iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If a service says your password was exposed, change that password on the affected account and on every other account where you reused it. Start with your email account, then protect financial accounts and services that can reset or unlock other accounts. A breach notice does not, by itself, prove someone signed in to your account—but a reused password gives anyone who has it a reason to try it elsewhere.
Why a reused password makes one breach a risk to other accounts
When the same password protects more than one account, a person who obtains it from one service may try it on other services. The Federal Trade Commission (FTC) describes this as a reason to use different passwords, and the Cybersecurity and Infrastructure Security Agency (CISA) warns that compromised passwords can expose multiple systems. The risk depends on which accounts share the password and whether an attacker can also identify or guess the corresponding usernames.
A breach notification and an account takeover are not the same thing. A notification may mean information associated with an account was exposed; it does not establish that someone used your password to sign in. Treat the alert seriously, but check it through the service itself rather than assuming every account is already compromised. The FTC lists warning signs of a possible takeover such as being unable to sign in, unexpected changes to your username or password, unfamiliar sign-in notices, or messages you did not send. FTC: How to recover a hacked email or social media account
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What should I do if my password was leaked?
Work through the response in order. If you still have access, change the password on the affected account first, then replace every copy of that password elsewhere. After that, close other sessions, strengthen sign-in protection, check recovery settings, and look for activity you did not initiate. Some services use different labels or offer different controls, so follow the provider’s official account-security instructions.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Confirm the alert without using its link. Open the service’s app or type its known address yourself. Check the account’s security notices there. If you received an unexpected message, do not enter your credentials through its link. For Google accounts, Google advises going directly to Password Checkup to confirm an unsafe-password alert rather than relying on the message alone. Google Account Help: Change compromised passwords in your Google Account
- Change the affected account’s password. Choose a password that is not a minor variation of the old one, and do not reuse it on another service. If the service says the password has already been changed, or you cannot sign in, go to its official recovery process instead of trying links in unsolicited messages.
- Change every reused copy. Update the password anywhere else you used it. Google’s compromised-account instructions also tell users to change passwords on apps and sites where they used the same password. A password that differs by a single digit or punctuation mark is still too close to count as a separate, reliable credential.
- Sign out other sessions and remove unfamiliar devices. Use the account’s security or device settings to end sessions you do not recognize, if the service provides that control. A password change does not come with a universal guarantee that every existing session will be invalidated, so look for a separate sign-out or session-management option. Google specifically advises checking for and removing unfamiliar devices. Google Account Help: Secure a hacked or compromised Google Account
- Turn on two-factor authentication and verify recovery details. If the account offers it, require a second sign-in factor in addition to the password. Check that the recovery email address and phone number belong to you, and remove details you do not recognize. The FTC describes common second factors as a code, an authenticator app, or a security key. FTC: Use Two-Factor Authentication To Protect Your Accounts
- Check for changes or messages you did not make. Review recent account activity, sent and deleted messages, social posts, and contacts. In email, inspect forwarding rules as well as the visible inbox: an unexpected rule could send future messages elsewhere. If your account may have messaged people, warn them to ignore unusual links or requests for money from it.
I use the same password everywhere—what do I change first?
There may be many copies, so start with accounts that could unlock other accounts or expose money. Email comes first because an attacker who controls the inbox may be able to request password-reset links for other services and receive those links there. The FTC explains this chain of events in its account-recovery guidance. Next, secure banking and payment accounts, then services that can reset or grant access to other accounts. This order is a practical prioritization, not a claim that any particular account was accessed.
| Priority | Accounts to check | Why they matter |
|---|---|---|
| 1 | Email accounts used for sign-in or recovery | Inbox access may let someone receive password-reset links for other services. |
| 2 | Banking, payment, and other financial accounts | They may expose money or payment details; contact the institution if you see suspicious activity. |
| 3 | Accounts used to access or reset other services | They may provide another route into accounts, devices, or stored information. |
| 4 | Shopping, social, cloud storage, work, and tax accounts | Include any of these where the breached password was reused; they may contain personal information or let someone act as you. |
Do not rely on memory alone if you have many accounts. Review the password records you control, such as those stored in a password manager or browser, and use the list to identify every reuse. Google Password Checkup can report passwords saved in a Google Account that are exposed, weak, or reused. It checks only passwords within its scope; it does not establish that every password you use elsewhere is safe. If you use a different provider, check that provider’s official security tools or review your own password records. Google Account Help: Make your account more secure
Should I change my email password too?
