iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
After a data breach, read the notice to see what information was exposed. Change the affected password and any reused or similar passwords, turn on multi-factor authentication, protect your credit if sensitive identity data was exposed, and verify any follow-up message through a contact method you already trust. The Federal Trade Commission (FTC) recommends acting quickly; many of the most important protections are free.
What should I do after a data breach?
- Read the breach notice. Identify whether it names passwords, Social Security numbers, payment details, or other personal information. The right next steps depend on what was exposed.
- Secure affected accounts. Change the exposed password and any reused or similar password, then enable multi-factor authentication (MFA), especially on email, financial accounts, and the breached service.
- Protect identity and credit information. If your Social Security number was exposed, get free credit reports and check for unfamiliar accounts. Consider a credit freeze or fraud alert if you want to restrict or flag new-credit applications.
- Verify follow-up messages independently. Do not use unexpected links or phone numbers in texts or emails. Contact the company using an official website address or phone number you know is real.
The FTC’s data-breach guidance lays out these initial steps. For identity information, IdentityTheft.gov provides a recovery plan tailored to what happened.
Should I change my passwords?
Change the password for the breached account and every other account where you used the same password or a close variation. You generally do not need to change unrelated passwords solely because another service was breached, but each account should have its own unique password going forward.
Choose a long replacement password; FTC guidance recommends aiming for at least 12 characters. A password manager can generate and store unique passwords, but buying one is not required. See the FTC’s password and account-security guidance.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Turn on multi-factor authentication
MFA adds a second check beyond your password. Enable it first on email, financial accounts, and the affected service. Email deserves particular attention because password-reset links often arrive there. When a service offers the choice, an authenticator app or security key is generally a stronger option than a code sent by text or email. Check that the specific service supports your chosen method.
Should I sign up for credit monitoring?
If the breached company offers free credit monitoring or identity-theft insurance, the FTC advises taking advantage of the offer. Monitoring can help you spot changes or possible misuse in your credit files, but it does not block someone from opening a new account. If your Social Security number was exposed, order free credit reports and look for accounts you do not recognize.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Monitoring, freezes, and fraud alerts work differently:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Option | What it does | Practical detail |
|---|---|---|
| Credit monitoring | Helps detect changes or possible misuse in credit files. | Take the affected organization’s free offer if available. It detects potential problems; it does not block new accounts. |
| Credit freeze | Blocks new creditors from accessing your credit report to open a new account while the freeze is active. | Free. Place it with Equifax, Experian, and TransUnion. You may need to lift it temporarily for a legitimate credit check. |
| Initial fraud alert | Asks businesses to verify your identity before opening new credit. | Free. Contact one bureau; it must notify the other two. It lasts one year and can be renewed. |
| Extended fraud alert | Asks businesses to take extra steps to verify identity when opening credit. | Free for people who experienced identity theft and have an FTC identity theft report or police report. It lasts seven years, subject to renewal requirements. |
For current instructions on freezes and alerts, see the FTC’s credit freeze and fraud alert guide. A freeze addresses new credit accounts; it does not stop all identity theft or protect existing bank or card accounts. If financial account details were exposed or misused, contact the bank or card issuer using its known official contact information.
Is this breach text message real?
A message may be fraudulent even if it mentions a real breach or company. Watch for urgency, claims of suspicious activity or payment problems, requests to confirm personal details, unfamiliar invoices, and unsolicited links or attachments. Do not click or reply with sensitive information. Find the company’s contact details independently and ask whether the message is genuine. The FTC’s phishing guidance advises using a phone number or website you know is real rather than details in an unexpected message.
What if I clicked the link or gave information away?
Respond according to what you disclosed or downloaded:
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
- Account password: If you can still log in, change it immediately and change reused versions on other accounts. Turn on two-factor authentication. If you are locked out, use the provider’s official account-recovery process.
- Social Security number or other identity information: Use IdentityTheft.gov for steps matched to the information exposed.
- Payment or bank details: Contact your bank, card issuer, or payment provider through a known official channel.
- Downloaded file or app: Update your device’s security software, run a scan, and remove any identified problems.
The FTC’s scam-response guidance provides additional recovery steps.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How do I report a scam text or email?
- Forward a phishing text to 7726 (SPAM).
- Forward a phishing email to reportphishing@apwg.org.
- Report the attempt to the FTC at ReportFraud.ftc.gov.
- If someone is using your personal information for identity theft, start at IdentityTheft.gov.
These reporting routes are listed in the FTC’s phishing advice.
Why can an old password breach still matter?
A password exposed in one incident can put other accounts at risk when it has been reused. In a 2022 consumer article discussing its Drizly case, the FTC said a database involving 2.5 million users included email, geolocation, passwords it described as not securely encrypted, and other demographic data. The same article says the FTC alleged an executive reused a seven-character password that had been made public in an unrelated breach. Those are details of the FTC’s account of that case, not general statistics about breach victims or password attacks. The FTC’s article is available at “Have you been affected by a data breach? Read on.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
