers replay breached credential lists against hundreds of other sites automatically within hours of a list circulating, a process called credential stuffing. Every account sharing that password is on a countdown clock the moment the breach becomes public.
3. Make every replacement password unique to its site, generated rather than invented from memory. Our free password generator runs entirely in your browser and produces genuinely random strings. This is the natural moment to finally adopt a password manager if you have been putting it off.
4. Work in order of value: email first, since it can reset almost everything else downstream, then banking, then any shopping account with a saved card, then everything remaining.

Step Two: Lock the Doors That Matter, Within the Day

1. Turn on two factor authentication on your most critical accounts if it is not already active: email, banking, and anywhere money or identity documents live. Once it is on, a future breach at any of these same sites matters far less. Setup takes only a few minutes per account; our 2FA guide walks through it, and our free TOTP generator shows exactly how the codes are produced.
2. Check your full exposure history at haveibeenpwned.com by entering your email address. Most people discover breaches they never received a notification for. Every listed breach translates into one instruction: never reuse whatever password you used on that specific site again.
3. Review the breached account itself before moving on: active sessions, connected third party apps, forwarding rules if it is an email account, and recovery settings. Attackers who gained early access sometimes plant persistence mechanisms before a breach becomes public.

Step Three: Handle Identity and Money Fallout Within the Week

• If card numbers leaked, do not wait around for fraud to appear. Request a replacement card proactively, and turn on real time transaction notifications so any charge shows up the moment it happens.
• If a government ID number leaked, place a credit freeze with the credit bureaus. It is free in the United States and many other countries, and it blocks new accounts from being opened in your name until you lift it. A fraud alert is the lighter, shorter term alternative if a full freeze feels excessive.
• If a phone number leaked alongside other identity data, you have just become a better SIM swap target. Set a carrier account PIN, a five minute task with real protective value; our SIM swap guide explains exactly why this matters.
• Watch for account opening notifications you did not initiate, bills for services you never signed up for, and unfamiliar entries on your credit report over the following months.

The Part Most Advice Skips: Post Breach Phishing

Breach data does not just sit in a database somewhere. It feeds phishing campaigns built to reference real facts about you specifically: your actual old password from the leak, quoted directly ("we have your password [real old password], pay us or else"), your home address, or your recent order history. Two rules keep you safe from this follow up wave:

• An extortion email quoting an old, real password of yours is mass produced automatically from breach dumps and sent to millions of addresses at once. It does not mean your camera was hacked. Delete it, and confirm that specific old password has been retired everywhere you ever used it.
• A "security notification" arriving right after a publicized breach is frequently a fake riding the news cycle. Never log in through a link inside that email. Type the site's real address into your browser yourself instead. Full pattern recognition for this lives in our phishing guide.

The company loses the data in an afternoon. The follow up attacks target you personally for months or years afterward. Real breach response is not a single bad evening of password changes, it is the ongoing process of retiring the leaked facts, passwords, security answers, and habits, so that stale, years old data eventually stops being useful to anyone.

Turning One Bad Notification Into a Permanent Upgrade

A breach notification is genuinely the best motivation most people ever get to fix their security habits properly. The end state worth reaching, and keeping:

1. A password manager holding one unique, randomly generated password per site, with nothing memorized or reused.
2. Two factor authentication active on everything important, through an authenticator app rather than SMS wherever the option exists.
3. Passkeys adopted wherever a site offers them, since they cannot leak in any usable form even in a future server breach; our passkey explainer covers the setup.
4. A credit freeze in place if any government ID number of yours has ever leaked in any breach.
5. A quarterly ten minute review: a haveibeenpwned check, a scan of active sessions on your most important accounts, and a password health check with our strength checker.

Frequently Asked Questions

The notification says passwords were hashed, does that mean I am actually safe?

It depends entirely on which hashing method was used, information the notification almost never specifies. Modern slow hashing, bcrypt or Argon2, buys real time before a password can be cracked. Obsolete fast hashing, MD5 or plain SHA-1, can be cracked within days for most real world passwords. Since you usually cannot tell which was used, assume the worst case and rotate the password regardless. Our hashing explainer covers exactly why the difference is so large.

Should I just delete my account on the site that got breached?

If you no longer use the service, yes, a dormant account is pure ongoing liability with no upside. Rotate the password first regardless, since account deletion flows sometimes fail partway or take weeks to complete, and remember that deletion never recalls data that was already stolen before the account closed.

Is there a way to know for certain whether my specific password was cracked?

Not really, and it does not change what you should do either way, which is rotate it everywhere it was reused. Haveibeenpwned's separate Pwned Passwords tool can tell you whether a specific password appears in known cracked password lists already, which is a strong signal to never use that exact password again anywhere.

Is paying for identity theft monitoring actually worth it?

The core protections, a credit freeze, bank transaction alerts, and free haveibeenpwned checks, are free and stronger in practice than most paid monitoring services. Paid monitoring mainly adds convenience and insurance coverage after the fact, not real prevention. Put the free protections in place first, then decide whether a subscription still adds enough value for you.

My data was breached years ago. Is it too late to do anything about it now?

No. Breach data circulates for a decade or longer after the original incident, and credential stuffing attacks run continuously against old lists, not just fresh ones. If any password from that era still survives unchanged on any of your accounts today, rotating it right now still closes a door that remains genuinely open.