Your Password Was Leaked in a Data Breach: What to Do Next
Data breaches are now so common that most internet users have been in at least one. Finding out your details leaked is unsettling, but a few focused steps will contain the damage. Here’s what to do, in order of priority.
First, confirm what leaked
- Check the password itself: enter it in our password breach checker. It uses the Have I Been Pwned k-anonymity method, so the password never leaves your device.
- Check your email address: search it at haveibeenpwned.com to see which services’ breaches included it and what types of data were exposed (passwords, phone numbers, addresses).
- Read the company’s notice if you received one. It should say what was taken and whether passwords were stored securely.
Step 1: Change the breached password, everywhere you used it
Change the password on the breached service, then on every other account where you used the same or a similar password. Attackers will try it on email, banking, shopping and social media accounts within days, a technique called credential stuffing. Create each new password with the random password generator and make sure each one is unique.
Step 2: Secure your email account first
Your email is the master key to everything else, because “forgot password” links go there. Give it a long, unique password or a 6-word passphrase, and turn on two-factor authentication. Then check its settings for anything you didn’t set up: forwarding rules, unknown recovery email addresses or phone numbers, and connected apps.
Step 3: Turn on two-factor authentication
Enable 2FA on your important accounts, starting with email, banking, UPI and payment apps, cloud storage and social media. An authenticator app or a hardware security key is much stronger than SMS codes, but any 2FA is far better than none. See our guide to two-factor authentication.
Step 4: Look for signs of misuse
- Review recent logins and active sessions; sign out devices you don’t recognise.
- Check bank, card and UPI statements for unfamiliar transactions.
- Look for orders, password-reset emails or “new sign-in” alerts you didn’t trigger.
If you find fraud, contact your bank immediately through its official number. In India, you can also report cyber fraud on the national helpline 1930 or at cybercrime.gov.in.
Step 5: Expect phishing
Criminals use breach data to make scam messages convincing: they may quote your name, an order number or even an old password. Be suspicious of any message that creates urgency (“your account will be blocked”) and never click login links in such messages; open the app or type the website address yourself. Legitimate companies will not ask for your password, PIN or OTP.
Step 6: Fix the root cause
The real lesson of most breaches is password reuse. The sustainable fix is:
- Install a reputable password manager.
- Protect it with a strong master passphrase you’ve memorised.
- Gradually replace old passwords with unique generated ones, starting with your most important accounts.
What if the breach included more than passwords?
- Phone number: expect more spam calls and SMS phishing; ask your mobile operator about SIM-swap protection.
- Card details: ask your bank to block and reissue the card.
- Government ID numbers: watch for loans or accounts opened in your name, and consider locking biometric or ID services where your country offers this.
Breaches are outside your control, but how much damage they do is largely within it. Unique passwords and two-factor authentication turn a breach from a crisis into a minor chore.