You got a breach notification email. Or you checked HaveIBeenPwned and found your email in a breach database. Either way: don't panic. Act fast, in order, and you'll significantly reduce your exposure. Here's exactly what to do.
Step 1: Confirm the breach is real (first 5 minutes)
Phishing emails often impersonate breach notifications — "Your account was compromised, click here to secure it." Before doing anything else, verify the breach independently. Go directly to HaveIBeenPwned.com and search your email. Check the breached company's official website or social media for an announcement. Don't click links in emails — type URLs directly.
Step 2: Change your password on the breached site (next 10 minutes)
Go directly to the site (don't use email links), log in if you still can, and change your password to a strong, unique one. Use our password generator to create a 16+ character replacement. If you can't log in, use the site's "Forgot Password" flow to regain access, then change it immediately.
Step 3: Change the same password everywhere you used it (next 30 minutes)
This is the most critical step most people skip. If you reused the breached password — on email, banking, shopping, work accounts, or anywhere — change it on every one of those sites too. Attackers run automated credential stuffing attacks against hundreds of sites within hours of a breach becoming public.
Use this breach as the forcing function to finally switch to unique passwords everywhere. A password manager makes this sustainable long-term.
Step 4: Enable two-factor authentication (next 20 minutes)
On the breached site and on any accounts where you just changed passwords, enable 2FA if it's available. Even if an attacker has your (now-changed) password, they can't get in without your second factor. Priority order: email accounts first, then banking, then social media, then everything else.
Use an authenticator app (Google Authenticator, Authy, or your password manager's built-in TOTP) rather than SMS-based 2FA when possible — SMS can be intercepted via SIM-swapping attacks.
Step 5: Check what data was exposed
Read the breach notification carefully. What was included? Passwords (hashed or plaintext?), email addresses, names, phone numbers, physical addresses, payment card details, social security numbers, date of birth? The type of data determines your next steps:
- ✓ Passwords only: Change them, done.
- ✓ Email + password: Change password, watch for phishing targeting your email.
- ✓ Phone number: Watch for spam calls, SIM-swap attempts. Consider a new number if targeted.
- ✓ Payment card data: Monitor your card statement, consider requesting a new card number from your bank.
- ✓ Social Security Number or national ID: Place a credit freeze immediately (free in the US at all three bureaus: Equifax, Experian, TransUnion). Monitor your credit report.
Step 6: Place a credit freeze if financial data was exposed
A credit freeze (also called a security freeze) prevents anyone — including you, until you lift it — from opening new credit in your name. It's free in the US and most other countries. It doesn't affect your existing accounts or credit score. Do it at all three major bureaus simultaneously if any financial or identity information was in the breach.
Step 7: Monitor for follow-up attacks
Data breaches often trigger a wave of targeted phishing emails. Attackers know your email (from the breach) and may send convincing fake messages from the breached company, your bank, or services you likely use. In the weeks following a breach, be especially skeptical of: unexpected account alerts, "verify your information" requests, and emails asking you to click links.
How to prevent the next breach from mattering
You can't prevent a company from being breached. What you can control: whether a breach at one site gives attackers access to all your others. The answer is simple — a unique password for every account, stored in a password manager, with 2FA everywhere. After one breach experience, most people are finally motivated to set this up. Don't let this one go to waste.