Step-by-step recovery plan
What to Do After a Data Breach
You got a breach notice or saw your email in the news, and now you want a clear plan. Here is what to do after a data breach, in the order that matters most.
The breach check is free and needs no account.
My data was leaked. What do I do now?
A breach means a company that held your details had them exposed. You cannot undo that, but you can close the gaps the leak opens.
Most harm after a breach is not the leak itself. It is what someone does next with your email, your password or your phone number.
The fastest way to lower that risk is to work in order. Protect the account that controls the others first, then move down the list. Each step below takes a few minutes.
Keep going from here
Next steps that fit the details that were leaked.
Check if a message is a scam
Test a suspicious text, email, link or QR code before you act on it.
Remove your personal data online
Use the opt-out helper and deletion request writer to get your details off people-search and data broker sites.
Compare identity protection services
See what password managers, monitoring, data removal and VPNs do and do not do, and the free step to take first.
How we handle your data
Read how the email you check is masked and hashed, and never kept in full.
The first seven steps to take after a data breach
Work top to bottom. The earlier steps protect the most, so do them first even if you only have ten minutes.
Secure your email account
Your email can reset most of your other logins, so it comes first. Change its password to something new and long, sign out of unknown devices, and check that no forwarding rules or recovery addresses were added without you.
Change any reused passwords
If the same password was used anywhere else, treat it as exposed everywhere. Change it on each account, starting with banking, then any account tied to money or identity. Use a different password on each one.
Turn on multi-factor sign-in
Add a second step to sign-in on your email, bank and main accounts. An app code or a passkey is stronger than a text message. This stops most takeovers even when a password is known.
Check your bank and account activity
Look over recent transactions and sign-in history. Report anything you did not do to your bank straight away, and set up alerts for new payments so you hear about activity quickly.
Watch for scams that use your leaked
Scammers use real details from a breach to sound convincing. Be wary of messages that mention your name, order or provider and push you to act fast. Check a suspicious message before you tap anything.
Consider a credit ban or freeze
In some countries you can place a ban or freeze so no new credit is opened in your name. Options differ by where you live, so check what your national credit bodies offer and how to lift it later.
Report identity misuse
If someone uses your identity, report it to your bank and the accounts affected, and to the right national body. Keep a record of what happened and every step you take, which makes reporting far easier.
Common questions after a data breach
Frequently Asked Questions
- My data was leaked. What do I do first?
- Secure your email account first, because it can reset most of your other logins. Change its password to a new long one, sign out of devices you do not recognise, and check for any forwarding rules or recovery addresses you did not add. Then work down the step list above.
- Do I need to pay for identity protection?
- Not to take the steps on this page. The most useful actions are free: strong unique passwords, multi-factor sign-in, and watching for scams. Paid services can add monitoring, but start with the free steps first. Our comparison explains what each type does and does not do.
- The breach check found nothing. Am I safe?
- An empty result means your address was not found in the publicly known breaches we can check. It is not proof you were never exposed, since not every breach is public. Keep strong passwords and multi-factor sign-in on, and turn on Breach Watch to hear about new breaches.
- Can you remove my data from a breach?
- No. Once data is leaked it cannot be pulled back, and we never hold or sell breach data. What you can do is close the gaps it opens: change exposed passwords, add multi-factor sign-in, and remove your details from people-search sites where possible.
- How do I report identity misuse?
- Tell your bank and any affected accounts straight away, then report to the right national body for where you live. Keep a clear record of what happened and the steps you have taken. The Incident Desk gives you one place to store that record.
Keep track of every step you take
Record what happened and tick off each fix as you go. A clear record makes reporting to a bank or a national body much easier.
Free to use. The breach check needs no account.