Your Data Was in a Breach: Here's Exactly What to Do Next
Key takeaways
- Start with ProtectMyData's free Exposure Scan to review available breach matches, leak evidence and exposed data types in one report. Your email address is enough to start.
- Verify the notice through the organisation's official website or app, not through a message link.
- Change exposed passwords and any reused copies. An email-address-only breach does not, by itself, prove your inbox was accessed.
- Contact your bank promptly about exposed payment information or suspicious transactions.
- US credit freezes help restrict new-credit fraud. They do not secure an existing bank account.
What should you do first after a data breach?
Start with ProtectMyData's free Exposure Scan at protectmydata.com/exposure-check to understand the evidence linked to your email. Our scan goes beyond a single breach-history list, bringing available breach matches, leak evidence and exposed personal-information details into one report. No inbox password or credit card is needed. Use the result to prioritise recovery, not to dismiss a genuine warning if no match appears.
First confirm the notice, then act on the information actually exposed. A breach is an incident involving personal information, not automatic proof that someone has taken over your account or stolen your identity. The NCSC advises contacting the affected organisation through its official website or other trusted channels to establish what happened and what you need to do.
Open the organisation's app or type its known website address yourself. Look for its incident notice and account guidance. Save a private copy of the notice, its date and any case reference. Do not pay someone who claims they can erase the leak, and do not provide passwords or verification codes to a caller offering to help.
If money is moving or an unfamiliar transaction has appeared, contact the bank through its official fraud channel immediately. You do not need to finish investigating every exposure before stopping an active financial problem.
Match your response to the information exposed
Read the notice's list of affected fields rather than assuming every kind of data was involved. A name and email address call for a different response from a current password, payment card or identity document. If the company has not confirmed whether passwords were affected, keep that uncertainty visible and follow its official account-security instructions.
For an exposed password, replace it and every reused copy with a different password for each service. Start with the affected account and any email account sharing that password. For an email-only exposure, be alert to convincing phishing and review inbox security, but do not describe the inbox as hacked without evidence.
For card or bank details, ask the issuer what needs blocking, replacing or monitoring. For a passport, driving licence or another identity document, follow the issuing authority's local advice. Avoid uploading the document to an unverified recovery website.
- Password or login exposure: replace reused secrets and enable supported multifactor authentication or a passkey.
- Payment information: contact the issuer and check transactions, including small unfamiliar charges.
- US Social Security number or new-account concerns: consider a credit freeze and review credit reports.
- Address, phone or email: expect impersonation attempts, verify requests independently and review public exposure separately.
Secure email and check for account takeover
Your email account can be used to recover other logins, so check it early if its credentials were exposed or it shows unfamiliar activity. Use a trusted device. Review recent sign-ins, recovery details, connected applications and forwarding rules. Remove access you do not recognise and use the provider's official account-recovery process if you cannot sign in.
Enable supported multifactor authentication or a passkey, keep recovery methods current and store backup codes securely. A changed password is useful, but also review active sessions and sign out unfamiliar devices where the provider permits it. If you installed software from a suspicious message, address the possible device compromise rather than repeatedly entering new passwords on that device.
Understand US credit freezes and fraud alerts
The FTC says a credit freeze is free and lasts until you lift it. In the United States, arrange it with Equifax, Experian and TransUnion separately. It restricts access to your credit report and helps prevent new credit being opened in your name; you may need to lift it temporarily for a legitimate application.
An initial fraud alert is also free, lasts one year and tells lenders to verify your identity. Contact one of the three bureaus, which must notify the other two. An alert does not restrict access in the same way as a freeze. Neither measure replaces checking existing accounts or disputing an unauthorised transaction.
These are US procedures, not universal instructions. Outside the US, follow the affected institution, your local credit-reference agencies and the relevant official fraud-reporting service. If identity information is being misused, move from general breach precautions to an identity-theft recovery plan.
