Knowing what to do after a data breach limits the damage: in the first hour, change the breached password and any reused copies and turn on two-factor authentication; in the first day, watch your bank accounts and freeze your credit if identity data was exposed; and over the next month, stay alert for phishing that uses the stolen details. This plan walks through each stage.
Key takeaways
- Act on passwords first: change the breached one and any reused copies.
- Turn on two-factor authentication for email, banking and the breached service.
- Freeze your credit if your ID number, date of birth or address was exposed.
- Expect phishing that mentions the breach, and never click links in “breach” emails.
What to do after a data breach: the first hour
In the first hour after a data breach, change the password for the breached service, change it anywhere you reused it, and turn on two-factor authentication. These steps stop the most common follow-on attack, criminals logging in with your stolen password.
- Change the breached account’s password through the official website, not a link in an email.
- Change the same password on every other account where you used it.
- Turn on two-factor authentication, starting with your email.
- Check the account for unknown devices, forwarding rules or changed recovery details.
What should you do in the first day?
In the first day, review recent transactions, contact your bank if payment data was exposed, and freeze your credit if identity details were taken. A freeze stops criminals opening new accounts in your name and is free in many countries.
| Data exposed | Action |
|---|---|
| Password | Change it everywhere it was used; enable 2FA |
| Card number | Ask your bank to replace the card |
| Bank account details | Watch for direct debits you did not set up |
| ID number, date of birth, address | Freeze your credit; watch for new accounts |
| Phone number | Add a carrier account PIN; distrust unexpected texts |
| Medical or insurance data | Review statements for treatments you did not receive |
US residents can use IdentityTheft.gov for a personalised recovery plan if their identity is misused.
What should you do in the month after a data breach?
In the month after a data breach, watch for phishing emails and calls that use the stolen details, keep monitoring your accounts, and take up any free credit monitoring the company offers. Criminals often wait weeks before using breached data.
Breach-themed phishing is common: emails offering “compensation” or asking you to “verify” your account. Our phishing prevention guide shows the warning signs.
How do you know which data was taken?
You find out which data was taken from the company’s breach notice, its website, or a breach lookup service. Companies in many regions must tell affected people what was exposed and what they are doing about it.
Our guide on how to check if your email was in a data breach explains how to use free tools to see every known breach involving your address. The NCSC publishes guidance on what to do when you are notified.
Can you take action against the company that was breached?
Depending on where you live, you may be able to complain to a data protection regulator or join a class action if the company failed to protect your data. Some settlements offer compensation or free monitoring.
For examples of how regulators have responded to big breaches, see our major data breaches guide, including the Equifax and Marriott settlements.
Related reading
Best Identity Theft Protection for Families and Seniors
Personal Cyber Security Services: What They Offer and Who Needs Them
Frequently asked questions
Is a credit freeze the same as credit monitoring?
No. A credit freeze blocks new credit being opened in your name. Monitoring only alerts you after something happens. A freeze is stronger prevention; monitoring is useful as an extra alert.
Will changing my password fix everything?
Changing passwords stops account takeover, but it does not undo exposure of data like your address or date of birth. For that data, use a credit freeze and stay alert to fraud and phishing.
Should I pay for identity theft protection?
Many people do not need to. Free steps such as credit freezes, unique passwords and two-factor authentication cover most risks. Paid services can help with recovery support if your identity is stolen.
How do I know a breach notification email is real?
Do not click its links. Go to the company’s website directly or call a number you already trust. Criminals send fake breach notices to steal passwords.
Next steps
Knowing what to do after a data breach turns a worrying notice into a short checklist: passwords and two-factor authentication first, then money and identity, then a month of alertness. Save this plan for next time. Businesses can prepare for their own incidents with our incident response guide.
