A breach notice can be unsettling, but you can reduce the chance that exposed information is reused against you. Read the notice carefully to learn what information was involved, when the incident occurred, and whether the company recommends specific action. Use the company’s official website or a phone number you already trust; scammers sometimes imitate breach notices to collect passwords or payment details.
Change exposed and reused passwords
If a password may have been exposed, change it immediately on the affected service. If you reused that password elsewhere, change those accounts too, starting with email, banking, and accounts used for password recovery. Use a unique password for each account; a reputable password manager can help create and store them. Do not follow a password reset link from an unexpected message unless you have independently verified it.
Turn on multi-factor authentication
Enable multi-factor authentication wherever it is offered, especially on email, financial, cloud, and social accounts. This adds another step beyond a password when signing in. Prefer an authenticator app or security key where supported, and store backup codes somewhere safe. Never share a one-time code with someone who contacts you unexpectedly, even if they claim to be technical support.
Review account activity and recovery settings
Check recent logins and devices on the affected service. Google’s account recovery guidance recommends reviewing unfamiliar devices and security events, then signing out of sessions you do not recognize. Confirm that the recovery email and phone number still belong to you, and remove third-party app access you no longer need. If you cannot access an account, use its official recovery process rather than paying someone who promises to recover it.
Respond based on the information exposed
If financial information was involved, contact the bank or card issuer using the number on the card and monitor transactions. If government identification or other identity data was exposed, use the appropriate official identity-theft service for your country. In the United States, the FTC directs people to IdentityTheft.gov for a personalized recovery plan. Follow the breach notice’s recommendations, but verify that any offered credit monitoring or support service is legitimate before enrolling.
Watch for follow-up scams
Be alert for messages that reference the breach and urge you to download an attachment, share a verification code, or pay a fee. Contact the company through its official site if anything is unclear. Keep devices and apps updated, and preserve the breach notice and case number for your records.
The right response depends on the type of information exposed and the country where you live. Use the company’s official notice and government consumer-protection resources for steps tailored to your situation.
Related reading: What to Do If Your Email or Password Appears in a Data Breach.
