What should I do after a data breach? First, verify the notice through the organization’s official website or app, then use the FTC’s IdentityTheft.gov recovery steps and its breach guidance to match your response to the information exposed. For accounts you can still access, change compromised or reused passwords, sign out other sessions, enable two-factor authentication, and check recovery details. A breach notice does not by itself mean fraud has occurred, but it is a reason to act promptly.
1. Verify the breach notice and identify what was exposed
Do not use a login link or phone number in an unexpected email or text. Open the organization’s known official website or app yourself and look for its breach notice or support instructions. The FTC also advises caution around unexpected messages that claim a problem with an account; see What To Know About Identity Theft.
As an Amazon Associate I earn from qualifying purchases.
Read the notice for the categories of information involved: login credentials, payment details, Social Security information, or other personal data can require different responses. The FTC’s breach guidance directs people to IdentityTheft.gov’s recovery steps for actions tailored to their situation. The FTC’s transcript states: “Then, visit identitytheft.gov/databreach” (What To Do After a Data Breach).
2. Secure the affected account and any reused passwords
Change the exposed password
If you can still access the affected account, change its password to a strong, unique one. Do not reuse a password from another account or choose a close variation of one that may also be exposed. A password manager can help generate and keep track of unique passwords; it supports this work but does not replace changing compromised credentials. The FTC discusses password managers and other protective steps in Protect Your Personal Information From Hackers and Scammers, and the FBI also recommends a reputable password manager in its online safety tips.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Change reused passwords on other services
If you used the exposed password, or a similar one, elsewhere, replace it on those accounts too. Prioritize your email account and accounts that can reset other passwords, access money, or store payment information. Email deserves early attention because other services may send password-reset links there. For compromised email or social accounts, follow the provider’s official recovery process and the FTC’s account recovery guidance.
3. End other sessions and strengthen sign-in
In the affected account’s security settings, use the option to sign out of all devices or sessions, if offered. Then turn on two-factor authentication (also called multi-factor authentication) if the service supports it. The exact methods vary by provider. FTC guidance identifies authenticator apps and security keys as stronger options than codes sent by text or email; choose among the methods the provider actually supports. A FIDO2-compatible hardware security key is one possible second factor, but check that your account and devices support it before buying one. See the FTC’s personal-information protection guidance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Check recovery details and recent activity
Confirm that the account’s recovery email address and phone number are correct and controlled by you. Remove unfamiliar recovery methods and update any that are out of date. Review recent sign-ins, account changes, messages, purchases, or other activity for actions you do not recognize. If someone may have used the account to contact others, warn affected contacts not to trust unexpected requests or links from it. For a hacked email or social media account, use the provider’s official recovery steps rather than links in suspicious messages; the FTC explains common recovery routes in its account recovery article.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Respond to exposed personal or financial information
Changing a password only protects the login; it does not address exposed payment-card, Social Security, health, or other identity information. Follow the breach notice and IdentityTheft.gov’s exposure-specific steps. If you find evidence of identity theft, the FTC advises contacting affected companies, asking them to close or secure fraudulent accounts where appropriate, and changing relevant logins, passwords, and PINs. Its recovery steps also describe a free one-year fraud alert.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If the notice says your Social Security information was exposed, the FTC recommends checking your free credit reports and looking for accounts you do not recognize. If you discover misuse, contact the businesses or financial institutions involved and follow the recovery steps for your case. A company may offer credit monitoring or another service after a breach; evaluate what it covers against the information exposed rather than assuming it is necessary or sufficient.
What if you can’t get into your account?
Use the service’s official account-recovery page, reached by typing its known website address or opening its app. Do not follow recovery links in an unexpected message. If the account is email or social media, the FTC’s recovery guidance points to provider-specific options. Once access is restored, change the password, end other sessions, check recovery details, and review account activity.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Guidance for readers outside the United States
The FTC and IdentityTheft.gov resources cited here are U.S.-focused. If you live elsewhere, use your country’s official consumer-protection and identity-theft services, along with the affected organization’s verified support channels. Account recovery options and support for two-factor authentication or security keys vary by service and can change.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
