What to Do After a Data Breach: A Step-by-Step Guide

Published November 8, 2026 · 6 min read · By KeyGuard Pro

You get an email saying a service you use has been breached, or a breach-notification site shows your address in a leak. It is stressful, but the response is mostly mechanical. Work through these steps in order, starting with the accounts that matter most.

First, do not panic and do not click links in the notice

Scammers send fake breach notifications that lead to phishing pages. Go to the company's website by typing the address yourself, or use the app you already have, and look for an announcement there. Treat any message that urges you to act immediately with suspicion.

Step 1: Find out what was exposed

Breaches differ. Some expose only email addresses; others include passwords, addresses, phone numbers or payment details. The company's notice should say what was taken. A reputable breach-notification service can tell you whether your email address appears in known leaks, although it will not tell you your password.

Step 2: Change the password on the affected account

Create a new, long random password with a generator and save it in your password manager. If you cannot get in because the attacker changed it, use the site's account-recovery process.

Step 3: Change it everywhere you reused it

This is the step people skip, and it is the one that matters most. Attackers will try the leaked email and password on other sites, an attack described in our guide to how passwords get cracked. If you reused the leaked password anywhere, change it on those accounts right away, starting with email, banking and shopping.

Step 4: Turn on two-factor authentication

Even if your password is out there, a second factor can stop a login. Follow our two-factor authentication guide and prioritize your email, since it can reset other accounts.

Step 5: Check your email account for signs of takeover

If an attacker has reached your email, they often set up quiet forwarding rules or change the recovery address so they can regain access. Look in your mail settings for:

• Forwarding addresses you did not add.
• Filters that skip the inbox, delete messages or mark them as read.
• Recovery phone numbers or addresses you do not recognize.
• Devices or sessions that you do not recognize, which you can sign out.

Step 6: Watch for phishing

Information from a breach, such as your name, an order history or a phone number, makes convincing scam messages possible. Be extra careful with emails, texts and calls that mention the breached service, and never give a code or password to someone who contacts you.

Step 7: Protect your money if financial data was involved

• Check statements and set up transaction alerts.
• If a card number was exposed, ask the issuer to replace the card.
• If identifying numbers such as a national ID were exposed, consider the credit monitoring or credit freeze options available in your country. In many places a freeze is free and prevents new accounts being opened in your name.

Step 8: Tidy up for the future

1. Delete accounts you no longer use. Data that a company does not hold cannot leak.
2. Use a unique email alias or address for important accounts if your provider supports it.
3. Run your password manager's security report and fix every reused or weak password.
4. Sign up for breach alerts so you hear about future leaks quickly.

What not to do

• Do not pay anyone who claims to hold your leaked data.
• Do not reuse your old password with a small change, such as adding a number.
• Do not assume that a password you changed years ago is safe if the site stored it poorly.

The short version

Change the exposed password, change it everywhere it was reused, turn on two-factor authentication, check your email for tampering and watch for scams. After that, make unique passwords a habit so the next breach is a minor inconvenience instead of an emergency.