Recommended Free Tools
Change the exposed password immediately, replace every reused or similar password, and secure your email account with multifactor authentication (MFA). Then check whether the breach included identity or financial data and follow the matching recovery steps. A breach notice confirms that information was exposed; it does not, by itself, prove that someone accessed your account. Suspicious sign-ins, changed recovery details, messages you did not send, or being locked out are signs of a possible takeover and require the provider’s recovery process.
Start with the safest response
Read the notification closely enough to identify the company, the affected service, the categories of data involved, and any dates it gives. Do not use a password-reset link in an unexpected email or text. Instead, open the service’s known app, type its address yourself, or use a bookmark you created previously. Criminals often imitate breach notices to collect the very credentials they claim to protect.
As an Amazon Associate I earn from qualifying purchases.
- Open the account through a trusted route. If you are unsure whether a notice is genuine, find the company’s contact page independently and ask whether the incident is real.
- Change the affected password. Do this even if you have not seen suspicious activity. Use a new password that you have never used elsewhere.
- Remove password reuse. Change any account that used the same password or a close variation. Start with email, banking, payment services, cloud storage, social networks, and accounts that can reset other passwords. The Federal Trade Commission (FTC) gives this advice in its data-breach guidance.
- Turn on MFA. Add an extra factor to the breached account and to your email and financial accounts wherever it is offered.
- Check recovery and activity settings. Verify recovery addresses and phone numbers, recent sign-ins, forwarding rules, sent mail, deleted mail, and active sessions.
Changing one password does not require changing every password you own when each account already has a genuinely unique credential. You do need to change every credential that was reused, similar enough to guess, stored by the breached service, or exposed in the incident.
If the exposed information was a password
Change it at the affected service
Sign in from the trusted route and use the account-security page to create a unique replacement. A password manager can generate random credentials and record which accounts have been updated. If the service offers a “sign out of all devices” or “log out of other sessions” control, use it after changing the password, particularly if the notice says passwords were readable or if you see unfamiliar activity.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Change reused and similar passwords
Attackers try exposed credentials on other services, a practice known as credential stuffing. Search your password manager, browser vault, or personal records for the old password and its variants. Prioritize accounts in this order:
- Your primary email and any backup email accounts.
- Banking, investment, payment, tax, and shopping accounts that store payment details.
- Cloud storage, work systems, password-manager accounts, and devices.
- Social, messaging, and other accounts that could be used to impersonate you or send reset links.
Do not “modify” an old password by adding a number or punctuation mark if that pattern is predictable. Use an unrelated credential for every service.
Use a sensible length target
An FTC hacked-account alert published in 2024 suggests a 12-to-15-character target in that account-security context. It is guidance for creating a stronger password, not a breach statistic or a universal cutoff. A longer passphrase made from unrelated words can be practical when a service accepts spaces or punctuation; a password manager is preferable when the service permits randomly generated strings.
Secure your email account before other accounts
Email deserves priority because password-reset links for many other services arrive there. The FTC explains the account-protection basics in its password guidance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Set a unique password that is not used by any other account.
- Enable MFA. If your provider supports them, consider an authenticator app or a security key; the FTC describes these as stronger options than text or email codes when available.
- Confirm that every recovery email address and phone number belongs to you. Remove unfamiliar entries.
- Review recent sign-ins, devices, connected apps, and active sessions. Revoke access you do not recognize.
- Inspect forwarding and filtering rules. Delete rules that redirect messages, hide security alerts, or mark mail as read without your permission.
- Check sent and deleted folders for messages you did not write. Look for password-reset requests, requests for money, or changes to contacts.
- Update the email account’s recovery codes and store them somewhere safe offline or in your password manager.
Apply the same checks to any other account that can reset important services, including a mobile-carrier account used for recovery. If the account is managed by an employer or school, notify its IT or security team as well as following the provider’s consumer recovery steps.
Choose the strongest MFA method the service supports
MFA blocks an attacker who has only your password, but methods differ. Availability varies by provider, and one physical key will not necessarily work with every service. The FTC and Cybersecurity and Infrastructure Security Agency (CISA) provide the comparison below.
| Method | What it does | Practical considerations |
|---|---|---|
| Security key | A physical device confirms a sign-in. | Strong protection against many phishing attacks. Check that the key is compatible with each service and keep a backup if the provider allows it. |
| Authenticator app | Generates time-based or approval codes on a trusted device. | Generally stronger than text or email codes when available. Save the service’s recovery codes before replacing or losing the phone. |
| Text message or email code | Sends a one-time code to a phone number or mailbox. | Better than a password alone, but more exposed to SIM-swap, mailbox, or phone-number attacks than an authenticator app or security key. |
Turn on MFA first for email, financial services, cloud storage, and accounts holding sensitive personal information. CISA’s Turn On MFA guidance explains why these accounts deserve priority, while its More than a Password material describes the extra protection.
Tell exposure apart from an account takeover
A company can expose an email address or password without an attacker ever using your account. Treat the incident seriously, but look for evidence before assuming takeover. Warning signs include:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Security alerts for logins, password changes, or MFA enrollment that you did not initiate.
