Reviewed by the Foxmole editorial team · 2026-07-29
Key takeaways
- Change the breached password and anywhere you reused it, now.
- Turn on two-factor authentication.
- Expect breach-themed phishing next, and stay skeptical.
Data breaches are common, personal-data breaches were among the top complaint categories in the FBI’s 2024 internet-crime reporting. If your information was exposed, panic doesn’t help but a short checklist does.
In the first hour
- Change the password on the breached account, and on any other account where you reused it. Make each new password unique. (See our password guide.)
- Turn on two-factor authentication, starting with email and banking. Even a leaked password is much less useful to an attacker without the second factor.
- Check what was exposed. A leaked email is low-risk; leaked passwords, ID numbers, or payment details need faster action.
In the first day, if money or ID was exposed
- Watch your accounts for unfamiliar charges; contact your bank about anything odd.
- Consider a fraud alert or credit freeze with the relevant credit bureaus in your country, which makes it harder for someone to open accounts in your name.
- Keep records of what you were told was exposed and when.
Expect follow-on scams
After a breach, criminals often use the leaked details to make phishing more convincing (“we noticed suspicious activity on your account…”). Be extra skeptical of messages referencing the breach, and navigate to services yourself rather than clicking links. (See our phishing red flags.)
This week, reduce the blast radius
- Use a password manager so a breach at one site can’t unlock others.
- Turn on 2FA everywhere it’s offered.
- Periodically check breach-lookup services like Have I Been Pwned for your main email addresses.
The short version
Change reused passwords, enable 2FA, watch financial accounts, and treat any breach-themed message as a likely scam. Preparation before a breach, unique passwords and 2FA, is what makes the cleanup easy.