iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Change the exposed password immediately, replace it anywhere you reused or closely copied it, and secure your email account with multifactor authentication (MFA). Then check recovery settings and match identity-protection steps to the specific information disclosed. A breach notification alone does not prove that anyone accessed your account; signs such as changed settings, unfamiliar logins, or messages you did not send require the provider’s account-recovery process.
Follow this response order
Use the sequence below whether you received a company notice, saw your address in a breach report, or were warned that a credential database was exposed. Start with accounts that can reset or reach your other accounts: email, banking, payment services, cloud storage, and your primary phone account.
- Go to the service directly. Open its known app, use a bookmark you created earlier, or type the address yourself. Do not use a sign-in or password-reset link in an unexpected email or text.
- Change the exposed password. Create a new password that is not used anywhere else. If you reused the old password, or made only a small variation of it, change those other accounts too.
- Secure email and high-impact accounts. Use unique passwords and turn on MFA wherever it is offered, starting with email and financial services.
- Check account control. Verify recovery email addresses and phone numbers, review recent sign-ins and active sessions, and look for forwarding rules or messages you did not create.
- Respond to the data category. Social Security numbers, payment details, identity documents, and passwords each call for different follow-up. Use the free IdentityTheft.gov/databreach guidance for the categories named in the notice.
- Escalate if there is evidence of takeover. If you cannot sign in or see unauthorized changes, follow the provider’s recovery flow rather than treating the event as a routine password change.
Exposure is not the same as account takeover
A company can confirm that your email address or password appeared in exposed data without knowing whether anyone used it. Treat the credential as unsafe, but look for separate evidence that an attacker entered or changed the account.
| Situation | What you may observe | Correct response |
|---|---|---|
| Password or email listed in a breach notice | A notification, security bulletin, or warning with no unfamiliar account activity | Change the affected and reused passwords, enable MFA, and review settings. |
| Possible unauthorized access | Unfamiliar sign-in alerts, changed recovery details, new devices, password-reset messages you did not request, or settings you did not change | Use the provider’s recovery instructions, then change the password, revoke other sessions, restore your details, and inspect account activity. |
| Confirmed takeover | You cannot log in, messages were sent without you, or the attacker replaced your recovery information | Complete account recovery immediately. After access is restored, secure every session and warn contacts about fraudulent messages. |
The Federal Trade Commission (FTC) explains recovery steps in How To Recover Your Hacked Email or Social Media Account. Recovery screens and available options vary by provider and can change over time.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If a password was exposed
Change the affected credential first
Use the service’s known website or app and change the password promptly. Do not sign in through a link from an unexpected breach notification; phishing messages often imitate legitimate alerts. The FTC’s breach guidance says to change the password used with the affected company immediately.
Eliminate reuse and near-reuse
Attackers test stolen credentials against other services. Search your password records for the same password, a previous version, or a predictable change such as adding a year or punctuation mark. Replace every matching or similar credential, giving priority to email, banking, payment, shopping, health, cloud-storage, and administrator accounts. A password that is merely “different” by one character should be treated as reused.
Use a password manager if it fits your routine
A password manager can generate random credentials and keep track of which account has which password. Choose a reputable product, protect its master account with a strong unique password and MFA, and keep recovery information current. If you do not use a manager, generate a separate long passphrase for each important service and record the changes in a secure method you can maintain.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In an October 2024 hacked-account alert, the FTC used 12 to 15 characters as a target in that account-security context. It is not a breach statistic or a universal guarantee; follow the provider’s current length and character requirements, and favor a unique credential over a short reused one. See Email or social media hacked? Here’s what to do.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Secure your email account before other accounts
Email deserves early attention because password-reset links for many other services arrive in the inbox. Someone who controls your email may be able to take over accounts whose passwords were never exposed.
- Change the email password to a unique one and enable MFA.
- Open the account’s security or sign-in page and review recent logins, recognized devices, connected apps, and active sessions. Sign out devices or sessions you do not recognize.
- Confirm that the recovery email address and phone number belong to you. Remove replacements or additions you did not authorize.
- Inspect forwarding, filters, mailbox rules, delegated access, and automatic replies. Delete rules that hide security alerts or forward mail to an unfamiliar address.
- Check sent and deleted folders for messages, password-reset requests, or attachments you did not create. Warn recipients if the account sent suspicious mail.
- Update the password and MFA on your most important accounts after email is secure, because those accounts may use email for recovery.
These checks and the provider-recovery process are covered in the FTC’s password protection guidance and its hacked-account instructions.
