Data breach: the steps to take without delay

The news arrives by email or in the press: a service you use has suffered a data breach. Email addresses, passwords, phone numbers, or purchase histories end up in the wild. The announcement is unsettling, but a breach is far from inevitable harm. It is the days that follow, and how you react, that make the difference.

Assess your exposure

Start by measuring what is actually affected. Read the service's announcement carefully: it usually states the kind of data involved. An exposed password does not carry the same weight as a plain email address.

Then check whether your address appears in known breaches using an exposure-checking service. That tells you which accounts to handle first. Note every service where you used the compromised information: that is your to-do list for the next few minutes.

Change reused passwords

The single most important reflex concerns reused passwords. If the leaked password was also used on other accounts, those accounts are now vulnerable, because fraudsters automatically test stolen credentials across many services.

Change them, starting with the sensitive accounts: your main email, your bank, anything tied to payments. Each time, choose a password that is unique and strong, and check its robustness with our password checker. Also turn on two-factor authentication everywhere you can.

Watch your accounts and finances

A breach can fuel fraud attempts in the following weeks. Keep your eyes open.

• Watch your bank statements and report any unfamiliar transaction to your bank without delay.
• Pay attention to password reset emails you did not request, a sign that someone is trying to get into an account.
• Be wary of an unexpected credit refusal or a letter in your name, possible clues of identity theft.

Guard against targeted phishing

This is the most insidious effect of a breach: targeted phishing. Armed with your real data, scammers send highly believable messages, citing your name, your provider, a recent purchase, or the breached service itself, sometimes by posing as it.

Treat any message that seems to know you too well with heightened suspicion. Do not click in haste, never share a code, and always verify through an official channel. To lastingly reduce how much information about you is out there to exploit, a service like Incogni asks data brokers to delete your personal information.

If a breach leads to fraud, report it to a national fraud service such as Action Fraud and follow the steps they recommend. To understand how this data feeds identity theft, head back to the identity theft guide.