First, do not panic
A message saying your information was part of a data breach is unsettling, but it is common and usually manageable. Large organizations are often required by law to notify people, and many people receive such notices over the years. A notice does not mean someone has already used your details, only that they were exposed. Your response should be steady and proportionate to what was actually exposed.
Step 1: Check that the notice is genuine
Scammers know people respond to breach alerts, and fake notices are a popular way to collect passwords and card numbers.
- Do not click links or open attachments in the message until you have checked it.
- Go to the company’s website by typing the address yourself, or open its official app, and look for an announcement.
- Be wary of notices that create urgency, threaten account closure or ask for your password, a full card number or a code sent to your phone. A real notice does not need these.
- Look at the sender details and the wording. Poor grammar or a generic greeting can be a clue, though not a certain one.
The article on phishing emails explains the common signs, and the overview of text message scams covers similar fakes that arrive by SMS.
Step 2: Read what was exposed
Good notices say what types of information were involved, when and what the company is doing about it. Different details call for different responses.
- Email address only. The main risk is more spam and phishing aimed at you. Stay alert to unexpected messages.
- Password. Change it, and change it anywhere else you used it.
- Payment card details. Contact your card provider through the number on the card or its official app. Cards can usually be replaced.
- Bank account details. Talk to your bank and consider extra monitoring.
- Government ID numbers, dates of birth or addresses. These are harder to change. Consider the protective options available in your country, such as fraud alerts or credit report checks, and look at official government guidance.
- Health or other sensitive records. Follow the instructions in the notice and watch for unusual correspondence.
If the notice is vague, the company’s official contact channels may give more detail.
Step 3: Change affected passwords
If a password may have been exposed:
- Change it on the affected service, from the official site or app.
- Choose a long, unique replacement, ideally a passphrase or a generated password in a manager.
- Change the same password on every other account where you used it, starting with email and finances. This is the point of the warning about password reuse: attackers often try leaked passwords on other sites.
- Sign out of other sessions if the service offers that setting.
- Turn on a second step if you have not already. The guide to two-step verification covers the options.
Even if a company says passwords were scrambled or stored securely, changing yours is a low-cost precaution.
Step 4: Check your recovery details
Make sure your backup email and phone number on the affected account are still yours and unchanged. Exposed contact details can be used in attempts to take over accounts. The guide to account recovery options explains what to review.
Step 5: Watch your accounts and statements
For a few months after a notice:
- Look over bank and card statements for unfamiliar charges.
- Review sign-in alerts and account activity.
- Keep an eye out for unexpected bills, accounts or letters in your name.
- Turn on transaction alerts where your bank offers them.
If you find something you cannot explain, contact the relevant provider through its official channels. The warning signs described in the article on account takeover signs apply here too.
Step 6: Expect follow-up scams
After a breach, scammers sometimes use the news to pose as the company, a bank or an official body, offering “help” or demanding payment. Those who know which company was breached may seem convincing. Treat unexpected calls, texts and emails with caution, and contact the organization using details you looked up yourself. The pattern of official impersonation is worth knowing in advance.
Step 7: Use the protections offered
Some companies offer free credit monitoring or identity protection for a period. If the offer comes through the company’s genuine channel, it can be a reasonable extra layer, though it is not required and it does not prevent misuse. Read the terms before signing up, and avoid giving more information than the offer needs.
Step 8: Reduce your exposure for the future
Breaches are outside your control, but the damage you can suffer is partly within it:
- Use unique passwords so one leak stays contained.
- Close accounts you no longer use, since an old account can still be breached. The advice on old accounts cleanup can help.
- Share only the details a service really needs.
- Consider separate email addresses for shopping and important accounts.
When to seek more help
If you think your identity has been misused, your bank account accessed, or someone is threatening you using exposed information, contact your bank, your local fraud-reporting agency or the police. If you or someone else is in immediate danger, contact local emergency services. This article offers general information, not legal or financial advice, and the right steps depend on where you live and what was exposed.
Most breach notices end up requiring a few sensible changes and some patience. Doing them promptly is the best way to keep a small event from becoming a bigger one.