What to Do After a Data Breach: A 10-Step Checklist

• 10 steps
• By data type
• Follow-up scams
• Prevent the next one
• FAQ

The 10-Step Checklist

Do these in order. Steps 1 to 6 are urgent and take less than an hour for most accounts. The later steps protect you over the following weeks.

1. Confirm the breach is real. Scammers send fake breach notices to steal passwords. Do not click the link in the email. Go to the company's website by typing the address yourself, or use its official app, and look for the notice there.
2. Find out what was exposed. A leaked password, a card number and a Social Security number need different responses. The company's notice should say which data was affected. Use the table below to match your situation.
3. Change the password on the breached account. The FTC advises logging in and changing your password, and the username too if possible. If you cannot log in, contact the company to recover or close the account.
4. Change that password everywhere else you used it. The FTC says that if you use the same password anywhere else, change that too. Attackers try leaked passwords on other sites automatically, a method called credential stuffing.
5. Start with your email and money. Whoever controls your email can reset almost every other account. Secure that first, then banking, payment and shopping accounts.
6. Turn on two-factor authentication. This is our recommendation rather than an item in the FTC document. A second factor stops an attacker who has only your password. Where offered, use passkeys.
7. Watch your statements. The FTC advises checking your accounts for charges you do not recognise. If a card number was exposed, contact the bank or card company to cancel the card and request a replacement. If a bank account number was exposed, the FTC says to contact your bank to close it and open a new one.
8. If your Social Security number was exposed (United States). The FTC recommends accepting free credit monitoring if the company offers it, getting your free credit reports from annualcreditreport.com, considering a credit freeze or a fraud alert, and filing your taxes early. Outside the United States, contact your national data-protection or consumer authority about the equivalent steps.
9. Check whether your email appears in other breaches. The service Have I Been Pwned lets you search by email address and shows which known breaches included it.
10. Fix the cause: unique, strong passwords. Generate a different long random password for every account with the Strong Password Generator and store them in a password manager. Avoid the most common passwords.

What to Do Based on What Was Exposed

Watch for Follow-Up Scams

After a breach, attackers often use the leaked details to make fraudulent messages more convincing. Be cautious with any email, text or call that mentions the breach, asks you to verify account details, or pressures you to act quickly. Contact the company only through its official website or app, never through a link in the message.

Prevent the Next One

• Use a unique password for every account, so one breach cannot spread.
• Make passwords long and random. See how much length matters in our crack-time table.
• Prefer services that offer passkeys and two-factor authentication.
• Keep recovery email addresses and phone numbers up to date.
• Review which old accounts you no longer use, and close them.

This page is general information, not legal or financial advice. The FTC publication we used is dated September 2016 and describes United States procedures, so check IdentityTheft.gov for the current guidance.

Sources

• FTC: Data Breaches: What to know, What to do, September 2016: the source for the actions that depend on what was exposed.
• Have I Been Pwned: check which known breaches include your email address.