Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Change the breached account’s password immediately, replace any reused or similar password elsewhere, secure your email, and turn on multi-factor authentication (MFA). Then check what information the company says was exposed and use the provider’s official recovery process if you see evidence of unauthorized access.
A breach notice means information was exposed in an incident; it does not, by itself, prove that someone logged in to your account. The right response depends on the data involved and on whether the account still behaves normally.
What a breach notice does—and does not—tell you
Read the company’s notice before deciding how far to escalate. Look for the incident date, the date your information was discovered, the categories of data involved, and whether the company says passwords or authentication data were included. A notice may describe exposed records without confirming that an attacker used them.
The Federal Trade Commission (FTC) warns that scammers buy credentials stolen in data breaches, using a username and password to try the account where the breach happened. That is why a password change is urgent even when you have seen no suspicious activity.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Exposed information versus account takeover
- Exposure: A company says your data was included in a compromised database or system. You may still have full control of the account.
- Suspected takeover: You see password-reset messages you did not request, unfamiliar sign-ins, changed recovery details, messages you did not send, purchases you did not make, or you can no longer log in.
- Confirmed takeover: The provider or your own investigation shows that another person accessed or changed the account.
Start with the exposure response below. Move to the takeover procedure as soon as you see any sign that an intruder entered the account.
Use this 15-minute response plan
- Verify the notice without using its links. Open the company’s app or type its known web address yourself. Find the security or incident message in your account, or contact support through a channel you already trust. A breach announcement can be copied by phishing criminals.
- Record what was exposed. Note whether the notice mentions a password, username, email address, phone number, security questions, payment details, Social Security number, bank information, or other identity data. Keep the notice for your records.
- Change the affected account’s password. Use the account’s Security, Password, or Login settings. Create a password that has never been used on another service.
- Replace reused and similar passwords. Search your password manager or browser’s saved-password area for the old password, and change every account that used it or a recognizable variation. Attackers test combinations across many services.
- Secure your primary email account. Email often receives password-reset links, so change its password if it was reused, enable MFA, review recovery addresses and phone numbers, and remove sessions or devices you do not recognize.
- Turn on MFA. In the affected account, open Security or Account settings, choose Two-factor authentication, Multi-factor authentication, or Login verification, and follow the provider’s setup instructions. Prefer a security key or authenticator app when offered; use text or email codes when stronger methods are unavailable.
- Review active sessions. Use labels such as Devices, Where you’re logged in, Sessions, or Sign out of all devices. End sessions you do not recognize and, when available, sign out everywhere after changing the password.
- Check for account changes. Inspect recovery email addresses, phone numbers, forwarding rules, connected applications, recent messages, orders, payment methods, and security notifications.
- Use data-specific guidance. If the notice includes a Social Security number or bank information, follow the FTC-referenced guidance at IdentityTheft.gov for the exposed data category and use the institution’s official fraud channel where appropriate.
Create passwords that contain no dominoes
The goal is not a particular password product. The goal is a different, difficult-to-guess password for every service. A breach at one company should not provide a working key to your email, banking, workplace, or social accounts.
Use a password manager if it fits your routine
The FTC recommends considering a password manager for complex, unique passwords. A manager can generate random passwords, save them, and fill them without requiring you to memorize each one. Protect the manager itself with a strong master password and MFA, and make sure you understand its account-recovery options before relying on it.
Browser and phone tools are also valid
Most current browsers and mobile operating systems can generate and save unique passwords. Open the browser or device settings, find Passwords or Password Manager, and use its generate-and-save option when changing an account. This approach is useful if you already keep your devices locked and synchronized; it is not necessary to buy a separate service.
| Approach | Strength | Practical considerations |
|---|---|---|
| Password manager | Can generate and store long, random passwords for many accounts | Requires protecting one master account and planning recovery access |
| Built-in browser or mobile password tool | Provides generation and autofill without another subscription | Works best when you use the same protected browser or device ecosystem consistently |
| Memorized passwords | Simple for a small number of accounts | People often reuse or slightly vary them, which increases damage from a breach |
Do not make predictable variations
Changing Spring2025! to Spring2025!2 is not a meaningful defense when the original password is known. Do not append a company name, year, or symbol to a password used elsewhere. Generate a genuinely new value, and never send it to someone who asks by email, text, phone, or social message.
