Your Data Was Leaked. Now What?

An email arrives saying a company you use has suffered a data breach. Your first reaction may be panic, or you may simply delete it. Neither helps. Most breaches expose only part of your information, and a clear sequence of actions can reduce the damage a lot. This guide gives you an order to work in, starting with the steps that matter most.

Step 1: Confirm the notice is genuine

Criminals know that breach notices make people nervous, so they send fake ones. Before clicking anything, check the message carefully.

• Do not use links or phone numbers in the email. Open the company website by typing the address yourself, or use its official app.
• Look for a notice on the company official site or support pages.
• Be suspicious of urgent threats, requests for your password, or demands for payment to "secure" your account.
• Check the sender address for small misspellings.

You can also search for your email address on a reputable breach-notification service to see which known leaks include it. Type the address of that service yourself and never reuse your real password there.

Step 2: Work out what was exposed

The right response depends on the type of data. Read the notice for a list of what was taken, then use this table to decide how urgent each item is.

Step 3: Change passwords, most important first

Start with the account that was breached, then move to anything sharing the same password. Attackers try leaked passwords on other services, a technique called credential stuffing, so reuse is the real risk.

1. Change the breached account password to a long, unique one.
2. Change your email account password next. Email controls password resets for nearly everything else.
3. Then change banking, shopping, cloud storage and social media accounts that used a similar password.
4. Use a password manager so that each account gets its own random password without you memorising them.

While you are there, sign out of all other sessions or devices if the service offers that option, and review recovery email addresses and phone numbers in case someone added their own.

Step 4: Turn on two-factor authentication

Two-factor authentication means a stolen password is not enough to get in. Where possible, choose an authenticator app or a hardware security key over text messages, because text messages can be intercepted in some attacks. Save the backup codes somewhere safe and offline.

Step 5: Protect your money

If payment details were exposed, contact your card issuer using the number printed on the card. Ask them to replace the card or monitor it. Review recent statements line by line and report any charge you do not recognise. Many fraud attempts begin with tiny test payments, so small unfamiliar amounts matter too. Turn on transaction alerts in your banking app so that you hear about charges immediately.

Step 6: Guard against identity theft

If identifying details such as a national ID number, passport data or tax number were included, take extra steps. Rules differ by country, but common options include:

• Placing a fraud alert or credit freeze with credit reporting agencies, where these exist in your country.
• Checking your credit report for accounts you did not open.
• Using any free monitoring service the breached company offers, after verifying the offer on its official site.
• Filing a report with your national identity theft or consumer protection authority if you find misuse.

A credit freeze usually costs nothing and can be lifted temporarily when you need to apply for credit.

Step 7: Expect follow-up scams

After a leak, attackers often use the stolen details to sound convincing. A message may mention your real name, an order you actually made or a last-four-digits card number. Treat these rules as fixed:

• A genuine company will not ask for your full password or one-time codes by phone, email or chat.
• Hang up and call back using an official number if someone claims to be from your bank.
• Do not open unexpected attachments, even if the message uses your name.
• Be wary of urgency. Pressure is a tactic.

Step 8: Keep watching and reduce future exposure

Breach effects can appear months later. Set a reminder to check your statements and credit reports every few months. To reduce future harm, delete accounts you no longer use, share only the details a service really needs, and consider using email aliases or a separate address for shopping and sign-ups. Companies cannot leak what they never held.

Frequently asked questions

Do I need to change my password if only my email was leaked?

Not necessarily, but it is wise to check that your email password is unique and has two-factor authentication. Expect more phishing aimed at that address.

Can I sue the company or get compensation?

That depends on local law and the circumstances. Some regions have strong data protection rules that require companies to notify you. Keep the notice and any evidence of harm, and consult a consumer or legal advice service if you suffered losses.

Is it safe to use the credit monitoring offered after a breach?

Often it is a useful free benefit, but confirm the offer through the company official website rather than the email link. Read what data the monitoring service collects before enrolling.

Should I close the affected account?

If you no longer use the service, yes. Request deletion of your data, and change passwords first so nobody else can use the account in the meantime.

Conclusion

A data breach is stressful but manageable. Verify the notice, find out what was exposed, secure your email and passwords, protect your money and identity, and stay alert to scams for the next few months. Doing these steps in order turns a worrying email into a short checklist, and good habits such as unique passwords and two-factor authentication make the next breach far less damaging.