Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start by finding out what actually happened, then secure any credentials or identity data that may be involved. A website vulnerability is a weakness in the site’s software or configuration; it does not, by itself, prove that your account was accessed or that personal information was exposed. The site operator must repair the weakness. You can still reduce risk by verifying the notice, changing exposed or reused passwords, enabling multifactor authentication (MFA), checking for account misuse, and taking identity-protection steps when sensitive data is involved.
This is general U.S. consumer guidance. The correct response depends on the company’s notice, the data it identifies, and whether you see signs of account takeover or device malware.
First, distinguish a vulnerability warning from a confirmed breach
A vulnerability report may mean the company found a flaw and is fixing it. A breach notice usually says that an unauthorized person accessed, acquired, or may have exposed data. Those are different events. Read the company’s wording carefully:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Vulnerability only: a weakness was discovered, but the notice does not say your account or data was accessed.
- Possible or confirmed exposure: the company identifies information that may have been viewed, copied, or stolen.
- Account compromise: you see unfamiliar sign-ins, changed recovery details, messages you did not send, or you cannot log in.
No general statistic can tell you your personal likelihood of compromise. The company’s dated notice is the authority for what happened at that service. Do not infer that a vulnerable website infected your computer; a site flaw and malware on your device are separate problems.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Verify the notice and identify what data is involved
Before clicking a link in an unexpected email or text, open the service through a bookmark, a known address that you type yourself, or a phone number from a statement or previous correspondence. Sign in only through that trusted route. Criminals often imitate breach notices to steal passwords.
- Find the official announcement. Check the company’s security page, account dashboard, or support channel reached independently.
- Record the date and scope. Note whether the notice concerns passwords, email addresses, payment details, government identifiers, health information, or merely technical details.
- Check what the company asks you to do. Legitimate instructions should not require you to send a password, one-time code, or complete payment to “secure” an account.
- Save the notice. Keep a copy or screenshot so you can refer to the stated data, dates, and support contacts.
The next action should match the information named in the notice. A password exposure calls for immediate credential changes; a Social Security number exposure requires identity and credit precautions; a technical vulnerability with no stated exposure may require monitoring and waiting for the operator’s fix.
Secure passwords before an attacker can reuse them
If the company says your password was lost in a breach, the Federal Trade Commission (FTC) says: “If a company or website tells you it lost your password in a data breach, change your password right away.” Change it by navigating to the service yourself, not through an unverified message.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Change the affected password
- Open the site or app through a trusted address.
- Go to the account or security settings and choose Change password.
- Create a long, unique password that you have never used elsewhere.
- Save the new credential in a reputable password manager if you use one.
- Sign out other sessions if the service offers Log out everywhere or Sign out all devices.
FTC guidance on strong passwords and MFA is available at Creating Strong Passwords and Other Ways To Protect Your Accounts (page marked November 2024).
Replace reused or similar passwords everywhere
If you used the same password, or a predictable variation of it, on another service, change every instance. Start with your email account because control of email can enable password resets for many other accounts. Then address banking, payment, cloud-storage, work, and social accounts. Do not merely change a number at the end; use a genuinely different password for each service.
A password manager is optional, not a requirement. Its practical benefit is generating and storing unique passwords so you do not have to memorize them. It cannot repair the vulnerable website or undo a password that was already exposed.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Turn on multifactor authentication (MFA)
MFA requires an additional proof of identity after the password. Enable it on the affected account and on important accounts, especially email and financial services. CISA’s instructions are in Turn On MFA.
| Method | How it works | Security and practical considerations |
|---|---|---|
| Authenticator app | Generates time-based codes on your phone or approved device. | Generally stronger than text or email codes; requires access to the enrolled device and a recovery method. |
| Security key | A physical token, often using FIDO2 or a similar standard, is tapped or inserted during sign-in. | Strong phishing resistance, but compatibility varies by website and you must protect a backup key or recovery option. |
| Text or email code | A one-time code is sent to a phone number or email address. | Better than a password alone, but FTC describes these codes as less secure than an authenticator app or security key where those options are available. |
Use the strongest method the service supports and enroll a backup method before you lose access. A FIDO2-compatible hardware key may be useful for accounts that support it, but buying one is not necessary for every reader and it does not fix the website’s underlying vulnerability.
Check for account takeover and recover access if needed
Look for password-reset emails you did not request, unfamiliar sign-in alerts, changed recovery email addresses or phone numbers, new payment details, messages or posts you did not send, and devices or sessions you do not recognize.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you can still sign in
- Change the password immediately, using a device you trust.