Choose the strongest MFA method the account supports
MFA adds a factor beyond the password. If a criminal obtains the password in a breach, the second factor can still block the login. The FTC describes security keys as the strongest method among the options in its consumer guidance, with authenticator apps generally stronger than text or email codes.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
| Method | How it works | Use it when | Important limitation |
|---|---|---|---|
| Security key | A physical key confirms the login using encryption. The FTC says security keys use encryption to confirm that the key is associated with your account. | The service supports a FIDO-compatible or other listed hardware key, especially for email, financial, administrator, and work accounts. | A physical key works only where the provider supports it. Register a backup method or spare key according to the provider’s instructions. |
| Authenticator app | An app generates time-based codes or approves a sign-in. | The service offers app-based MFA and you can keep the enrolled device available. | Save the provider’s recovery codes and follow its transfer process before replacing or losing the phone. |
| Text or email code | The provider sends a one-time code to your phone number or email address. | No stronger option is available. | Phone-number or email compromise can expose the code. Never disclose a code to an unsolicited caller or message sender. |
Set up MFA without locking yourself out
- Sign in through the provider’s official app or site, not a link in an unexpected message.
- Open Settings → Security or the equivalent account-security page.
- Select Two-factor authentication, Multi-factor authentication, or Login verification.
- Choose the strongest supported method, enroll it, and complete a test sign-in.
- Save recovery codes offline or in a protected password manager. Do not store them in an unprotected public note.
- Add a backup method only if the provider recommends it and you can protect it. Review the list later and remove devices or methods you no longer control.
An unexpected request for an MFA code is a warning sign. The FTC specifically cautions against sharing verification codes with unsolicited contacts. End the conversation and open the account directly to inspect security activity.
Match your response to the information exposed
Do not assume every breach requires the same remedy. Use the notice’s exact categories to decide which accounts and institutions need attention.
| Data named in the notice | Immediate action |
|---|---|
| Password, username, or login token | Change the password on the affected service and every account where it was reused or slightly modified. Enable MFA and terminate unfamiliar sessions. |
| Email address or phone number | Expect targeted password-reset and phishing messages. Secure the email account, check recovery details, and verify requests through independently opened provider channels. |
| Security questions or answers | Change the answers anywhere they were reused. Prefer answers that are not publicly discoverable, and use MFA so a question alone cannot authorize a login. |
| Payment-card or bank information | Use the financial institution’s official fraud or security contact and follow the data-specific steps in the FTC-referenced IdentityTheft.gov guidance. |
| Social Security number or other identity information | Follow IdentityTheft.gov’s breach guidance for that category. Keep the company’s notice and any case numbers, and be wary of callers promising to “restore” your identity. |
If the notice does not say what was exposed, ask the company through an independently verified support channel. Do not provide additional personal information merely to receive a generic explanation.
Secure your email before other accounts
Email is the reset hub for many services. An attacker who controls it can request password resets, read security alerts, add forwarding rules, or remove your recovery options.
Email-account checklist
- Change the email password to a unique one.
- Enable a security key or authenticator app if offered.
- Review recovery email addresses, phone numbers, trusted devices, and active sessions.
- Inspect forwarding rules, filters, automatic replies, and delegated access for changes you did not make.
- Check sent, deleted, and archived folders for messages or reset requests you do not recognize.
- Review connected applications and revoke access that you no longer need.
Complete these checks from a device and network you trust. If the provider reports unusual activity or blocks the account, use its official recovery process rather than repeatedly guessing passwords.
Free tools Windows power users keep installed
One-click scans. No signup required.
What to do if the account was taken over
Use this branch when you are locked out or find evidence that another person accessed the account. Providers use different forms, identity checks, and waiting periods, so follow the instructions on the provider’s official recovery page or app.
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
Before recovery
- Write down the account’s original email address, previous passwords you remember, approximate creation date, and recent legitimate activity. This can help the provider’s verification process.
- Use a clean, trusted device and independently navigate to the provider. Do not use a recovery link sent by an unsolicited contact.
- Warn close contacts through a separate channel if the compromised account may have sent messages or payment requests in your name.
After you regain control
- Change the password immediately to a unique value.
- Sign out all devices and terminate active sessions.
- Enable MFA, choosing a security key or authenticator app where supported.
- Verify recovery email addresses and phone numbers; remove additions you did not authorize.