Yes, if you reused the exposed password for email—or if you have any reason to suspect the email account itself is compromised. Email is particularly important because password-reset messages for other services may arrive there. A person with access to the inbox may be able to use those messages to take over additional accounts. If email was not one of the accounts using the password and there is no sign it was accessed, the breach alone does not prove that its password needs changing; nevertheless, make sure it has a unique password and that its recovery details and sign-in activity are familiar.
If you have more than one email account, check the one used as a recovery address for the breached service as well. Secure it with a unique password and a second factor if available. When reviewing an email account, look beyond the password: check forwarding rules, account recovery details, active sessions, sent mail, and deleted mail for changes or activity you did not make.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What if I can’t get into my account?
Use the service’s official account-recovery instructions. Go to its known website or app yourself and find the recovery option there. Do not trust a caller, message, or search result that asks you to share a sign-in code or password in order to “restore” the account. Google advises using account recovery when someone has changed account details or you cannot sign in; other providers have their own procedures and verification requirements. The FTC’s recovery page includes links for common email and social services. FTC recovery guidance
While waiting for access to be restored, secure the email account used to recover the locked account. If it shares the exposed password, change that password there too. This matters because access to the recovery inbox may provide a route to reset other services.
If banking or identity information may have been exposed or used, contact the affected financial institution or relevant authority. Google’s compromised-account guidance recommends contacting a bank or local authorities if banking or identity information may be exposed. U.S. readers who believe personal information was stolen can use the FTC’s IdentityTheft.gov to report identity theft and get a recovery plan. Procedures and reporting options vary by country.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →How do I know if someone is still logged in?
Check the service’s security, devices, or active-sessions page. Review device names, locations, and recent sign-ins where the service shows them, and sign out sessions or remove devices you do not recognize. The exact labels and details vary by provider. Do not treat a familiar device name as conclusive proof that a session is yours if other account activity looks suspicious.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Look for signs beyond the session list: recovery phone numbers or email addresses you did not add, forwarding rules you did not create, messages or posts you did not send, and security notices about unfamiliar activity. A service’s session controls may not show every detail, and a password change may not automatically end every active session. Use the separate sign-out-all-devices control if offered, then check the account again after recovery.
How to avoid repeating the same problem
Give every account its own password. A password manager can generate and keep track of unique passwords across your devices, reducing the need to invent or remember each one yourself. It is an optional tool, not a prerequisite for responding to a breach; if you choose one, consider whether it works on the devices you use and whether you understand its recovery process. Google recommends a password manager as one way to create and manage strong, unique passwords. Google Account Help: Make your account more secure
When comparing password managers, focus on whether they can generate unique passwords, work across the devices you use, and offer a recovery process you understand. These practical differences matter more than choosing a tool during the urgent first steps of account recovery. No particular product is required by the guidance here.
For accounts that support it, add two-factor authentication. The FTC’s guidance describes a security key as a physical device used as a second factor and characterizes security keys as its strongest common two-factor method. A FIDO2 security key may be an option for compatible accounts, but availability and recovery methods depend on the service. Other supported choices include authenticator apps and codes. Choose a method the account supports and that you can reliably recover if you lose access to a device or key. A second factor helps protect sign-ins; it does not replace changing a password already exposed in a breach. FTC two-factor authentication guidance
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Compare second-factor options by whether the account supports them, how easy they are for you to use, what recovery options are available, and how well they resist credential theft. A security key is optional and compatible only with services that support it; a password manager or key is a follow-up aid, not a reason to delay changing reused passwords.
Finally, keep recovery options current and review account activity when a service reports a security issue. These habits make it easier to spot unwanted changes and regain control, but they do not make it safe to reuse a password.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Frequently Asked Questions
Does a breach notification mean someone got into my account?
No. A breach notice can mean information associated with the account was exposed; it does not by itself establish that someone signed in. Check the notice through the service’s app or known website, then change the exposed password and any reused copies.
What if I can’t get into the account whose password was exposed?
Go directly to the provider’s official account-recovery process. Secure the email account used for recovery too, especially if it shares the exposed password, because password-reset messages may arrive there.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Should I change my email password too?
Change it if you reused the exposed password for email or suspect the inbox was accessed. Email deserves priority because an attacker with inbox access may receive password-reset links for other services.
Do I need to buy a password manager or security key right now?
No. First change the affected password and every reused copy, then review sessions, recovery details, and activity. A password manager can help create and manage unique passwords; a FIDO2 security key is an optional second factor for compatible accounts. Check device support and recovery options before choosing either.
The Bottom Line
Change the exposed password on the affected account and everywhere you reused it, starting with email and financial accounts. Then end unfamiliar sessions, verify recovery details, enable a second factor if available, and check for activity or settings you did not change. Use the provider’s official recovery process if you are locked out.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
