What to Do After a Data Breach: A Step-by-Step Recovery Plan

A breach notification rarely arrives at a good time. Sometimes it's an email from a service you forgot you joined. Sometimes it's a headline naming a company you use every single day. The instinct is either to panic or to shrug — and neither one helps. What helps is a short, ordered plan: find out what was exposed, cut off access, then watch for the fallout. Most of this takes an afternoon. A little of it turns into a habit.

Step 1: Establish What Was Actually Exposed

Start with the notification itself, but don't trust the link inside it. Open a new tab, type the company's address yourself, and log in from there. Breach emails are prime phishing material, and convincing fakes appear within hours of real news.

Then work out which category of data was involved, because the response is different for each:

• Email address only: expect more spam and better-crafted phishing. Little to change, but be suspicious of unexpected messages.
• Password, even if encrypted: change it everywhere that password was used.
• Payment card: review statements closely and consider requesting a replacement card.
• Government ID, Social Security number, or full date of birth: the serious tier. This can support identity theft for years, so plan for ongoing monitoring.

If the company is vague about what leaked, a breach-notification service such as Have I Been Pwned can show you which known breaches include your email address. It won't catch everything, but it's a fast way to see your exposure across dozens of sites at once.

Step 2: Change Passwords, Starting With Your Email

Your email is the master key. Whoever controls it can trigger password resets on almost everything else you own, so it goes first. After that, work outward by value:

1. Primary email account and its recovery address
2. Banking, credit cards, payment apps, retirement and investment accounts
3. Mobile carrier account, cloud storage, and any tax or government portal
4. Social media and messaging accounts
5. Shopping, streaming, and everything else

Change the breached password everywhere it was reused. Reuse is what turns one leaked site into ten compromised accounts. Don't just tack a digit onto the end — moving from "Summer2023!" to "Summer2024!" is one of the first patterns an attacker tries, and cracking tools test those variations automatically.

Aim for at least 16 characters. A passphrase of four or five random words is easier to remember and harder to guess than a short jumble of symbols. If you take one tool away from this article, make it a password manager: you memorize a single strong passphrase, it generates and stores the rest, and changing a password after a breach becomes a two-minute chore instead of a weekend project.

Step 3: Turn On Two-Factor Authentication

A stolen password is useless to an attacker who also needs a second factor. Enable it right after you change passwords, again starting with email.

• An authenticator app or a hardware security key is stronger than SMS codes, which can be intercepted through a SIM swap. SMS is still far better than nothing.
• Save your backup codes offline — printed or written down somewhere you'll actually find them.
• Never approve a login prompt you didn't trigger. Attackers sometimes flood your phone with prompts hoping you'll tap "approve" to make it stop.

Step 4: Look for Signs Someone Already Got In

Changing a password doesn't remove access someone established earlier. Go looking:

• Email: check the sent folder and trash, but more importantly check forwarding rules and filters. A hidden rule that forwards your mail to a stranger or quietly files security alerts out of sight is a classic move. Also confirm your recovery email and phone number are still yours, and sign out of all active sessions.
• Bank and cards: scan statements for small test charges and unfamiliar payees.
• Social and messaging: look for posts, friend requests, or messages you didn't send.
• Cloud and apps: review connected devices, third-party app permissions, and shared files.

If you find evidence of intrusion, repeat the order: secure your email, reset the affected account, then contact the provider's support with a clear timeline of what you found and when. Specifics get faster help than "I think I was hacked."

Step 5: Monitor, and Know When to Escalate

For most breaches, a few weeks of attention is enough. If identity documents or financial details were involved, plan for longer. Turn on transaction alerts, review statements on a schedule rather than when you remember, and expect a wave of targeted phishing that references the breach by name. Verify anything urgent by navigating to the site yourself.

Where a leak involves your ID numbers, a credit freeze can stop new accounts from being opened in your name, and you can lift it later when you need to apply for credit. Rules and costs vary by country, so check what applies where you live.

This is general account-security guidance, not legal or financial advice. If your government ID or bank details were exposed, your bank or a qualified adviser in your country can tell you what steps are appropriate.

Make the Next Breach Boring

• Use a unique password on every account, managed by a password manager.
• Leave two-factor authentication on everywhere it's offered.
• Keep your phone, browser, and operating system updated.
• Use a separate email address for shopping and newsletters so a leak there doesn't point at your main inbox.
• Check breach lists twice a year, and whenever a major incident hits the news.

The Order That Matters

Email password first, then two-factor, then financial accounts, then everything else — and then a few weeks of paying attention. That sequence covers the vast majority of real-world damage. A breach is unpleasant, but it's rarely catastrophic for people who act within the first few days. It's the notices that get ignored, the reused passwords left in place for years, that cause the trouble. Spend an hour now, and the next notification becomes a chore instead of a crisis.

Photo: Michael / Pexels