Data Breach Response: What to Do When Your Accounts Are Compromised

Immediate Actions (First 30 Minutes)

1. Change the breached password — Immediately, on the affected service
2. Change reused passwords — Any account sharing the same or similar password
3. Enable 2FA — On the breached account and all high-value accounts
4. Check active sessions — Revoke all sessions on the affected service
5. Review recovery options — Verify email and phone haven't been changed

Damage Assessment (First 24 Hours)

Determine what data was exposed. Different breach types require different responses. An email/password breach is concerning but manageable with unique passwords. A breach exposing Social Security numbers, financial data, or identity documents requires more aggressive action — credit freezes, fraud alerts, and identity monitoring.

Identifying Affected Accounts

Check all accounts associated with the breached email address:

• Search your password manager for the breached email
• Check HaveIBeenPwned.com for additional breaches
• Review your email inbox for service confirmation messages
• Check connected OAuth applications

Long-Term Prevention

After handling the immediate crisis, strengthen your security posture systematically. Migrate all passwords to a dedicated password manager with unique, randomly generated credentials per service. Enable 2FA on every account that supports it, prioritizing email, banking, and cloud storage. Set up breach notification monitoring for all your email addresses.

Financial Breach Response

If financial data was exposed, contact your bank immediately to flag the account. Place a fraud alert with one credit bureau (it propagates to all three). Consider a credit freeze, which prevents new accounts from being opened in your name.