What to do after a data breach: a 10-minute checklist
Got a data breach notice or heard about a hack? Here is a simple 10-minute checklist to secure your accounts, check what was exposed and avoid follow-up scams.
Breaches are now a regular part of the news. In recent weeks alone we have covered incidents at Chainalysis, Railway and Binance. If you get a notice, or think your details were exposed, here is a calm 10-minute checklist you can follow.
The 10-minute checklist
- Confirm it is real (1 minute). Go to the company’s official website or app yourself and look for a notice. Don’t click links in the email or text, because scammers copy breach notices.
- Change the password (2 minutes). Choose a long, unique password for that account. A password manager makes this much easier.
- Change reused passwords (2 minutes). If you used the same password anywhere else, change it there too, starting with email, banking and shopping.
- Turn on two-factor login (1 minute). Use an authenticator app or a passkey where possible. Text-message codes are better than nothing but easier to attack.
- Sign out everywhere (1 minute). Use the “log out of all devices” option and remove connected apps or devices you don’t recognize.
- Check what was exposed (1 minute). Look up your email address on Have I Been Pwned to see which breaches include it.
- Watch your money (1 minute). Check bank and card statements for unfamiliar charges, and set up alerts. If card details were exposed, ask your bank about replacing the card.
- Expect phishing (1 minute). After a breach, criminals use leaked names, emails and phone numbers to send convincing fake messages. Be suspicious of anything urgent about the breached company.
If sensitive data was exposed
- ID numbers or financial details: consider a fraud alert or credit freeze where available, such as in the US and UK. In the US, IdentityTheft.gov gives a step-by-step recovery plan.
- Phone number: add a PIN or extra security with your mobile provider to reduce the risk of SIM swapping.
- Email account: secure this first, since it can reset almost every other password.
For developers and businesses
If a service you use was breached, the risk is often your keys and secrets, not just your password.
- Rotate API keys, tokens and environment variables that the service could access, and do it from a trusted device.
- Check logs for unusual access or new keys you did not create.
- Revoke old access for team members and tools that no longer need it.
- Use a secrets manager so keys are not scattered across files and laptops.
Our guide on checking a compromised coding extension shows what a cleanup can involve.
If you hold crypto
- Follow only the exchange’s official announcements.
- Never share your seed phrase or recovery phrase with anyone, including “support” staff.
- Enable withdrawal allow-lists and strong two-factor login if your exchange offers them.
What not to do
- Don’t pay anyone who contacts you claiming to fix the breach or return stolen data.
- Don’t reply to unexpected calls, emails or texts asking for codes or passwords.
- Don’t reuse the same new password across accounts.
Make the next breach less painful
- Use a password manager and unique passwords for every account.
- Turn on two-factor login for email, banking and important apps.
- Use a separate email address for shopping and newsletters.
- Delete accounts you no longer use.
Frequently asked questions
What should I do first after a data breach?
Confirm the breach on the company’s official site, then change your password and turn on two-factor login.
How do I know if my data was in a breach?
Search your email address on Have I Been Pwned and read the company’s official notice.
Do I need to freeze my credit?
If sensitive details such as ID numbers or financial data were exposed, a credit freeze or fraud alert can help where it is available. Check your country’s official guidance.
Why do I get more scam messages after a breach?
Criminals use leaked contact details to send believable phishing messages. Verify any message by contacting the company directly through its official site.
