How to Secure Accounts: What to Do After a Data Breach

What to Do After a Data Breach to Regain Control

Knowing what to do after a data breach allows you to limit financial loss, prevent identity theft, and secure your exposed accounts before attackers use your information. When you complete this process, you will have an inventory of your exposed records, replaced credentials across compromised and secondary services, hardened multi-factor authentication on essential accounts, and an active monitoring workflow for fraudulent activity. Acting methodically stops automated account takeovers and targeted fraud attempts.

Before you begin, gather two items. First, locate the breach notification letter, security email, or trusted service notice that alerted you to the compromise. This document details which database was breached and what data fields were accessed. Second, ensure access to an offline note or a dedicated password manager where you can record updated passwords and account changes without reusing credentials.

Identify the Specific Information Compromised

Breaches do not expose identical records. Some incidents involve only basic identifiers, while others expose sensitive authentication secrets, payment card details, or national identity identifiers. The specific records taken dictate your immediate defensive priorities. If an incident leaked only email addresses and usernames, your primary exposure is spam and targeted social engineering. If passwords or authentication hashes were exposed, your active accounts face direct compromise.

Use the breach disclosure text to classify your exposure into clear categories. When passwords, answers to security questions, or PIN numbers are exposed, credential stuffing against your other profiles presents an immediate hazard. When financial data or identifiers like Social Security numbers are taken, financial accounts and your credit profile require defensive controls. Review the table below to select your defensive response based on the exposed records.

Exposed Data Type    | Primary Threat Mechanism           | Mandatory Immediate Action
---------------------+------------------------------------+------------------------------------
Username / Password  | Credential stuffing, account theft | Reset breached password and reuses
Payment Card Numbers | Unauthorized purchases, skimming   | Lock card, request reissued number
Social Security / ID | Identity theft, fraudulent loans   | Place credit freeze with bureaus
Email / Phone Number | Phishing campaigns, smishing traps | Flag incoming messages, audit MFA

Replace Reused Passwords and Harden Login Secrets

Credential stuffing occurs when attackers take usernames and passwords leaked from one service and test them against dozens of unrelated websites. If you have used the same password across multiple platforms, every single one of those accounts is now vulnerable. You must immediately update the password for the breached service and any secondary site sharing that secret.

The FTC password guidance advises that a strong password contains at least 12 characters. Longer credentials provide stronger protection against automated guessing. Using a passphrase made of random words separated by spaces creates a strong credential that remains easy to remember. Never share these passphrases over phone calls, SMS texts, or email, and store them securely in a password manager rather than browser cache files or paper sheets left on desks.

Enable Multi-Factor Authentication Across Priority Accounts

A password alone cannot reliably protect an account once your credentials circulate among attackers. Multi-factor authentication adds an independent layer of defense by requiring at least two separate factors before granting access: something you know, something you have, or something you are. Even if an attacker holds your valid password, an active second factor blocks unauthorized access.

According to the CISA multi-factor authentication advisory, malicious cyber actors take advantage of credentials harvested from unrelated breaches. Enabling multi-factor authentication creates a strong barrier against account takeover. Phishing-resistant options based on FIDO and WebAuthn hardware tokens offer the highest level of protection because they stop attackers from harvesting one-time codes on fake login portals. If hardware tokens are unavailable, use an authenticator app generating time-sensitive codes or number matching prompts instead of standard text messages.

Prioritize turning on MFA for your primary email accounts, banking profiles, password managers, and cloud storage providers. Learn how to turn on MFA for your most important accounts to systematically lock down these core services before attackers exploit exposed credentials.

Recognize and Defend Against Follow-Up Social Engineering

Attackers frequently exploit data breaches to craft persuasive phishing scams. Because they possess your name, email address, phone number, or details about the services you subscribe to, their follow-up emails and text messages appear authentic. They may pose as customer support representatives claiming your account is suspended, or package couriers demanding payment updates.

The CISA Secure Our World guidance highlights avoiding and reporting phishing scams as a core defensive habit. Inspect incoming messages carefully for false urgency, mismatched sender domains, and unexpected attachments. Review common delivery scams and learn to detect delivery text scams that attempt to steal fresh payment data. If you notice strange activities like unexpected password reset emails, review these signs your account has been hacked to determine whether an unauthorized session is already active.

How to Verify Your Security and Troubleshoot Continued Suspicious Activity

To verify that your defensive response worked, check the active login sessions and security settings on your updated accounts. Sign into each hardened profile, navigate to the security or privacy settings menu, and review the list of authorized devices. If you see active sessions from unfamiliar browsers or locations, terminate them immediately. Confirm that your contact email address, phone number, and backup recovery codes have not been altered.

If you continue to observe suspicious signs after changing credentials, such as unexpected login attempts, locked accounts, or emails sent from your address, your system or secondary authentication method may be compromised. First, scan your local devices for malware or unauthorized extensions that capture keystrokes. Second, regenerate all backup recovery codes for your authenticator apps and revoke existing API tokens or authorized third-party applications linked to your accounts. Finally, place a credit freeze with major credit reporting agencies to prevent attackers from opening fraudulent credit lines in your name.