"Your data was in a breach." Now what?

Breach notification emails are written by lawyers. They are long, calm, and strangely good at not telling you the one thing you want to know: what should I actually do? Here is the order that puts the highest-impact steps first.

Step 0: check the notification is real

Fake breach notices are themselves a phishing technique, and they work because the emotion is already there. Do not click the link in the email. Go to the company's website directly, or check whether reputable news outlets are reporting it. A real notice will be findable without following their link.

Step 1: work out what was actually taken

This drives everything else. Breach notices usually list the data categories somewhere in the middle. Roughly in order of how much they should worry you:

• Passwords — act immediately, especially if you reused that password anywhere.
• Government ID numbers, passport or licence details — identity fraud risk, and these cannot be changed. Watch your credit.
• Full payment card details — contact your bank and get the card replaced.
• Security questions — your mother's maiden name is now public and permanently unusable as a secret.
• Email, phone and address — lower direct risk, but this is the fuel for convincing, personalised phishing.

Note the phrasing carefully. "Encrypted passwords" is reassuring; "hashed with an outdated algorithm" is not. If you cannot tell, assume the worst and change it.

Step 2: change passwords, in priority order

1. The breached service itself.
2. Any other account using that same password, or a close variant. "Summer2024!" and "Summer2025!" are the same password to an attacker.
3. Your primary email account, if it shared anything with the above. Email is the recovery path to everything.

Make each new password unique. If that sounds impossible to manage, that is precisely what a password manager is for — and this is the moment it stops being a nice-to-have.

Step 3: sign out everywhere

Changing a password does not always end sessions that are already active. Find "sign out of all devices" or "active sessions" in the account's security settings and use it. This is the most commonly skipped step and one of the most important.

Step 4: turn on strong MFA

If the account supports passkeys, use them. If not, an authenticator app is next best. SMS codes are better than nothing but are vulnerable to SIM-swap fraud, so avoid them on anything financial where an alternative exists.

Step 5: check for attacker persistence

If an account may have been accessed, resetting the password is not enough on its own. Look for:

• Email forwarding rules or filters you did not create — a classic way to keep reading your mail silently.
• Recovery email addresses and phone numbers that are not yours.
• Extra MFA methods registered.
• Connected third-party apps with access you do not recognise.
• App-specific passwords or API tokens.

Step 6: expect the follow-up scam

This is the part that catches people weeks later. Breached contact details get used to build highly believable follow-ups: a "breach support" service asking for a fee, a fake bank calling about "suspicious activity", a credit-monitoring offer with a payment form.

Rule for the next few months: you contact them, they never contact you. If your bank calls, hang up and ring the number on your card.

Step 7: for identity data, think longer-term

Where ID numbers or financial details were exposed, consider a credit freeze or fraud alert with the credit agencies in your country. It is free in many places, and far more effective than paid monitoring, which mostly tells you after the fact. Fraud using stolen identity data often surfaces months later, so stay alert past the point where it stops feeling urgent.