If a breach notice says your password or personal information may have been exposed, act on the type of data involved. Change the exposed password and any reused or similar passwords; contact your card issuer if payment-card details were exposed; and take credit and identity-protection steps if your Social Security number or other identity information was involved. For U.S.-specific steps matched to the exposed information, start at IdentityTheft.gov/databreach.
First, verify the notice and find out what was exposed
Read the notice to identify the affected organization and the types of information involved. If an unexpected email or text asks you to click a link, provide a password, or share sensitive details, do not use the link or reply. Instead, contact the organization using a website address or phone number you already know is genuine.
The response depends on whether the exposed information was an account password, payment-card data, identity information such as a Social Security number, or evidence that someone has already accessed an account. The U.S. Federal Trade Commission (FTC) directs consumers to IdentityTheft.gov/databreach for advice based on what was exposed.
If a password was exposed, change it wherever it was used
Change the password on the affected service right away. The FTC’s November 2024 guidance says: “If a company or website tells you it lost your password in a data breach, change your password right away.” Then change it on every other account where you reused it or used a similar version. A password exposed on one service can put other accounts at risk if the credential is repeated.
#1 Best Overall
- Use a different, strong password for each account. A password manager can help create and keep track of complex, unique passwords; the FTC describes it as an option, not a requirement.
- If answers to security questions were used as account credentials and exposed, change those answers too.
- Turn on multi-factor authentication (MFA) wherever the service offers it. When available, an authenticator app or security key is more secure than a code sent by text or email, according to the FTC. Options and setup vary by service, so use that service’s security settings and recovery instructions.
If you suspect someone has taken over an account
Signs of unauthorized access can include unfamiliar account activity, profile changes, email forwarding rules you did not create, or messages and posts you did not send.
If you can still sign in
- Change the account password to a unique one.
- Use the account’s security settings to sign out other devices or sessions.
- Turn on MFA and check that the recovery email addresses and phone numbers belong to you.
- Review recent activity, profile details, and email forwarding rules for changes you did not make.
If you are locked out
Use the service’s official account recovery process. Reach it through the service’s known website or app rather than a link in an unexpected message.
If payment-card information was exposed
Contact the bank or card issuer using a trusted phone number or its official app or website. Ask about replacing the card number, then review transactions and promptly report charges or account changes you do not recognize. Follow the issuer’s instructions for securing the account.
If your Social Security number or other identity information was exposed
Use IdentityTheft.gov/databreach for steps tailored to the information named in the notice. For an exposed Social Security number, FTC guidance advises ordering free credit reports and checking for unfamiliar accounts. Consider a fraud alert or a credit freeze to make it harder for someone to open new credit in your name.
Free tools Windows power users keep installed
One-click scans. No signup required.
If you find evidence that someone has used your identity, report it at IdentityTheft.gov. The service provides a personalized recovery plan. Review the plan and follow the steps that apply to your situation.
Watch for follow-up scams
A breach can prompt convincing messages from people pretending to be the affected company, a bank, or a government agency. Treat unsolicited calls, texts, and emails requesting passwords or other sensitive information with caution. Do not share details or follow their links; contact the organization through a known-good channel. For U.S. identity-theft reporting and recovery information, use the official IdentityTheft.gov service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do at a glance
| What may have been exposed | First action | Next steps |
|---|---|---|
| Password or login credentials | Change the password on the affected service. | Change reused or similar passwords elsewhere, use unique passwords, and enable MFA where available. |
| Payment-card details | Contact the card issuer or bank. | Ask about replacing the card number and report unfamiliar transactions or account changes. |
| Social Security number or other identity information | Get tailored U.S. guidance at IdentityTheft.gov/databreach. | Check credit reports, consider a fraud alert or freeze, and report suspected identity theft at IdentityTheft.gov. |
| Signs of account takeover | Secure the account or start its official recovery process if locked out. | Sign out other devices, verify recovery details, and check activity and forwarding rules. |
This guidance is focused on U.S. consumers and FTC resources. Outside the United States, use your country’s official identity-theft, privacy, and credit-reporting services.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
