The email usually arrives on an ordinary afternoon, and it’s rarely written to alarm you. A company you may barely remember “recently became aware of an incident involving unauthorized access.” It might be a pharmacy, a hotel chain, or a shop where you once bought a single pair of running shoes. The letter offers vague reassurance, a block of legal language, and perhaps a year of free credit monitoring.
Most people react in one of two ways: they panic and start changing everything at random, or they sigh and archive it. Neither helps much. A breach notice is best treated like a small kitchen fire. It’s rarely a catastrophe, but it deserves prompt attention and a set order of steps. The whole routine takes less than an hour, and most of the value comes from doing the right things first.
First, Make Sure the Notice Is Real
Breach notices are a favorite costume for scammers, because they arrive with built-in urgency. So before you click anything, treat the message itself as a possible attack.
Don’t use the links in the email. Instead, open a new browser tab and type the company’s address yourself, then look for a security notice on its site or in its newsroom. Large breaches also tend to get press coverage, so a quick search of the company’s name plus “breach” will usually confirm whether the incident happened. Free services such as Have I Been Pwned let you check whether your address appears in known breach data, though a recent incident may not be listed yet.
Be especially wary of any message that asks you to “verify your identity” by entering your password, Social Security number, or card details. A legitimate notice tells you what happened and what you can do. It doesn’t need you to hand over more information, and no real company will call you to ask for a one-time login code.
Work Out What Was Actually Taken
The right response depends on the type of data involved, and a well-written notice will say. Skim past the apology and find the sentence listing what was exposed, then sort it into one of three rough categories.
Login details. If passwords were exposed, even in scrambled or “hashed” form, your priority is changing them, here and anywhere else you used the same one.
Financial details. A leaked card number is annoying but very fixable, since your bank can cancel and reissue it, usually from within its app. Leaked bank account numbers call for a conversation with the bank about extra monitoring or a new account.
Identity details. Your full name paired with a date of birth, a government ID number, or a passport scan is the most serious category, because you can’t simply reissue your birthday. This calls for the credit steps described below.
A leak of only your name and email address is the mildest case. You don’t need to do much beyond staying alert for convincing phishing messages, which may now mention details like your recent orders or your account with that company.
Change the Password That Matters Most, Then Hunt for Its Twins
If a password was involved, change it on the affected site, but don’t stop there. The greater danger is reuse. Attackers routinely take leaked email-and-password pairs and try them automatically on banks, email providers, and shopping sites. It’s a cheap attack, and it succeeds because so many people recycle the same few passwords.
Try to remember where else you’ve used that password, or something close to it. “Summer2019!” and “Summer2021!” count as the same password to an attacker, since tools that test leaked credentials try those small variations as a matter of course. If you use a password manager, its security report can often flag duplicates in seconds. If you don’t, start with the accounts that would hurt most to lose: your main email first, because it can reset almost everything else, followed by banking, your phone carrier, and any cloud storage.
Each replacement should be long, random, and unique to that site. People are terrible at inventing randomness, and our “random” choices tend to feature pets, sports teams, and birth years, so let a machine handle it. Your password manager can do this, or you can use a free password generator to produce something like a 16-character string, and then save it somewhere safe rather than trying to memorize it.
While you’re in those settings, turn on two-factor authentication for your most important accounts. An authenticator app or a hardware key is stronger than a text message code, but any second factor is much better than none, because a stolen password alone will no longer get anyone in. It’s also worth glancing at the list of active sessions and connected devices, which many services display in their security settings. If you see a tablet in a city you’ve never visited, sign it out.
Lock Down Your Credit If Your Identity Data Leaked
If government ID numbers or similar details were exposed, your concern shifts from your accounts to new accounts opened in your name. Monitoring tells you about this after it happens, which is why the free credit monitoring in the breach letter is useful but not sufficient. A credit freeze is more effective, as it stops most lenders from viewing your credit file, which makes it much harder for a fraudster to open a card or loan.
In the United States, freezes are free by federal law, and you place one separately with each of the three major bureaus: Equifax, Experian, and TransUnion. Doing all three takes about fifteen minutes online. You can temporarily lift the freeze when you apply for credit yourself, so the inconvenience is small. Many other countries have a similar option, sometimes called a security freeze or a protective registration, so it’s worth checking what your national consumer agency recommends.
Also note the date of the notice and keep a copy of it. If fraud shows up months later, a record of the incident makes disputes easier and helps you connect the dots.
Set a Reminder for Next Month
The hour after a breach is only part of the job, because stolen data doesn’t always get used right away. It can sit for months before being sold, bundled with other leaks, and put to work. So put a recurring reminder in your calendar, perhaps for 30 and 90 days out, to look over your bank and card statements for small unfamiliar charges, which fraudsters often use to test whether a card works. Check your credit reports too, if identity data was involved.
Be particularly skeptical during this time of messages that refer to the breached company. “We noticed your account was affected, click here for your compensation” is exactly the sort of follow-up scam that tends to appear after a major incident makes the news.
A Routine You Only Have to Learn Once
Breaches are now routine enough that most of us will receive several of these letters over the years, largely through no fault of our own. You can’t control how well a retailer protects its customer database. You can control how much damage a leak can do once it reaches you: confirm it’s real, identify what was taken, replace reused passwords, freeze your credit if needed, and check back later. Run through those steps once and the next notice becomes a chore instead of a crisis.