What To Do Immediately After a Data Breach (Step-by-Step)

Every day, billions of stolen credentials sit on dark web forums waiting to be used. If you've just found out your email was in a breach, don't panic — but do act fast. Here's exactly what to do.

Step 1: Change Your Password Immediately

Change the password for the breached service first. Use a long, random password — at least 16 characters. Don't reuse it anywhere.

Step 2: Check If You Reused That Password

This is the real danger. If you used the same (or similar) password on other accounts — especially email, banking, or social media — change those too. Attackers use a technique called "credential stuffing" where they try leaked passwords on hundreds of other sites automatically.

Step 3: Enable Two-Factor Authentication (2FA)

Even if an attacker has your password, 2FA stops them getting in. Use an authenticator app (Google Authenticator, Authy) rather than SMS where possible.

Step 4: Watch for Phishing

Breached email addresses get sold to spammers and phishers. Be extra cautious of emails asking you to click links or enter your details for the next few weeks.

Step 5: Monitor for Further Breaches

One breach often precedes others. Set up continuous monitoring with BreachWatch so you're the first to know if your email appears in any new leaked database.

The most important thing: act quickly. Most account takeovers happen within hours of credentials being posted.