A notice that your email address or password appeared in a data breach can be unsettling, but it does not automatically prove that someone accessed your account. Act on the information the company says was exposed, and use official account pages rather than links in an unexpected message. Be especially careful after a breach is announced: scammers may imitate the affected company and send convincing “security” links.
Secure the affected account first
Open the company’s official site or app directly and change the password for the affected account. If you reused that password elsewhere, change it on those accounts too, starting with email, financial services, cloud storage, and social accounts. Use a different, strong password for each service; a password manager can help create and store unique credentials. The Federal Trade Commission recommends turning on multifactor authentication when available, so a password alone is not enough to sign in.
Check recovery and session settings
Review the account’s recovery email address and phone number, signed-in devices, active sessions, and connected apps. Remove anything you do not recognize, and update recovery details that are old or controlled by someone else. Look for mail forwarding rules, filters, or security changes that you did not create. If you can no longer sign in, follow the provider’s official account recovery process from a trusted device.
Respond based on what was exposed
If payment-card or bank information may be involved, contact the financial institution using the number on the card or its official website and review recent transactions. If identity information such as a Social Security number was exposed, the FTC’s IdentityTheft.gov data-breach tool provides a tailored U.S. recovery plan. Other countries have separate credit-reporting and identity-protection processes, so use the official agency in your jurisdiction. Save the breach notice and records of any actions you take.
Watch for follow-up scams
Do not provide a password, verification code, or payment to someone who calls or texts claiming to fix the breach. Avoid attachments and links in unsolicited messages; navigate to the provider directly. If you already entered credentials on a suspicious page, change them immediately from the legitimate site and secure any reused accounts. Report impersonation attempts to the affected service.
Keep a practical security routine
Use unique passwords, multifactor authentication, current software, and account alerts for important services. Review statements and login notifications in the weeks after a breach. You do not need to panic or delete every account, but you should act promptly on exposed credentials and carefully follow the company’s verified instructions.
A breach notice is a reason to strengthen account security, not to trust every follow-up message. Confirm which data was involved, take targeted steps, and consult official recovery guidance if you spot unauthorized access or identity theft.
