An email arrives from a service you used years ago: there has been a security incident and your data may have been exposed. The notification is vague, the advice is generic, and it is not obvious whether this matters.
The response depends almost entirely on two things: what was actually taken, and whether you reused that password anywhere.
What changed in 2026
- Breach frequency stayed high. Notifications remained a regular occurrence for most people.
- Notification content improved somewhat. More disclosures specified what data was involved rather than describing it vaguely.
- Credential stuffing stayed the dominant follow-on attack. Reused passwords remained the mechanism turning one breach into many compromises.
- Breach lookup services became standard tools. Checking whether your addresses appear in known breaches became routine.
What was exposed determines the response
| Exposed |
Urgency |
Action |
| Email address only |
Low |
Expect more spam and phishing |
| Password (even hashed) |
High |
Change it wherever reused |
| Payment card |
Moderate |
Card issuer will typically reissue |
| National identifier |
High |
Freeze credit |
| Date of birth and address |
Moderate |
Combined with other data, enables impersonation |
| Security question answers |
High |
Change them everywhere |
| Message contents |
Varies |
Depends entirely on content |
The single most consequential item is a password, because the follow-on attack is automated and immediate: attackers take credentials from one breach and try them across hundreds of services.
That attack fails completely against unique passwords and succeeds completely against reuse. Which is why the first action is not about the breached service at all.
The first hour
Change the password wherever you reused it. Not just at the breached service. If that password was used elsewhere, those accounts are the exposure, and attackers move fast. Start with email, then financial accounts, then everything else.
If you cannot remember where you reused it, a password manager can tell you — which is one of its underrated benefits.
Check the breached account for changes. Attackers who got in before you were notified frequently add a recovery email address, add a phone number, create a forwarding rule, or authorise a new device. Removing the password without removing those leaves them access.
Email forwarding rules deserve specific attention: a rule silently copying your mail to an attacker survives a password change and is easy to miss.
Enable stronger authentication. If the account supports security keys or an authenticator app, this is the moment — see security keys explained.
Freeze credit if identifiers were exposed. Free, fast, and it blocks new account fraud, which is the main consequence of a leaked national identifier — see credit freeze vs lock.
The following weeks
Expect targeted phishing. Breach data is used to make convincing messages that reference real details — your actual account, a real transaction, a real service you use. Be more sceptical than usual of anything arriving unprompted, particularly if it creates urgency.
Watch for account activity you did not initiate. Login notifications, password reset emails you did not request, and unfamiliar devices.
Do not act on messages about the breach. Attackers send fake breach notifications with links. Go to the service directly rather than clicking.
Consider whether other accounts share recovery paths. If the breached account was a recovery address for others, those are exposed too — see account recovery planning.
If accounts were actually compromised, the fuller sequence in identity theft recovery applies.
Common mistakes
- Changing only the breached password. Reuse is the actual exposure.
- Not checking for account changes. Forwarding rules and recovery addresses persist.
- Clicking links in breach notifications. Frequently the follow-up attack.
- Ignoring a breach because the service seems unimportant. The password matters, not the service.
- Not freezing credit when identifiers leaked. Free and effective.
- Assuming hashed passwords are safe. Weak passwords are recovered from hashes routinely.
- Doing nothing because the breach was years ago. Old credentials still get tried.
FAQ
How do I know if I was affected?
The notification should say. Breach lookup services let you check an email address against known breaches, which frequently reveals older exposures nobody told you about.
Does a hashed password mean I am fine?
Not necessarily. Weak or common passwords are recovered from hashes routinely, and older hashing methods are weak. Treat any exposed password as compromised.
Should I accept the offered credit monitoring?
It is generally free and it detects rather than prevents. A credit freeze prevents, and costs nothing. Take both if offered; prioritise the freeze.
Should I delete the account?
Reasonable if you no longer use the service, and it does not undo the exposure. Deleting also removes your ability to see what happened, so change and secure it first.
Where to go next
For preventing the reuse that makes breaches dangerous, read password rotation myths and the best password managers. If accounts were actually compromised, identity theft recovery.