Your Data Was Breached: Here's Exactly What to Do Next

Data Breaches Are Inevitable

In today's digital landscape, data breaches are not a question of "if" but "when." Major companies — from social media giants to healthcare providers — suffer breaches regularly, exposing millions of users' personal information. What determines the impact is how quickly and effectively you respond.

Step 1: Confirm the Breach

Before panicking, verify the breach is real:

• Check the company's official website for breach notifications
• Visit HaveIBeenPwned.com — Enter your email to see which breaches include your data
• Watch for official emails — Legitimate breach notifications come from the company's official domain, not random addresses
• Be cautious of phishing — Scammers often send fake breach notifications to steal more data

Step 2: Change Your Passwords Immediately

Start with the breached account, then any accounts sharing the same password:

• Use our Password Generator to create strong, unique passwords
• Change passwords for your email accounts first (they control password resets everywhere else)
• Never reuse a compromised password on any account, ever

Step 3: Enable Two-Factor Authentication

If you have not already, enable 2FA on every account that supports it, starting with:

• Email accounts
• Banking and financial services
• Social media
• Cloud storage

Step 4: Monitor Your Financial Accounts

• Check bank statements for unauthorized transactions
• Review credit card activity daily for the first few weeks
• Set up transaction alerts so you are notified of any purchases in real-time
• Consider a credit freeze if sensitive financial data was exposed — this prevents new accounts from being opened in your name

Step 5: Watch for Identity Theft

After a breach, criminals may attempt to use your stolen data for identity theft:

• Monitor your credit reports — You are entitled to free reports from all three bureaus
• Watch for unexpected mail — Unfamiliar bills, credit cards, or collection notices are red flags
• Tax fraud — File your taxes early to prevent criminals from filing fraudulent returns
• Medical identity theft — Review medical bills and insurance statements for services you did not receive

Step 6: Document Everything

Keep records of:

• The breach notification and date
• All accounts potentially affected
• Steps you have taken to secure your accounts
• Any unauthorized activity you discover

This documentation is essential if you need to dispute fraudulent charges or file an identity theft report.

Preventing Future Damage

• Use a password manager with unique passwords for every account
• Enable breach monitoring in your password manager or through HaveIBeenPwned
• Minimize the data you share — The less data companies have, the less can be stolen
• Regularly review account activity across all important accounts

The first 48 hours after discovering a breach are critical. Act quickly, stay methodical, and you can significantly limit the damage.