Data breach: what to do now, step by step

When you learn your data was in a breach, do five things in order: confirm what leaked, change the affected password and any copies of it, turn on a second factor, secure your email, and stay alert for phishing that uses the leaked details. Most breaches expose an email address and a password, and the damage stays small if you act quickly.

Step 1: confirm and find out what leaked

• Have I Been Pwned. haveibeenpwned.com lists known breaches and shows which data types were included, such as passwords, phone numbers or addresses. You can sign up for notifications about future ones.
• HPI Identity Leak Checker. The Hasso Plattner Institute in Germany runs sec.hpi.de/ilc, which sends its result to the address you entered, so only the mailbox owner sees it.
• The company’s notice. If the service itself writes to you, verify it by visiting the site or app directly, never through the link in the message.

Note which data was exposed. A leaked password is a different problem from a leaked address or ID number.

Step 2: change the right passwords

1. Change the password on the breached service.
2. Change it everywhere else you used the same or a similar one. If you recognise this as many accounts, it is a sign to move to a password manager, which makes unique passwords effortless.
3. Start with the accounts that unlock others: email, Apple or Google account, banking.
4. Choose long, new passwords, following the guidance in strong passwords in 2026. You do not need to change them again on a schedule.

Step 3: add a second factor

Turn on two-factor authentication or a passkey on the breached service and on your important accounts. A stolen password is then not enough on its own. Where you can, choose an authenticator app or a security key over SMS.

Step 4: secure your email and sessions

Your inbox is where resets arrive, so check it first. Our guide to securing your email account covers forwarding rules, connected apps and recovery details. Then use “sign out of all devices” on the breached service to end any session an attacker may hold.

Step 5: protect against what comes next

What leaked	What to do
Email address only	Expect spam and phishing. Do not open attachments, do not trust links.
Password	Steps 2 and 3 above, urgently.
Phone number	Be careful with calls and texts claiming to be your bank or a courier. Consider extra protection against SIM swapping.
Payment card	Contact your bank, ask for a card replacement, check statements.
ID, date of birth, address	Watch for misuse in your name. Consider identity-theft protection if you want help monitoring.
Security questions	Replace them where you can, and treat answers as passwords.

Attackers often send follow-up emails that use real details from the leak to look convincing. A message that knows your name or a past order is not proof of honesty.

Your rights under the GDPR

Companies in the EU must notify the supervisory authority of certain breaches, generally within 72 hours of becoming aware, and tell affected individuals when the risk to them is high (Articles 33 and 34 of the GDPR). You can also ask what data a company holds about you under Article 15, and file a complaint with your national data protection authority if you think a company handled the breach badly.

What you do not need to do

• Delete your accounts in a panic. Closing an account does not remove data that already leaked.
• Pay anyone who contacts you claiming to hold your data.
• Install “cleaning” tools offered through an unsolicited email.

How to read a breach notification

A notice usually states what happened, which data was involved and what the company recommends. Look for three things: whether passwords were stored hashed or in plain text, whether payment data was included and whether the company says the breach is fixed. If a notice is vague, check the tools above for the date and the data types.

Have I Been Pwned and passwords

Have I Been Pwned also offers a way to check whether a particular password has appeared in known leaks. The lookup is designed so that your full password never leaves your device: only a short fragment of its hash is sent. Many password managers use the same service to flag weak or exposed passwords for you, which is a convenient way to find reuse without typing secrets into websites.

A simple 15-minute routine

1. Search your main address in a leak checker.
2. List the breaches shown and the data types for each.
3. For every breach with passwords, change that password and any copy of it.
4. Open the security settings of your email account and review devices, forwarding rules and recovery options.
5. Turn on 2FA wherever it is still missing.
6. Set a reminder to check again in a few months, or subscribe to alerts.

When to take it further

If financial data or identity documents were part of a leak, contact your bank or card issuer, and consider reporting identity misuse to the police and the relevant authority in your country. In the EU you can also raise a complaint with your national data protection authority. Keep copies of the notice and any correspondence, because they help if you need to dispute a transaction later.

Make the next breach harmless

Unique passwords, 2FA and a few minutes of monitoring turn a breach from a crisis into a notification. Subscribe to alerts so you hear about the next one early.