Your Data Was Breached — Now What?

Receiving a notification that a service you use has experienced a data breach has become common enough that many people have developed a kind of fatigue toward these alerts, often not acting on them meaningfully. Given how frequently this happens, it's worth having a clear, practical sense of what actually matters to do in response, prioritized by what genuinely reduces risk versus what's a lower-priority precaution.

First, understand what was actually exposed

Breach notifications vary considerably in what they disclose, but the specific type of data exposed changes what response is actually warranted. A breach exposing only email addresses carries different, generally lower stakes than one exposing passwords, and a breach exposing passwords carries different stakes depending on whether those passwords were stored securely hashed (a technical process that makes them very difficult to reverse into the original password even if exposed) or, in poorer security practices, stored in plain, readable text.

Reading the actual notification carefully, rather than just noting that a breach occurred, is worth the few minutes it takes — the specific data exposed determines which of the following steps actually matter most for your situation.

Priority one: change the password on the breached account, immediately

Regardless of what else was exposed, changing the password on the specific breached account is the highest-priority, least-skippable step. Even if the exposed password was securely hashed, treating it as compromised and replacing it removes any risk from that specific exposure entirely, rather than relying on an assumption about how well the platform's security actually held up.

Priority two: check whether that same password was reused elsewhere

This is the step most people skip, and it's often the more consequential one. If the breached account's password was reused on other accounts — a very common practice, and part of why breaches cause damage well beyond the originally breached service — those other accounts are now at meaningful risk too, since attackers routinely test breached password-and-email combinations against other popular services, a technique called credential stuffing.

If password reuse is a pattern in your own habits (extremely common, worth acknowledging honestly rather than assuming it doesn't apply to you), a breach notification is a good forcing function to change the password everywhere it was reused, not just on the originally breached service.

Priority three: enable two-factor authentication if you haven't already

If the breached account, or any account sharing the compromised password, doesn't already have two-factor authentication enabled, this is a good moment to add it. Two-factor authentication means a compromised password alone isn't sufficient for an attacker to access the account — they'd also need the second factor (typically a code sent to your phone or generated by an authenticator app), which meaningfully raises the bar even if a password has already been exposed.

Priority four: check for suspicious activity on financial accounts, if relevant

If the breach involved a service connected to payment information, or if you have reason to believe the exposed data could be used for financial fraud, checking recent account activity and, if the breach was significant, considering a fraud alert or credit monitoring (where available in your country) is a reasonable precaution, calibrated to how sensitive the specific breach actually was.

A note on breach notification emails themselves as a phishing vector

A specific and important caveat: breach notifications are sometimes exploited by scammers who send fake "your account was breached, click here to secure it" emails, mimicking the format of legitimate notifications specifically to harvest credentials through a fake login page. Rather than clicking a link directly in a breach notification email, a safer practice is navigating to the actual service directly (typing the URL yourself or using a saved bookmark) and changing your password from there, rather than trusting a link embedded in the notification email itself.

Using a password manager to prevent the underlying problem

The root issue that makes breaches so consequential — password reuse across multiple services — is best addressed structurally, not just reactively after each individual breach. Using a password manager to generate and store a unique, strong password for every service removes the password-reuse risk that makes any single breach a threat to your other accounts as well. This is a genuinely high-value habit to build, even though it requires some upfront setup effort, since it changes every future breach notification from a multi-account emergency into a single, contained, low-stakes password change.

What this means for platforms you trust with sensitive or anonymous data specifically

For platforms handling particularly sensitive information — including anonymous Q&A or messaging platforms, where a breach could expose message content or identity information users specifically expected to remain private — the stakes of a breach are correspondingly higher, which connects to the broader discussion of platform accountability covered elsewhere on this blog. A platform's transparency and speed in disclosing a breach, and the specific technical measures it had in place beforehand (like whether passwords were properly hashed), are meaningful signals of how seriously that platform takes the responsibility of holding sensitive user data.

The bottom line

A data breach notification deserves a specific, prioritized response: change the breached account's password immediately, check for and fix any password reuse across other accounts, enable two-factor authentication where available, and watch for suspicious activity if financial information was involved — while being cautious that the notification itself isn't a phishing attempt. Building the habit of unique passwords per service, ideally through a password manager, is the structural fix that makes any future breach considerably less consequential.