- Inspect messages, orders, payment methods, profile changes, connected apps, forwarding rules, and other activity for unauthorized actions.
- Notify the provider through its security channel about the takeover and preserve any case number or confirmation.
Do not assume that changing the password alone removed an intruder. A still-authorized session, recovery address, forwarding rule, or connected application can provide continued access.
Expect phishing that uses the breach as a pretext
News of a breach gives criminals a convincing reason to contact you. They may claim to be the breached company, a bank, a security team, or an identity-recovery service. Their goal may be your password, an MFA code, payment details, or remote access.
Safer verification habits
- Do not click a password-reset or compensation link in an unexpected message.
- Do not read an MFA code to a caller or type it into a page reached from an unsolicited message.
- Open the provider’s app or type a known address yourself, then look for security notices.
- Use the telephone number printed on a statement or shown inside the official app instead of a number supplied by a message.
- Check the sender and destination carefully, but remember that a familiar-looking address can still be forged.
A legitimate support agent will not need your one-time code to “cancel” a login. If someone pressures you to act immediately, stop and verify through a separate channel.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPrioritize accounts instead of trying to change everything at once
If you have many accounts, work from the ones that can unlock or financially affect the others. Keep a simple inventory with the service name, email used, password-change date, MFA method, recovery options, and notes about any suspicious activity.
| Priority | Accounts | Reason |
|---|---|---|
| 1 | Primary email and other email accounts | Password-reset links and security alerts usually arrive there. |
| 2 | Financial, payment, payroll, and government-service accounts | Unauthorized access can create direct financial or identity harm. |
| 3 | Work, school, cloud-storage, and administrator accounts | One compromised login may expose shared files or other users. |
| 4 | Social, shopping, travel, and subscription accounts | These accounts can be abused for impersonation, purchases, or further phishing. |
| 5 | Any account that reused the breached password | Reuse, not the account’s popularity, determines how quickly the breach can spread. |
Common mistakes and how to correct them
Changing only the breached account
Why it fails: A reused password remains valid elsewhere.
Correction: Search your saved passwords for the old value and replace every match and close variation.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
Using the same new password everywhere
Why it fails: A later breach can expose all accounts again.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Correction: Generate a unique password for each service with a password manager or built-in browser tool.
Choosing email or text MFA when a stronger method is available
Why it fails: The email account or phone number may be compromised separately.
Correction: Choose a security key or authenticator app where the provider supports it, and preserve recovery access.
Clicking the breach-notice link
Why it fails: Criminals can imitate a real notification and capture the replacement password or MFA code.
Correction: Navigate independently to the provider’s app or known address.
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
Stopping after the password change
Why it fails: Attackers may still have an active session, changed recovery contact, forwarding rule, or connected application.
Correction: Sign out all devices, inspect security settings and activity, and remove unauthorized access.
Assuming a notice proves a takeover
Why it fails: Exposure and unauthorized login are different events, and unnecessary panic can lead to unsafe calls or payments.
Correction: Treat the password as exposed, then look for concrete account-activity evidence and use the appropriate recovery branch.
Keep evidence and use official channels
Save the breach notice, the company’s incident reference, support case numbers, suspicious messages, and dates of password or MFA changes. Do not forward sensitive evidence widely; store it in a protected location. When you need help, begin from the company’s known app or website, your financial institution’s statement or official app, or the FTC’s consumer guidance. Avoid anyone who contacts you first and asks for a password, verification code, remote-control access, or an upfront payment.
The FTC’s consumer pages Have you been affected by a data breach? Read on., Use Two-Factor Authentication To Protect Your Accounts, and Creating Strong Passwords and Other Ways To Protect Your Accounts provide the general steps above; the last page identifies November 2024. Its guidance on recovering a compromised account is titled How To Recover Your Hacked Email or Social Media Account. CISA’s More than a Password guidance also explains why MFA protects an account beyond the password.
Quick Recap
When you are finished
- The breached password is changed and is not used anywhere else.
- Your email account has a unique password, MFA, correct recovery details, and no unauthorized forwarding or connected apps.
- High-impact accounts have MFA, preferably a security key or authenticator app where supported.
- All unfamiliar sessions, devices, recovery methods, and account changes have been removed or reported.
- You know which data category was exposed and have followed the corresponding IdentityTheft.gov or institution-specific guidance.
- You can recognize and independently verify breach-related messages instead of sharing codes or credentials.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
