What to Do After a Data Breach
Respond to a data breach by verifying the notice, securing affected accounts, reviewing exposed information, and watching for targeted follow-up scams.
Verify the notice and its scope
Visit the organization's official website or app directly to confirm a breach notice. Do not sign in through an unexpected email link. Read which information was involved and what the organization recommends. An exposed email address calls for different action than an exposed password or financial account. Keep a copy of the notice and note any support or reporting steps that apply to you.
Secure affected accounts
If a password was exposed, change it through the real service. Replace it on every other account where you reused it, even with minor variations. Enable two-factor authentication where available. Review recent activity, recovery details, and signed-in devices. Sign out sessions you do not recognize. If your primary email was affected, address it promptly because it may provide password-reset access to other accounts.
Match your response to the information
Contact your bank or card issuer if payment information or suspicious transactions are involved. If government identity details were exposed, follow the issuing authority's guidance. In the United States, consider a credit freeze with each nationwide credit bureau when the exposed information could support fraudulent credit applications. A freeze does not stop every kind of fraud. Use IdentityTheft.gov if you need a recovery plan for actual identity misuse.
Expect convincing follow-up messages
Attackers may use exposed details to make calls and emails sound legitimate. Be cautious with messages offering urgent refunds, compensation, or account repair. Never share verification codes with unexpected callers. Monitor relevant accounts and statements, and report unfamiliar activity promptly. Avoid paying an unknown service that claims it can erase leaked information from the internet. Focus on practical account controls and official support channels.