What to Do After a Data Breach: A Calm, Practical Checklist

After a data breach, start with your email

Finding out your data was exposed after a data breach is unsettling, and the worst response is either panic or indifference. Panic leads to frantic password changes on devices you have not secured. Indifference leaves the door open for months. The middle path is a short checklist, done in the right order, and this guide walks through it.

Start with your email account, because email is the master key to everything else. If an attacker controls your email, they can reset passwords on most of your other accounts. Change your email password to something long and unique, then turn on two-factor authentication using an authenticator app rather than SMS where possible. If your email provider offers passkeys, set one up. This single step does more than any other item on the list, so do it first, before you touch anything else.

Change passwords, but change the right ones first

Next, change passwords for accounts that share the exposed password. This is where most people get into trouble, because password reuse turns one breach into many. Prioritize in this order: banking and payment accounts, email (already done), cloud storage and photo backups, social media, and shopping accounts with saved payment methods. Everything else can wait a day.

If you have been reusing passwords, this is the moment to stop, and a password manager is the tool that makes stopping realistic. Our guide to setting up a password manager walks through the 30-minute setup, and it is worth doing properly rather than rushing. A manager generates a unique password for every site, so the next breach exposes one password, not your whole digital life. While you are at it, audit your app permissions too, since old apps with broad access are another quiet risk.

Turn on two-factor authentication everywhere it matters

Two-factor authentication is the single best defense against stolen passwords. With it on, a leaked password alone is not enough to get into your account. Enable it on email, banking, cloud storage, social media and any work accounts, and prefer authenticator apps or hardware keys over SMS codes, which can be intercepted through SIM swap attacks.

Save your backup codes somewhere safe, and not in the same place as your passwords. A printed copy in a drawer, or a note in a password manager's secure section, works. The goal is to be able to recover your account if you lose your phone, without handing an attacker a second way in.

Watch your money and your inbox

For the next few months, check your bank and card statements more often than usual, and set up transaction alerts if your bank offers them. Look for small test charges, which thieves use to check whether a stolen card still works before making a larger purchase. If you spot anything unfamiliar, call your bank immediately rather than waiting to see if it resolves itself. It will not.

Your inbox is the second place to watch. Breach data fuels phishing, and the most convincing phishing emails are built from real details: your name, your address, the service that was breached, even the last four digits of a card. Expect messages that pretend to be from the breached company, offering a security check or a refund. Do not click links in those messages. Go to the company's website directly, or use the official app, and check there. Our guide on how to check if a link is safe covers the 30-second checks that catch most fakes.

Check whether you were actually exposed

Not every breach notice means your data was taken. Companies often notify a broad group out of caution, and the actual exposed records may be a subset. Use a reputable breach search service to check your email address, and read the company's own notice carefully for what was exposed: names and emails are annoying, while identity documents, passwords and payment details are serious. Match your response to the severity, but do not assume a mild notice means no action. At minimum, change that service's password and turn on two-factor authentication.

If identity documents or financial details were exposed, consider stronger steps: a credit freeze or fraud alert where available, a tax authority alert if your jurisdiction offers one, and a police report if you find evidence of identity theft. Keep a simple log of what you changed and when, because breach fallout can drag on for months and you will forget the details.

The habits that make the next breach boring

Breaches are now a routine part of digital life, which means the goal is not to avoid them entirely. It is to make each one boring. Unique passwords, two-factor authentication, transaction alerts and a healthy suspicion of unexpected messages turn a breach from a crisis into an afternoon of housekeeping.

Do this checklist once, properly, and the next breach notice will feel very different. You will change one password, confirm two-factor authentication is on, and move on with your day. That is the whole point: security habits that are dull are security habits that actually survive contact with real life.