What to Do After a Data Breach: A Step-by-Step Checklist

Receiving a "we have had a security incident" email is unsettling. Acting quickly and in the right order limits the damage.

In the first hour

1. Confirm the notice is genuine. Do not click links in the email. Go to the company's website directly or search for news of the breach.
2. Change the password on the affected account, using a new random password from a password generator.
3. Change it anywhere you reused it. This is the most important step, because attackers will try the leaked password on other services.
4. Turn on two-factor authentication for the affected account and your email.

In the first few days

• Check account activity for unknown logins, orders, address changes or new linked devices.
• Sign out other sessions where the service offers it.
• Watch your bank and card statements. If payment details were exposed, contact your bank to cancel or monitor the card.
• Be alert for targeted phishing. Criminals use leaked names and order details to make scam emails and calls convincing.

If sensitive identity data was exposed

If identification numbers, dates of birth or addresses were included, consider the protections available in your country, such as a credit freeze or fraud alert with credit bureaus. Keep copies of the breach notice in case you need to dispute fraudulent activity later.

Prevent the next one from hurting

• Use unique passwords everywhere, stored in a password manager.
• Use email aliases for shopping and newsletters, so a leak does not expose your main address.
• Give companies only the data they need.
• Delete accounts you no longer use.

A breach at one company is outside your control. How far it spreads into the rest of your accounts is largely within it.

Frequently asked questions

How to recover a hacked account?

To recover a hacked account, use the service's official recovery page, reset the password, sign out all sessions, check recovery email and phone settings, and turn on 2FA. Keep recovery codes and backup codes stored safely for next time.

What are the signs your account was hacked?

Signs your account was hacked include login alerts you don't recognize, a password reset email you didn't request, messages you didn't send, changed settings and unknown devices. Act fast.

Can a data breach lead to identity theft?

Yes. If personal details such as ID numbers or dates of birth leak, criminals may attempt identity theft. Watch your bank statements and consider the credit protections available in your country.