What to Do After a Data Breach

Here is what to do after a data breach: confirm which company was breached and what data leaked, change the exposed and reused passwords starting with your main email, turn on MFA, call your bank if card details were involved, and watch for follow-up scams for at least a week. Do not start by clicking every "check your leak" link you see. The FTC's IdentityTheft.gov recovery guidance also matches the steps to the type of exposed information and stresses contacting the relevant organizations quickly.［1］

Not every breach is equally serious. An exposed email address, password, card number, or identity document requires a different response order. For the habits that limit the damage of the next breach, see the complete online security guide.

Key Takeaways:

• After a data breach, confirm the source and the type of exposed data before acting.
• An exposed email address, password, card number, or identity document each calls for a different response order.
• Main email, reused passwords, financial accounts, and cloud storage come first; then turn on MFA and revoke old sessions.
• For the following week, watch closely for fake support calls and follow-up phishing.

What to do after a data breach in the first 10 minutes

Do not stop at "your data was leaked." Confirm:

• which company or platform was breached;
• whether the exposed data includes email, phone number, password, address, payment card, or ID document;
• whether passwords were plaintext, hashed, or unclear;
• whether there is an official notice or reliable media report;
• whether the notice asks you to click a login link.

If the notice came by email, open the official website or app manually instead of clicking the email button.

Within 1 hour: change the highest-risk accounts first

Use this order:

1. Primary email;
2. Accounts using the same or similar password;
3. Banks, payment apps, and shopping platforms;
4. Cloud storage and photo backup;
5. Social media;
6. Work accounts.

NIST's current guidelines, SP 800-63B-4, require services to reject new passwords that appear on lists of compromised passwords.［2］If you reused a password, change every account that used it.

---

Within 24 hours: enable MFA and revoke old sessions

After changing passwords, sign out of all devices, revoke suspicious sessions, and check recovery email, phone number, backup codes, and third-party app access.

Email deserves special attention. Some attackers do not change the password immediately after gaining access. Instead, they quietly set up forwarding rules and keep watching bills, codes, and reset emails.

What if a payment card or ID document was exposed?

For a payment card: contact the bank, freeze or replace the card, enable transaction alerts, and review recent statements.

For identity documents: keep the notice as evidence and watch for loan, payment, carrier, and real-name account activity. Identity theft procedures vary by region, but FTC IdentityTheft.gov gives step-by-step recovery guidance.［1］

How do you spot signs of a data breach and find leaked data?

You may never receive a breach notice. Treat these as signs of a data breach that affects you:

• password reset emails, sign-in alerts, or MFA codes you did not request;
• charges, withdrawals, or new bills you do not recognize, or a regular bill that suddenly stops arriving;［3］
• accounts in your name that you never opened;［3］
• contacts telling you they received odd messages from your email or social account.

To find leaked data, start with the password manager you already use. Google Password Checkup flags saved passwords that are exposed, weak, or reused,［4］ and the iPhone Passwords app gives similar alerts, explained in what a data leak warning on iPhone means. To check an email address against public breach lists, follow how to find leaked passwords, and open the checking tool by typing its address yourself.

For the next 7 days: watch for follow-up scams

After a breach, scammers may pretend to be "support," a "bank," or a "platform security team." They may quote your email, phone number, or order details accurately to sound legitimate.

Remember three rules:

• Do not share verification codes.
• Do not install remote-control software.
• Do not sign in from SMS or email links.

For more warning signs, read phishing warning signs.

Summary

• After a data breach, confirm the type of exposure before acting.
• Primary email, reused passwords, financial accounts, and cloud storage are highest priority.
• After changing passwords, turn on MFA, sign out old sessions, and check recovery methods and forwarding rules.
• For the next week, watch closely for fake support and follow-up phishing.

FAQ

Is it serious if only my email address leaked?

Yes, but it is usually not the highest-risk breach. It can lead to spam, phishing, and credential stuffing attempts, so check for reused passwords.

Should I change a password if only the hash leaked?

Yes. You cannot know the hash strength, salting method, or attacker resources. Changing it is safer.

Can I remove my email from the dark web?

Usually not completely. What you can do is change passwords, turn on MFA, monitor accounts, and reduce future exposure.

Is every data breach notice real?

No. Confirm through the official website, app, official announcement, or reliable reporting before clicking any login link in a notice.

Should I handle a work account breach myself?

No. Notify your company's IT or security team immediately because attackers may use your account to target coworkers.

---

Disclaimer: This article is general security education and does not replace advice from your bank, platform, company security team, or legal professionals.

Sources

［1］FTC — IdentityTheft.gov: https://www.identitytheft.gov/ ［2］NIST — Digital Identity Guidelines: Authentication and Authenticator Management, SP 800-63B-4: https://pages.nist.gov/800-63-4/sp800-63b.html ［3］FTC — What To Know About Identity Theft: https://consumer.ftc.gov/articles/what-know-about-identity-theft ［4］Google Account Help — Change compromised passwords in your Google Account: https://support.google.com/accounts/answer/9457609

Sources checked 4 October 2026.

---

Related Articles:

• Check whether your passwords have leaked
• How to remove your email from the dark web
• Complete online security guide