- Use the security page to sign out all other devices and sessions.
- Enable 2FA or MFA.
- Verify the recovery email address and phone number; remove additions you did not make.
- Review account rules, forwarding addresses, connected apps, API keys, payment methods, and recent activity. Remove anything unfamiliar.
- Check whether the attacker changed your username, contact details, or notification settings.
The FTC’s October 2024 guidance, Email or social media hacked? Here’s what to do, and its recovery instructions at How To Recover Your Hacked Email or Social Media Account cover these account-takeover steps.
If you are locked out
Use only the provider’s official Forgot password, hacked-account, or account-recovery process. Follow identity checks exactly and contact support through the verified site or app. Tell contacts, coworkers, or customers through a separate channel if messages were sent from the compromised account. Do not pay a person who contacts you unexpectedly claiming to be support, and never disclose a one-time authentication code.
Respond when identity information may be exposed
If the notice names a Social Security number or other identity data, follow the breach plan at IdentityTheft.gov. The FTC recommends obtaining free credit reports and checking for accounts or activity you do not recognize. Review statements and notices for unfamiliar loans, credit cards, utility accounts, tax filings, or address changes.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Credit freeze versus fraud alert
| Option | What it does | When it may fit |
|---|---|---|
| Credit freeze | Blocks prospective creditors from accessing your credit file to open most new accounts while the freeze is active. The FTC says freezes are free and do not affect your credit score. | Useful when a Social Security number or other identity information may enable new-account fraud. You must temporarily lift the freeze when applying for credit. |
| Fraud alert | Asks businesses to take additional steps to verify your identity before opening new credit. The FTC describes fraud alerts as free. | Useful when you suspect misuse and want an added verification step without placing a full freeze. |
Read the FTC explanation, Get a credit freeze to stop identity thieves, to choose the measure that fits your circumstances. A freeze or alert does not replace checking existing accounts for fraudulent activity.
Use services offered in the breach notice
Affected companies sometimes offer free credit monitoring or identity-theft insurance. The FTC advises taking advantage of free services offered with a breach notice. Check the enrollment deadline, duration, covered information, and any claim or support procedure. Do not assume you must buy a separate monitoring subscription; no paid service can guarantee prevention or repair of every type of identity theft.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Know when device-malware steps apply
A vulnerable website alone is not evidence that your phone or computer is infected. Consider malware response only if you downloaded an unexpected file, installed untrusted software, saw persistent pop-ups or redirects, noticed disabled security tools, or observe other unexplained device behavior.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Stop entering passwords or financial information on the suspected device until it is checked.
- Use reputable, updated security software to scan the device and follow its removal instructions.
- From a separate, trusted device, change important passwords and enable MFA after the scan or cleanup.
- Keep the operating system, browser, and security software updated.
The FTC’s April 2025 guide, Malware: How To Protect Against, Detect, and Remove It, applies when there are independent signs of infection, not merely because a website reported a vulnerability.
What the website operator must do
You cannot patch the provider’s server, rewrite its authentication code, or verify its internal logs. The operator is responsible for fixing the flaw, investigating whether it was exploited, securing affected systems, and communicating accurately about exposed data. You can ask support whether the vulnerability is fixed, whether your credentials were reset or invalidated, what categories of data were involved, and where to find updates. Treat answers as specific to that company and incident; there is no universal deadline or remedy established here.
Quick Recap
Common mistakes to avoid
- Clicking the first warning link: verify the sender and navigate independently.
- Changing only the affected site’s password: reused credentials can expose every account that shares them.
- Leaving recovery details untouched: an attacker may retain access through a newly added email address, phone number, app, or session.
- Assuming MFA is a guarantee: it reduces risk but does not make an account invulnerable; protect backup codes and recovery channels.
- Buying a tool in a panic: password managers, security keys, monitoring, and insurance are optional aids, not repairs to the site.
- Wiping a device without evidence: a website vulnerability does not establish malware, and unnecessary resets can destroy useful account or fraud evidence.
A practical response checklist
- Verify the notice through a trusted website or support route.
- Write down the date and categories of data the company identifies.
- Change the affected password immediately.
- Change every reused or similar password, starting with email.
- Sign out other sessions and inspect recovery details and connected apps.
- Enable the strongest MFA option the service supports.
- Watch sign-in alerts, statements, and account-change notices.
- If identity data was exposed, obtain free credit reports and consider a free freeze or fraud alert.
- Enroll in any legitimate free monitoring or identity-theft service offered by the company.
- Use malware procedures only when the device shows independent signs of infection.
- Keep the company’s notice and follow later updates from verified channels.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
