It usually starts with one of two emails. Either a company writes to tell you its customer database was breached, or a friend sends you a link to a site called Have I Been Pwned, where you type in your address and get back a cheerful red banner that says: “Oh no — pwned!”
Neither message tells you what to actually do next. So let’s fix that. A data breach is mostly someone else’s failure that becomes your chore — but it is a short chore, and doing it properly now saves you from the much longer chore of untangling fraud later.
First, find out what actually leaked
Not every breach is equal. Your email address alone leaking is a nuisance. Your email plus a password is a problem. Your email plus a government ID number is a genuinely serious situation. The response should match the exposure, so step one is checking what was in the breach.
If the company sent you a notice, read it properly — it usually says which types of data were involved. If you found out from a friend, or you just want to check, go to Have I Been Pwned, type in your email address, and read the results. For each breach listed, the site shows what kinds of data were exposed: email addresses, names, passwords, phone numbers, physical addresses, and so on.
The password detail matters most. If the listing shows passwords were exposed — even hashed ones — treat them as compromised and change them. Hashed just means the thief has to do some extra work first. Plenty of leaked hashes get cracked within days.
The password you reused is the real casualty
The single most valuable thing attackers pull from breaches is not any one account. It’s your password habits. If the password that leaked is also your password for email, shopping, or banking, every one of those accounts is now exposed — and this is where breaches turn into actual account takeovers.
So: change the password on the breached service first. Then change it everywhere else you reused it. Yes, all of them. This is the boring, time-consuming part, and it is also the part that prevents nearly all of the damage.
Make the replacements unique this time. A password manager makes this painless — it generates and remembers a different strong password per site, so the next breach only ever costs you one account. The Have I Been Pwned site itself nudges you toward this, and it’s genuinely the best single upgrade most people can make to their security.
Now expect a wave of phishing
There is a pattern that follows nearly every large breach: scammers buy or download the leaked data and start sending targeted phishing emails and texts. Because they now know your name, your email, maybe your phone number or address, the messages look far more convincing than generic spam.
The rule for the next few months: be extra suspicious of anything asking you to click a link, “verify” your account, or urgently hand over information — especially anything referencing the breached company. Scammers love impersonating the company that was just breached.
And one bit of paranoia that pays off: never click the link inside a breach notification email. Go to the company’s website directly by typing the address yourself. A breach notice is the perfect cover story for a phishing attack.
Turn on two-factor authentication for your important accounts
A data breach is a good reason to finally enable two-factor authentication (2FA) on the accounts that matter: your email first, then banking, cloud storage, and anything tied to money or identity. Even if your password leaks again tomorrow, 2FA means the thief still can’t get in without the second factor.
Email comes first for a simple reason: your email account is the master key to your online life. Nearly every other service lets you reset its password through your email. If someone controls your inbox, they can reset their way into almost everything else. Protect it with 2FA, and use an authenticator app rather than SMS codes when you have the choice — it’s harder to intercept.
If sensitive personal data was exposed, freeze your credit
This one applies when the breach included the kind of data used for identity theft: social security numbers, tax IDs, full financial account details. In that case, the US Federal Trade Commission recommends you act on the credit side, not just the password side.
The two tools are a fraud alert and a credit freeze. A fraud alert tells creditors to contact you before opening new accounts or changing existing ones — you only need to set it with one of the three major credit bureaus (Equifax, Experian, TransUnion), and it notifies the other two. The initial alert lasts one year and can be renewed. A credit freeze goes further: it blocks potential creditors from seeing your credit report at all, which makes it far less likely someone can open accounts in your name. For a freeze, you need to contact each bureau separately.
Both are free, and both are described step by step at IdentityTheft.gov/databreach, the FTC’s page for exactly this situation. If you take the company up on any free credit monitoring it offers, treat that as a supplement, not a substitute.
If you’re outside the US, check your own country’s consumer protection agency for the equivalent of a credit freeze or fraud alert — the password and 2FA steps above apply everywhere, but credit systems work differently by country.
The step almost everyone skips: set up a breach alert
You checked whether your email was in a breach — once. Breaches keep happening, and you won’t hear about most of them. The last move is to make the checking automatic.
Have I Been Pwned has a free notification service: subscribe your email address and it emails you if that address ever turns up in a newly disclosed breach. It takes about two minutes to set up, and it turns the whole process from something you remember to do into something that comes to you. Mozilla Monitor offers a similar free alert service, built on the same breach data.
Here’s the honest truth about data breaches: you can’t prevent the next one. The companies holding your data will get breached again — it’s your data, but it’s their security. What you can control is how quickly you hear about it and how small your exposure is when it happens. Unique passwords, 2FA on email and banking, a credit freeze when the exposure is serious, and an automatic alert watching the rest. That covers almost everything a breach can throw at you, and it takes one focused afternoon to set up. We’ve got more practical safety guides in our Online Safety section.
Comments 6