- Recovery email addresses, phone numbers, usernames, or profile details that changed.
- Devices or sessions you do not recognize.
- Messages, posts, purchases, transfers, or password-reset requests you did not make.
- An inability to sign in even though your previous password should work.
If any sign appears, stop trying random fixes and use the provider’s official account-recovery flow. The FTC’s recovery instructions cover common email and social-account steps.
After you regain access
- Change the password again from a clean, trusted device.
- Sign out other devices and sessions.
- Restore your correct recovery email, phone number, and MFA methods.
- Remove unfamiliar forwarding rules, filters, connected apps, and authorization tokens.
- Review sent, deleted, and archived messages and check for changes to contacts or payment details.
- Tell contacts to ignore suspicious messages sent from the account.
If you cannot recover the account, contact the provider through its independently located support channel. Never give a caller or message sender a one-time code or recovery code.
Match the response to the data that was exposed
Use the FTC’s What To Do After a Data Breach material and its IdentityTheft.gov/databreach resource for steps tied to the specific categories named in your notice. The following table separates credential work from identity-recovery work.
| Exposed information | Priority actions |
|---|---|
| Email address only | Expect more phishing and password-reset attempts. Keep your account password unique, enable MFA, and treat unexpected messages as untrusted. An exposed address alone does not prove account access. |
| Password or security answers | Change the password at the affected service and everywhere it was reused or made similar. Secure email and other high-value accounts with MFA and review sign-ins. |
| Social Security number or comparable identity number | Follow IdentityTheft.gov’s data-specific plan. Review your credit reports and consider a credit freeze or fraud alert. |
| Bank-account or payment information | Contact the institution through the phone number on its official website, statement, or app. Ask about fraud procedures, replace compromised credentials or cards as advised, and monitor transactions. |
| Government ID, medical, or other sensitive records | Use the breach notice’s dedicated instructions and IdentityTheft.gov. Remedies can depend on the issuing agency, account type, and country. |
Credit or identity-monitoring services are not automatically necessary for every breach. Their value depends on what was exposed, the risk of misuse, and whether the organization offers a legitimate, time-limited service. Start with the free government guidance and the institutions that hold your accounts.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Credit freezes, fraud alerts, and financial follow-up
A credit freeze restricts access to your credit file until you lift it, while a fraud alert asks businesses to take additional steps to verify applications. They address identity misuse, not a stolen email password. If a Social Security number was exposed, review the options described by the FTC and place the protections that fit your circumstances.
If a bank or payment account may be compromised, call the institution using a known number rather than a number in the breach message. Ask whether it recommends changing online-banking credentials, replacing a card or account number, filing a fraud claim, or adding transaction alerts. Check statements and app notifications regularly and report unauthorized transactions promptly; waiting can affect the institution’s dispute process.
Avoid the most common mistakes
- Clicking the notification link. A real breach can be used as a pretext for a fake login page. Navigate independently.
- Changing only the breached account. Reused and similar passwords remain exposed elsewhere.
- Relying on password changes without MFA. MFA adds protection if a new password is later phished or stolen.
- Ignoring recovery settings. An attacker who controls a recovery address can reset a password after you change it.
- Assuming an email exposure proves a hack. Look for account evidence, while still taking preventive steps.
- Buying monitoring immediately. First identify the data involved and use official, free guidance.
- Using the same recovery phone or email everywhere. Secure those recovery channels and protect the accounts themselves.
Keep monitoring after the first day
Save the breach notice and record which accounts you changed, which sessions you revoked, and when MFA was enabled. For the next several weeks, watch email for password-reset requests, sign-in alerts, and messages claiming to be from the breached company. Review financial statements and credit activity according to the institution’s advice. Update passwords again if a provider reports a new incident or if you accidentally entered credentials into a suspicious page.
For a workplace or school account, report the event through the organization’s incident process even if you have completed the consumer steps above. Organizational systems can require forced resets, device checks, log review, or token revocation that only administrators can perform.
When you need outside help
Use the provider’s recovery process for a hijacked account, the financial institution’s fraud department for suspected transactions, and IdentityTheft.gov/databreach for identity-data exposure. If you are in a country outside the United States, equivalent national identity-theft and credit-reporting agencies may use different procedures; the federal links here are U.S.-focused. Never pay an unsolicited “recovery agent,” share MFA codes, or install remote-access software for someone claiming to investigate the breach.
Quick Recap
Your action checklist
- Verify the notice through a known app or typed address.
- Change the exposed password and every reused or similar password.
- Secure email with a unique password, MFA, correct recovery details, and clean forwarding rules.
- Enable the strongest supported MFA on email, financial, cloud, and other high-value accounts.
- Check sign-ins, devices, sent mail, deleted mail, connected apps, and recovery settings.
- Use provider recovery steps if there is evidence of takeover.
- Match credit, banking, identity, and monitoring actions to the information actually exposed.
- Continue watching for phishing, unauthorized activity, and follow-up notices.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
