A data-breach notice can create urgency, but the safest response is methodical. Start by confirming the notice through the organization’s official website or app—not a link in an unexpected email or text. Then protect the accounts that could give an attacker the widest access.
1. Confirm what happened without using the message link
Open the company’s app or type its known website address yourself. Look for an account notice, security page, or support announcement. A legitimate breach can attract convincing copycat phishing messages, so avoid calling a number or signing in through an unsolicited alert.
Find out what information was involved, which account was affected, when the incident occurred, and whether the company forced a password reset. A notice that only says “your data may be at risk” is not enough to decide every next step.
2. Change the affected password from a trusted device
Use the service’s official app or website. Choose a new, unique password that you have never used anywhere else. If the old password was reused, change the other accounts that share it—starting with email, financial services, cloud storage, social media, and business administration accounts.
Do not make a small variation such as adding a year or exclamation point. Attackers test predictable variations. A password manager can generate and store a different password for every account; our guide to choosing a password manager explains what to compare.
3. Secure the email account first when it is the recovery key
Your primary email can reset many other accounts. Give it a unique password, enable multi-factor authentication, review recovery addresses and phone numbers, and sign out sessions you do not recognize. Also check for forwarding rules or filters you did not create. An attacker may add one so copies of security messages continue going elsewhere.
4. Turn on stronger sign-in protection
Enable multi-factor authentication wherever it is offered. An authenticator app, security key, or passkey generally provides stronger phishing resistance than a text message, although any supported second factor is usually better than a password alone. Store recovery codes somewhere secure and separate from the device you normally use.
CISA’s Secure Our World password guidance recommends long, random, unique passwords and a password manager. Its MFA guidance explains why a second sign-in factor matters.
5. Review sessions, connected apps, and recent activity
- Sign out devices or sessions you do not recognize.
- Remove unfamiliar third-party apps and browser extensions.
- Check recent logins, sent messages, purchases, and security-setting changes.
- Confirm that recovery details and trusted devices still belong to you.
- Save screenshots or confirmation numbers if you need to dispute activity.
If you clicked a suspicious link or installed something, changing a password may not be enough. Follow our suspicious-link response checklist from a clean device and contact the affected service through a verified channel.
6. Match the response to the exposed information
A leaked password calls for account changes. Exposed payment-card information may require a call to the card issuer using the number on the card or official statement. Exposure of highly sensitive identity information may justify a credit freeze or fraud alert. The U.S. Federal Trade Commission’s IdentityTheft.gov provides a recovery plan based on what was exposed and what misuse occurred.
Be cautious with “breach monitoring” sales pitches. A monitoring alert can tell you that information appeared in a known dataset; it cannot guarantee that an account is safe or remove copied data from every criminal system.
7. Watch for follow-up scams
Attackers may use real details from a breach to sound credible. Treat unexpected password-reset calls, “account recovery” messages, invoice changes, and requests for one-time codes as untrusted. Go directly to the service and never give a verification code to someone who contacted you.
A practical order of operations
If several accounts need attention, protect email first, then financial and business-admin accounts, cloud storage, social media, and the remaining reused-password accounts. Work from a trusted device and keep a written checklist that does not contain the passwords themselves.
Our harder-to-hack guide covers the preventive basics. If you want help evaluating protection options for a home or small business, explore User Friendly Security’s website-first resources and contact us through the site. Security tools reduce risk, but no product or monitoring service can promise perfect protection.