Your Data Was in a Breach. What Should You Do?
Companies get hacked, and customer data such as emails, passwords, phone numbers and addresses can leak. You might receive a notice from a company or a warning from your password manager. Here's what to do.
Check if you're affected
- Enter your email at Have I Been Pwned, a well-known free service, to see which breaches include it.
- Check your password manager's security report.
- Google's Password Checkup and Apple's Passwords app warn about compromised passwords.
Understand what leaked
| Data exposed | Risk | Action |
|---|---|---|
| Email only | More spam and phishing | Be extra alert to phishing |
| Password | Account takeover | Change it everywhere it was used |
| Phone number | Scam calls, SMS phishing, SIM swap attempts | Protect SIM, ignore unknown callers |
| Card details | Fraudulent charges | Contact bank, replace card |
| ID numbers | Identity fraud | Monitor accounts, report misuse |
Change passwords
Change the password on the breached service, and anywhere else you used the same or similar password. Use unique passwords from a password manager.
Turn on 2FA
Two-factor authentication stops attackers even if they have your password. See setting up 2FA.
Watch for follow-up scams
Scammers use breach news to send fake emails like "Your account was compromised, click here to secure it." Always go to the website directly. See spotting phishing.
Monitor financial accounts
Check bank statements for unknown transactions, and set up transaction alerts.
Close old accounts
A breach is a good reminder to delete accounts you no longer use. See reducing your digital footprint.
Reduce damage from future breaches
You can't stop companies being hacked, but you can limit how much a breach affects you:
- Unique passwords everywhere so a leak in one place doesn't unlock others.
- 2FA on important accounts, ideally with an authenticator app or passkey.
- Give less information when signing up: skip optional fields like date of birth or address.
- Use email aliases for shopping and newsletters.
- Don't save cards on websites you rarely use.
- Delete unused accounts so there's less data to leak.
Set up breach alerts
Several free tools notify you of new breaches:
- Have I Been Pwned lets you subscribe to notifications for your email.
- Google Password Manager and Chrome warn about compromised saved passwords.
- Apple Passwords shows security recommendations.
- Many password managers include breach monitoring.
ID documents leaked?
If a breach included ID card or passport details, watch for fraudulent use such as new SIM registrations or loans in your name. In some countries you can check which SIMs are registered to your ID through official services. Report misuse promptly to the relevant authorities.
Frequently asked questions
Should I delete the account from the breached company?
If you don't use it, yes. If you do, change the password and turn on 2FA.
Can I stop my data being sold?
Once leaked, data can't be fully recalled. Focus on protecting accounts and staying alert.
Keep reading
What Is a VPN and Do You Actually Need One?
A plain-English explanation of VPNs: what they protect, what they don't, when they're useful, and how to choose a trustworthy one.
SIM Swap Scams: How Criminals Steal Your Phone Number
Learn how SIM swap fraud works, the warning signs, and how to protect your bank and accounts that rely on SMS codes.
10 Signs Your Account Has Been Hacked (and What to Do)
Recognise the warning signs that your email, social media or other accounts are compromised, and take back control quickly.