what to do after your email appears in a data breach

work from the exposed account outward. this is account cleanup, not incident response for a business or a person facing targeted abuse

Never miss an update

This list changes over time — get a short email when it does.

At most one short email a week — unfollow in one click.

do not use the link in a surprise text or email to reach either site

change the password on the affected account

go directly to the service and make the new password unique

replace every reused or closely related password

turn on multi-factor authentication

prefer an authenticator app or security key when the service supports one

sign out other sessions and remembered devices

check recovery email addresses and phone numbers

remove anything unfamiliar before relying on a password reset

review passkeys, app passwords, and connected applications

inspect email forwarding rules and filters

attackers sometimes leave a quiet copy of incoming mail after losing access

replace exposed payment credentials if the issuer advises it

watch statements and account notifications

report unfamiliar activity through the official bank or card channel

expect phishing that references the breached company

accurate personal details do not prove the sender is legitimate

save the breach notice and a record of actions taken

close the account if it is abandoned and deletion is available

download anything needed first, then confirm the closure by signing in again

Or start a list of your own — free, it takes a minute.

Related lists