iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If a service says your password was exposed, change it promptly on that service and anywhere else you reused or closely based it. Then secure your email and other important accounts with unique passwords, stronger available multifactor authentication (MFA), and recovery details you control. A breach notice alone does not mean your device is infected or that someone accessed every account.
What should you do first after a data breach?
- Read the breach notice. Check what information the company says was exposed and follow its official guidance for that data. A stolen password calls for credential changes; exposed personal information may require a different response.
- Change the password on the affected service. The Federal Trade Commission (FTC) says to change it right away if a company reports losing it in a breach. Use a new password that you do not use elsewhere. FTC password guidance
- Change any reused or similar passwords. Update them on other services too, making every replacement unique. You do not need to change unrelated passwords unless those accounts show suspicious activity.
- Secure your email and high-impact accounts. Start with your email, then consider bank, credit-card, payment, social-media, and tax-filing accounts. An attacker who controls your inbox may be able to receive password-reset links for other services. FTC password guidance
- Turn on MFA and check recovery options. Prefer an authenticator app or security key over text or email codes when the service offers one you can use. Verify that the recovery email and phone number belong to you and are accessible.
- Respond to other exposed data as needed. Follow the notice’s instructions for the specific information involved. If your personal information is being used, the FTC directs consumers to IdentityTheft.gov and its breach guidance.
A password manager is optional, but the FTC recommends considering one to create and keep track of complex, unique passwords. It is a convenience for putting unique passwords into practice, not a required purchase. FTC password guidance
Which MFA method should you choose?
MFA requires another factor in addition to your password. The strongest option you can actually enable depends on the affected service’s support and your devices. In its comparison of common two-factor methods, the FTC calls security keys the strongest and advises choosing an authenticator app or security key over text or email codes when available. FTC MFA guidance
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Method | What to know |
|---|---|
| Security key | A physical second factor; the FTC describes it as the strongest common method in its guidance. The account and device must support the key. |
| Authenticator app | An option the FTC advises choosing over text or email codes when the service offers it. |
| Text or email code | A second-factor option, but the FTC advises preferring an authenticator app or security key when available. |
Before relying on any method, check the provider’s instructions for compatible devices and whether you can keep a backup sign-in method. Consider how you would regain access if your phone or physical key were lost. The FTC guidance does not establish universal compatibility or compare individual key models. FTC MFA guidance
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do you secure an email account?
Treat email as a priority because it is often used to reset passwords elsewhere. If its password was exposed or reused, replace it with a unique one, enable the strongest MFA option the provider supports, and check that its recovery email and phone number are yours. The FTC recommends enabling MFA on email and other consequential accounts such as financial, social-media, tax-filing, and payment services. FTC MFA guidance
What if you are locked out or the account was taken over?
Use the affected provider’s official account-recovery process; recovery methods differ by service, so follow that provider’s instructions rather than relying on a generic workaround. FTC guidance for hacked email or social-media accounts recommends taking these steps after you regain access: FTC hacked-account guidance
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Change the password and make it unique.
- Sign out of other devices or sessions.
- Turn on two-factor authentication.
- Confirm that recovery contact details are yours and that any recovery codes or contact are set up and stored according to the provider’s instructions.
- Inspect email forwarding rules, sent and deleted folders, and contacts or messages you do not recognize. Alert your contacts if the account sent suspicious messages.
Recovery can require more than routine sign-in. NIST’s SP 800-63B-4 (July 2025) describes possible approaches such as repeating identity proofing, using a prearranged recovery contact or recovery code, or using an authenticator still linked to the account. These are standards-level examples, not a guarantee that every service offers each option. NIST says a recovery event generates one or more notifications to help the subscriber detect fraudulent recovery; check your account notifications and act on any recovery you did not request.
When should you check your device?
A breach notification by itself is not evidence that your computer or phone is infected. If you suspect the device itself was compromised, FTC advice for hacked-account recovery includes updating computer security software and running a scan. That step is relevant to suspected device compromise, not an automatic requirement after every breach notice. FTC hacked-account guidance
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How should you handle exposed personal information?
Let the breach notice guide your response: the next steps depend on what information was exposed and whether it is being misused. The FTC points people whose personal information is being used to IdentityTheft.gov for tailored guidance. No single response—such as paid monitoring or a credit freeze—is established as necessary for every breach scenario by the guidance cited here. FTC breach guidance
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How can you make account recovery safer in advance?
- Keep recovery email and phone details current and under your control.
- Save recovery codes securely if the provider offers them, and follow its instructions for any recovery contact.
- Choose security-question answers that cannot be guessed from public information or found online. If a service requires answers, treat them like passwords and use unique answers rather than reusing personal facts. FTC password guidance
- Keep a backup MFA method where the service permits one, and understand the provider’s process for replacing a lost device or key.
NIST’s recovery standard describes notifications and potentially longer waits for account recovery than for routine authentication. The exact steps, available methods, and timing are set by each provider. NIST SP 800-63B-4
Quick Recap
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
