Find out what leaked
The breach notice, if there was one, says which kinds of data were taken. If not, search the email addresses and usernames you use on a data breach search. What leaked decides which of the steps below you need.
An address alone means spam and phishing. A password or password hash means account takeover. A phone number, a home address, a date of birth or ID numbers mean scams and fraud in your name.
Change the leaked password, everywhere
Change it on the breached site, then on every other site where you used the same password. Start with your email account, because whoever controls your email can reset everything else.
If a password hash leaked rather than the password itself, do the same. Short and common passwords are recovered from their hashes quickly.
Use a different password for every site
Reuse is what turns one breach into many. A password manager creates a long, unique password for each account and fills it in for you, so you only remember one.
Turn on two-factor sign-in
With two-factor sign-in, a leaked password alone doesn’t get anyone in. An authenticator app or a passkey is stronger than text-message codes, which can be intercepted if your number is moved to another SIM.
Check your important accounts for intruders
In your email account especially, look for things you didn’t set up:
- sign-ins from devices or places you don’t recognise
- forwarding rules or filters that send your mail elsewhere
- a changed recovery email address or phone number
- apps or services you didn’t connect
Sign out of all sessions after changing the password, and remove anything you don’t recognise.
Expect phishing that uses the leak
Scammers write to breach victims pretending to be the breached company, a bank or a delivery service, using the real details from the leak. Don’t follow links in messages about the breach. Go to the site or call the company yourself.
Protect your phone number if it leaked
Ask your carrier for a port-out PIN or number lock so the number can’t be moved to another SIM without it, and move important accounts from text-message codes to an authenticator app or a passkey.
Protect your credit if financial or ID data leaked
If a card number leaked, tell your bank; they will usually replace the card. If your Social Security number, date of birth or ID documents leaked, in the US you can freeze your credit for free with Equifax, Experian and TransUnion, which stops new accounts being opened in your name. Elsewhere, ask your national credit agencies about a freeze or fraud alert.
Watch your bank and card statements for charges you don’t recognise for the next few months.
Check again from time to time
Breach data often surfaces months or years after the breach. Search your addresses again every few months, and whenever a service you use announces a breach.
What to do after a data breach
A breach notice, or your address turning up in a search, is worth an hour of your time. Here is what to do, in the order that matters, depending on what leaked.
The full records are on Seer
This site shows how many breach records hold what you searched, and a masked sample of them. The check is run by Seer, which shows the full records: which breach each came from, when, and what leaked with it.
Seer also searches stealer logs, the records malware takes from infected devices, and finds the social accounts tied to an email address, username or phone number.
Try Seer’s free check- Breached credentialsEvery record an email address, username, phone number or domain appears in.
- Stealer logsLogins captured by malware on infected devices, searchable by email, username or domain.
- Social accountsAccounts on 740+ platforms by username, 106 by email address and 20 by phone number.
- Plans and pricingWhat a free account includes, and what the paid plans add.