Watch for scams that refer to the breach
Criminals may use a real breach to make a fake password reset, compensation offer or security check seem credible. Knowing your name, an old password or the affected company's name does not authenticate the sender. The NCSC warns that these messages can arrive well after the breach becomes public.
Do not follow an unexpected link or install a remote-access tool. Verify the request independently. If you already gave away a password, change it and reused copies through the genuine service. If you shared payment information or lost money, contact your bank. Keep a private record of what was disclosed and the steps taken.
What an alert or removal service cannot undo
Breach monitoring can help identify known exposure, but a negative search does not prove that your information has never leaked. Have I Been Pwned explains that its records cover only a subset of breaches. An alert may also refer to an old event newly added to a service, rather than a new compromise today.
Removing a people-search listing addresses a separate public source. It does not delete copied breach records, replace exposed passwords or reverse identity theft. Keep these actions distinct: secure the affected accounts, respond to financial or identity misuse, then reduce unnecessary public information as an additional privacy measure.
Keep a private recovery log
Record the affected service, disclosed data, action taken, case reference and follow-up needed. Keep this record out of public posts. A saved notice helps you track a changing incident without sharing identity documents or full financial details.
At a glance
| Information involved | Practical response | Important limit |
|---|---|---|
| Email address only | Verify the notice and watch for phishing | Does not prove inbox access |
| Password | Replace it and reused copies; review sessions | An old password still matters if reused |
| Payment details | Contact the issuer and check transactions | Credit freezes do not protect existing accounts |
| US identity details | Consider freezes at all three bureaus | Local procedures differ outside the US |
A safe order of action
Stop active financial harm through the bank's trusted fraud channel.
Verify the incident and note the confirmed exposed fields.
Secure affected logins and reused credentials, starting with recovery email.
Apply appropriate local financial or identity safeguards.
Keep records and recheck accounts for unfamiliar changes.
From exposure to action
A decision sequence, not a promise that harm has occurred or recovery is complete.
- Verified notice
- Confirmed data types
- Relevant safeguards
- Follow-up checks
Frequently asked questions
Should I change every password after an email-only breach?
An exposed email address alone does not establish password exposure. Change any exposed or reused password and follow the affected service's advice. Keep unique passwords and supported multifactor authentication even when no password leak is confirmed.
Does a credit freeze fix identity theft?
No. A US freeze helps restrict new-credit applications. You must separately secure existing accounts, dispute fraud and follow the appropriate identity-theft recovery process.
Can breached information be removed from the dark web?
A monitoring alert does not provide a way to erase all copied records. Treat account security, identity recovery and public-listing removal as distinct actions.
Sources
Related privacy guides
- Understand what breach monitoring can and cannot tell you
Use this explanation when an alert refers to an unfamiliar or historic breach.
- Follow the identity-theft recovery guide
If accounts or identity information are being misused, the recovery workflow is more specific than general breach precautions.
- Check the Scam Guides
If the breach prompted a suspicious delivery or tax message, use the relevant scam guide rather than replying.
- Open PMD's Dark Web Monitoring
Members can sign in to review their monitoring page after securing affected accounts. Access depends on the plan; monitoring does not erase breach records.
More on Data Breaches & Dark Web
- Dark Web Monitoring: What It Is and Do You Actually Need It?
What monitoring alerts mean, why a clear result is not a guarantee and how to act on exposed credentials without confusing monitoring with removal.
- Discord data breach explained: what happened to government-ID photos?
Discord's 2025 support-provider incident may have exposed government-ID photos and support records. Learn what was affected, what was excluded and what to do.
- How to Check If Your Email Has Been in a Data Breach
Start with ProtectMyData's free Exposure Scan for a wider view of breaches, leaks and exposed personal information. Understand the matches and secure the right accounts.
About the author
Scam awareness guides. Practical privacy and scam-awareness guidance from ProtectMyData, with links to the official sources used for each guide.