The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Act quickly, but match your response to the information exposed. Read the breach notice, change the compromised password and every reused or similar password, enable two-factor authentication, and watch your accounts. If a Social Security number or other identity information was exposed, check your credit reports and consider a free credit freeze or fraud alert. Report suspected identity theft at IdentityTheft.gov for a personalized recovery plan.
This guidance is based on U.S. Federal Trade Commission material. The exact steps depend on the breach notice, your account activity, and your jurisdiction.
As an Amazon Associate I earn from qualifying purchases.
Start with the breach notice, not a panic click
A breach announcement should tell you which service was affected, when the incident or notification occurred, what categories of information were involved, and whether the organization is offering free monitoring or another response service. Those details determine your next move. A stolen password requires credential changes; an exposed Social Security number creates a different credit and identity-theft risk.
Make a short incident record
Save the notice and write down the organization, affected account, approximate incident and notice dates, data types listed, and any enrollment deadline for a free service. Do not assume that every customer record or every type of data was exposed. Use the FTC’s breach-specific tool at IdentityTheft.gov/databreach for steps based on the information named in your notice.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Confirm that a follow-up message is genuine
Criminals often exploit public breach news with fake “secure your account” emails and text messages. Do not open an unexpected attachment, click its sign-in link, or provide a password or verification code to someone who contacted you. Instead, type the organization’s known web address yourself, use an app you already installed, or call a phone number from an earlier statement or official account page. The FTC’s guidance on protecting personal information explains why these unsolicited requests deserve caution: consumer.ftc.gov/articles/protect-your-personal-information-hackers-scammers.
Change exposed and reused passwords immediately
If a password may have been included in the breach, replace it on the affected service as soon as possible. Then change every other account where you used that password or a close variation. Attackers routinely try credentials from one incident on unrelated services, so changing only the breached account leaves a reused password exposed.
Use a unique replacement for every account
Each important account should have its own password or passphrase. A password manager can generate and store unique credentials, but the essential rule is separation: one compromised password should not unlock email, banking, tax, shopping, or social accounts. Do not recycle a previous password by changing only a number, punctuation mark, or capitalization.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Work through the highest-impact accounts first
- Email: Email often controls password resets for other services. Change its password first, review recovery addresses and phone numbers, and sign out of unfamiliar sessions.
- Banking, cards, and payment apps: Look for unauthorized transactions and make the new password unique.
- Tax and government-related services: These accounts can contain identity information and payment details.
- Social and messaging accounts: Protect them against impersonation and messages sent in your name.
- Other services using the exposed password: Search your password manager or personal records for every reuse, including small or seldom-used accounts.
For account-specific recovery instructions, the FTC’s account guidance is at consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Add two-factor authentication to block password-only logins
Two-factor authentication (2FA), also called multi-factor authentication in some settings, requires a second credential in addition to your password. As the FTC puts it, “Even if a hacker knows your username and password, they can’t log in to your account without the second credential or authentication factor.” Read the FTC’s full explanation at consumer.ftc.gov/articles/use-two-factor-authentication-protect-your-accounts.
Choose the strongest method the service supports
- Security key: A physical key used during sign-in. The FTC identifies security keys as the strongest method among the options in its guidance.
- Authenticator app: An app generates verification codes on your device and is generally a stronger choice than codes delivered by text message or email.
- Text or email code: Use this when stronger options are unavailable, but protect the phone number or email account receiving the code.
Availability varies by service. Enroll from the account’s own security settings, store recovery codes somewhere safe, and never tell a caller or unexpected texter a verification code. A legitimate support representative will not need you to read one back to “cancel” a breach.
If an email or social account was taken over
A breach notice does not prove that an account was hijacked, but unfamiliar messages, changed recovery details, new login alerts, or missing mail are warning signs. Use the provider’s official account-recovery page rather than a link supplied by a stranger.
- Recover access through the provider’s published process.
- Set a new, unique password that was not used elsewhere.
- Sign out of all devices and sessions you do not recognize.
- Turn on 2FA and save the recovery codes.
- Check recovery email addresses, phone numbers, forwarding rules, connected apps, and recent login activity; remove anything that is not yours.
- Review sent messages, posts, purchases, and payment settings for unauthorized actions.
- Warn contacts if the account may have sent fraudulent links or requests in your name.
