Breaches Updated November 15, 2026

What to do after a data breach

A step-by-step checklist for when a company you use has been breached, depending on what was exposed.

A breach notice does not mean your accounts have been taken over. It means some of your details may now be in criminals' hands. What to do depends on what was exposed.

First, check what was exposed

Search your email address on Have I Been Pwned to see which breaches include it and which kinds of data each one exposed. Our breach pages list the exposed data for each new breach.

If passwords were exposed

• Change the password for that service.
• Change it anywhere else you used the same or a similar password. Criminals try leaked passwords on other sites.
• Use a password manager so every account has its own password.
• Turn on two-step verification, ideally with an authenticator app or passkey rather than text messages.

If email addresses or phone numbers were exposed

• Expect more phishing that mentions the breached company and sounds convincing.
• Do not click links in messages about the breach; go to the company's site or app directly.

If financial or identity details were exposed

• Watch bank and card statements, and ask your bank for a new card if card numbers were leaked.
• In the US, freezing your credit with Equifax, Experian and TransUnion is free and stops new accounts being opened in your name.
• In the UK and Canada, check your credit report with the credit reference agencies and ask about fraud alerts.
• If someone has used your identity, report it: in the US at IdentityTheft.gov.