Turn on MFA and choose the strongest available method
MFA requires an additional proof of identity, so a stolen password alone is less useful. Enable it on email, financial services, payment accounts, social networks, cloud storage, and any account that can reset another account. CISA’s Turn On MFA advice specifically highlights email and financial accounts.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches| MFA method | How it works | Practical guidance |
|---|---|---|
| Security key | A physical key confirms a sign-in | When the service supports it, the FTC identifies security keys as a stronger option than text or email codes. Check compatibility before buying; one key will not necessarily work with every service, and keep a recovery method. |
| Authenticator app | An app generates time-based codes or approves a prompt | Also identified by the FTC as stronger than text or email codes when available. Protect the phone and save the service’s backup or recovery codes securely. |
| Text message or email code | A one-time code is sent to a phone number or inbox | Use it when stronger methods are unavailable. It still adds a barrier, but possession of the phone number or email account becomes critical. |
The FTC compares these approaches in Use Two-Factor Authentication To Protect Your Accounts and More than a Password. Save backup codes offline or in a protected password manager, not in an unprotected note.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do when the account was actually taken over
Do not keep guessing passwords or repeatedly submit failed logins. Use the provider’s official “forgot password,” hacked-account, or account-recovery flow. If the attacker changed the recovery address or phone, follow the provider’s identity-verification steps and use a previously recognized device or location where the service permits it.
After you regain access:
- Set a new, unique password and enable MFA.
- Sign out all other devices and sessions, then remove unfamiliar connected apps.
- Restore your own recovery email address and phone number.
- Remove unauthorized forwarding rules, filters, delegates, payment methods, or profile changes.
- Review sent, deleted, and archived content for evidence of fraud or further compromise.
- Tell contacts to ignore suspicious messages and links sent from the account.
If you cannot complete recovery, use the provider’s published support channel, not a phone number or link supplied by a stranger. The FTC’s recovery article explains why changing the password alone is insufficient after a takeover.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Match identity-protection steps to the information exposed
Email address only
An exposed email address commonly leads to more spam and targeted phishing. Keep your existing account, use a unique password and MFA, and treat unexpected “breach” notices as untrusted until verified through the company’s known site. You generally do not need to change every password solely because an address was disclosed; change credentials when the notice says a password was exposed, when you reused one, or when account activity indicates compromise.
Recommended Free Tools
Password plus email address
Follow the password-replacement process above, including every reused or similar credential. Prioritize accounts that can move money, reset other accounts, access private files, or control your phone number.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Social Security number or identity data
Use What To Do After a Data Breach and the category-specific plan at IdentityTheft.gov/databreach. FTC materials point to reviewing your credit reports and considering a credit freeze or fraud alert after Social Security number exposure. A freeze restricts access to your credit file until you lift it; a fraud alert asks businesses to take additional steps to verify applications. Choose based on your circumstances and follow the instructions from the credit bureaus.
Bank or payment information
Contact the bank, card issuer, or payment provider through the number on a statement or its official app, not through contact information in the breach email. Ask what account replacement, transaction monitoring, or dispute steps apply. Review transactions frequently and report anything unauthorized promptly. NIST’s Phishing guidance also recommends unique replacement passwords and direct contact with financial institutions when financial information may be involved.
Identity documents or other sensitive records
Follow the breach notice’s instructions for document replacement, tax accounts, medical information, or government benefits. Keep the notice, dates, correspondence, and case numbers in a secure record. The right remedy depends on the exact data and the country or state involved; U.S. federal guidance does not replace local requirements.
Decide whether monitoring or paid services are warranted
Credit or identity monitoring is not automatically necessary for every exposed email address. Consider it when the incident involves Social Security numbers, financial data, identity documents, or evidence of attempted fraud, and compare what the service actually monitors with the free steps from IdentityTheft.gov. A company’s offer of monitoring does not prove that you must enroll, and a paid service cannot substitute for changing reused passwords, securing email, or reporting unauthorized transactions.
Work, school, and managed accounts
For an employer, school, or other organization-managed account, contact the IT or security team as well as following the organization’s incident process. Administrators may need to revoke sessions, rotate shared credentials, preserve logs, or investigate other affected users. Consumer recovery steps are not a replacement for organizational incident response.
Mistakes that make a breach worse
- Changing the password only on the breached site while leaving reused passwords active elsewhere.
- Clicking a reset link in an unsolicited message instead of opening the known app or typed address.
- Ignoring email-account recovery settings and forwarding rules.
- Assuming a notification proves takeover, or assuming no takeover is possible because the notice mentions only an email address.
- Buying monitoring before identifying what data was exposed and what the service covers.
- Deleting the breach notice, security alerts, or transaction records needed for recovery and disputes.
- Using the same MFA backup code or recovery phone number across accounts without protecting it.
A practical completion checklist
- Exposed password changed at the service and everywhere it was reused or closely copied.
- Email password is unique, MFA is enabled, and recovery details are correct.
- Recent sign-ins, devices, sessions, forwarding rules, sent mail, and deleted mail reviewed.
- MFA enabled on financial, payment, cloud, social, and other high-impact accounts.
- IdentityTheft.gov/databreach steps completed for the specific data categories named.
- Bank or card issuer contacted through a known official channel when financial data may be involved.
- Provider recovery completed and contacts warned if the account sent unauthorized messages.
- Workplace or school security team notified for a managed account.
U.S. agency guidance cited here describes common consumer actions; providers’ interfaces, supported MFA methods, reporting deadlines, and legal remedies vary by account, location, and date.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