The FTC’s 2024 consumer alert provides additional account-takeover guidance: consumer.ftc.gov/consumer-alerts/2024/10/email-or-social-media-hacked-heres-what-do.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When a Social Security number or credit information was exposed
Identity information calls for credit-focused steps in addition to password changes. If your Social Security number was listed in the notice, order your free credit reports and inspect them for accounts, inquiries, or other activity you do not recognize. The FTC’s breach-response video is available at consumer.ftc.gov/media/79862.
Decide between a credit freeze and a fraud alert
Both options are free, but they work differently. A freeze blocks prospective creditors from accessing your credit report while it is active. A fraud alert leaves report access available but asks lenders to verify your identity before opening new credit.
| Question | Credit freeze | Initial fraud alert |
|---|---|---|
| What happens? | Prospective creditors cannot access the credit report while the freeze is active. | Lenders are asked to verify your identity before opening new credit. |
| Cost | Free. | Free. |
| How long? | Until you lift it. | An initial alert; follow current FTC instructions for its duration and renewal. |
| Practical effect | You may need to lift the freeze temporarily when applying for credit. | Credit applications can proceed, with an added identity-verification request. |
| Where to act | Contact Equifax, Experian, and TransUnion. | Follow the FTC’s current instructions for placing the alert. |
A freeze does not affect your credit score. You can temporarily lift it when a lender needs to review your report and restore it afterward. A fraud alert is useful when you want an extra verification step without restricting report access. The FTC compares the choices at consumer.ftc.gov/credit-freeze-or-fraud-alert-right-you and explains the current freeze process at consumer.ftc.gov/consumer-alerts/2025/09/get-credit-freeze-stop-identity-thieves.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Monitor accounts and use free breach services carefully
Check for activity you did not authorize
Review bank and card transactions, payment-app transfers, password-reset emails, login alerts, and credit-report entries. Save dates, amounts, account names, screenshots, and confirmation numbers for anything suspicious. Contact the institution through its official app, website, or statement number; do not use contact details from a suspicious message.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Evaluate a monitoring offer in the breach notice
If the organization offers free credit monitoring or identity-theft services, the FTC advises taking advantage of the free offer. Read what the service monitors, who is eligible, how enrollment works, and when coverage ends. Monitoring can alert you to some changes, but it does not replace unique passwords, 2FA, account review, a credit freeze, or a fraud alert.
Before paying for an optional service after the free period, check its coverage, exclusions, duration, and monthly or annual cost. The FTC’s credit overview explains what credit monitoring can and cannot show: consumer.ftc.gov/articles/understanding-your-credit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Report identity theft as soon as you see evidence
An unfamiliar account, charge, tax filing, benefit claim, or other use of your information may indicate identity theft. Report it at IdentityTheft.gov. The service creates a report and a personalized recovery plan, including next steps for the affected accounts and records.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsKeep copies of the report, correspondence, dispute submissions, and case numbers. Follow each institution’s official process for closing fraudulent accounts, disputing transactions, replacing credentials, and documenting that the activity was not yours. If an email or social account was compromised, complete the provider’s recovery process as well; an IdentityTheft.gov report does not restore a hacked account by itself.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prevent a second scam built around the breach
A real incident can make a fake follow-up message sound convincing. Treat urgent requests for payment, remote access, passwords, security codes, or identity documents as suspicious. Go to the organization independently, and do not let a caller rush you into disabling security controls. The FTC’s consumer guidance on protecting personal information covers common hacker and scam tactics at consumer.ftc.gov/articles/protect-your-personal-information-hackers-scammers.
Tell household members or coworkers what warning signs to expect if the exposed account could be used to impersonate you. If a compromised social account sent messages, warn recipients through a separate channel so they do not click the original links.
Keep the response organized
- Maintain a dated log of password changes, freezes or alerts, disputed transactions, provider case numbers, and identity-theft reports.
- Store recovery codes and important contact information offline or in a protected password manager.
- Recheck account recovery details after making security changes; an attacker’s email address or phone number must not remain attached.
- Review the breach notice for enrollment deadlines and the end date of any free monitoring service.
- When applying for credit during a freeze, lift it only for the necessary period and restore it afterward.
These actions address the main U.S. consumer remedies described by the Federal Trade Commission. Credit-bureau procedures, account security options, and provider recovery pages can change, and remedies outside the United States may differ. Use current instructions from the organization involved, the FTC, and your local authorities.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
