01 / Understand
What is happening?
A breach can expose different kinds of information: an email address, password, payment details or sensitive identity records. The right response depends on the actual notice, not just the headline. Verify the notice on the company’s official website rather than following an unexpected email link.
You cannot undo a company’s breach. You can limit the fallout by replacing exposed passwords, stopping password reuse, strengthening account recovery and taking identity-specific steps when sensitive records were involved.
02 / Act without spending
Your free first steps
- 01
Verify the notice and read what was exposed.
Go directly to the company’s official website. Save its breach notice and instructions. Be wary of “breach support” callers asking for passwords, money or remote access.
- 02
Replace exposed and reused passwords.
Give the affected account a unique password. Change that password everywhere else you used it, starting with your primary email and financial accounts. Enable multifactor authentication when available.
- 03
Review account activity and recovery settings.
Look for unfamiliar sign-ins, forwarding rules, recovery addresses and transactions. Sign out unfamiliar sessions. Contact the bank directly if payment information or transactions are affected.
- 04
If sensitive identity data was exposed, consider a credit freeze.
In the US, freezing and unfreezing your credit is free at Equifax, Experian and TransUnion. Contact all three; monitoring is not a substitute for a freeze.
FTC credit freeze guidance
An important reality check
What tools cannot promise
A password manager cannot retrieve leaked data or protect a reused password until you change it. Alerts may miss misuse, and a credit freeze does not stop every kind of fraud or protect an existing account from takeover.
03 / Common questions
A few things worth knowing
Do I need to change every password after one breach?
Change the affected password and any account that used the same or a similar password. Prioritize email and financial accounts. Unique passwords help keep one breach from spreading to unrelated accounts.
Is paid monitoring required after a breach?
No. The appropriate response depends on the exposed data. Account security, checking statements and free US credit freezes may be useful without a subscription. Paid monitoring does not replace those steps.
Does a credit freeze stop all fraud?
No. A freeze restricts access to your credit file, which helps against some new-credit fraud. It does not stop every identity crime, existing-account misuse or a scam that persuades you to send money.
Further help from official sources
These are established guidance resources, not a claim of new research or an endorsement of any paid tool. Check the official pages for current instructions.