Your Data Was in a Breach. Do These 7 Things Today

No panic, no expensive subscriptions — just seven calm steps, in the right order, starting with the account that guards all the others.

The email arrives on an ordinary morning: a company you once used has had a data breach, and your information was involved. The first feeling is usually a mix of anger and helplessness. Push both aside. A breach is not the end of the story — what matters is what you do in the next day or two, while the stolen data is fresh and most valuable to criminals. Here are the seven steps, in order.

Step 1: Confirm the breach from the official source

Do not trust news of a breach from a random text, email or social post — fake breach notices are themselves a common scam. Type the company's official address yourself and read its statement closely. Find out exactly what was taken: email addresses and passwords call for one response, while identity numbers, dates of birth or financial details call for a stronger one. The US Federal Trade Commission (FTC) routes people through IdentityTheft.gov/databreach precisely because the right steps depend on which type of information was exposed. Note any free credit monitoring the company offers — if it is genuinely offered, take it.

Step 2: Secure your email account first

Before touching the breached service, lock down your email. Your inbox is the master key to your digital life: password resets for banking, shopping and social accounts all land there — a criminal who controls it can undo every other fix. Give it a brand-new, long password shared with no other account, and turn on two-factor authentication. Do this first, and the steps that follow will hold.

Step 3: Change the breached account's password and turn on 2FA

Now deal with the account that was breached. Change its password to something unique — not a variation of the old one — and switch on two-factor authentication if the service offers it. Treat a breached password as public property: assume it is already in criminal hands, being tested against login pages. Two-factor authentication means a correct stolen password is not, on its own, enough to get in.

Step 4: Hunt down every account that reused that password

This is the step people skip, and the one criminals count on. Attackers take email-and-password pairs from a breach and try them, automatically, against other sites — your bank, your shopping accounts, your social media. CISA's advice to anyone who has revealed a password is blunt: if you used the same password for multiple accounts, change it for each one, and never use it again. Work through your important accounts today — a password manager makes this bearable, remembering a different password for every site.

Step 5: Expect phishing that uses the leaked data

A breach rarely ends with the breach. CISA, relaying warnings from the FTC and the UK's National Cyber Security Centre, notes that the volume of scam messages often increases after major data breaches, because stolen data makes phishing more credible: the fake bank email can now greet you by name and quote your real details. For the next few months, treat every message about the breach, your account or a refund as guilty until proven innocent. Do not click its links or call its numbers — go to the official site yourself. And remember: the real company will not call or email asking you to "verify" your information.

Step 6: Freeze your credit, or set a fraud alert, where that applies

If the breach exposed identity details — a national identity or Social Security number, date of birth, financial data — and you live in a country with a credit bureau system, act on it. In the US, the FTC explains, a credit freeze restricts access to your credit report so nobody can open a new credit account in your name — including you, until you lift it. A freeze is free to place and to lift, does not affect your credit score, and lasts until you remove it; you place it separately with each of the three bureaus: Equifax, Experian and TransUnion. The lighter option is a fraud alert, which tells lenders to verify your identity first: it lasts one year, and you contact just one bureau, which must notify the other two. Either way, check your free credit reports for accounts you do not recognise.

Step 7: Keep records, and keep watching

Save the breach notice, and note the date you changed each password, enabled two-factor authentication and placed any freeze. If something goes wrong later, this paper trail is gold — and IdentityTheft.gov can turn it into a step-by-step recovery plan. Then stay mildly watchful: scan statements for small test transactions, and treat password-reset emails you did not request as a warning sign, not an annoyance.

What NOT to do

Do not click links or call numbers inside breach-related emails and texts. They are how the Step 5 follow-up scams arrive. Type the official address yourself.
Do not pay for protection in a panic. The strongest steps above are free. If paid monitoring suits you, buy it calmly, later — not at midnight on breach day.
Do not "fix" things with the same password, or a close cousin of it. Anything resembling the leaked password should be retired forever.
Do not ignore the notice because nothing bad has happened yet. Stolen data can be sold and resold; the fraud attempt may come months later. Quiet is not the same as safe.

A breach takes your data out of your hands, but it does not take away your next move. Confirm it, lock your email, change what leaked, freeze what you can — today, while it still matters most.

The Daily Tech Watch

Saturday, October 31, 2026