If a password was exposed, change it promptly on the breached service and anywhere you reused it. If only your email address appeared, that alone does not prove anyone accessed your inbox—but secure your email account, since it can receive password-reset links for other accounts. Then check what information the breach exposed and look for signs of account takeover.
First, find out what information was exposed
Read the breach notice carefully. An email address alone calls for different steps than a password, Social Security number, payment information, or other sensitive personal data. The Federal Trade Commission (FTC) directs consumers to IdentityTheft.gov/databreach for steps tailored to the type of information involved.
As an Amazon Associate I earn from qualifying purchases.
A breach notice does not, by itself, establish that someone logged in to your account. For example, the FTC says a hacked Drizly database contained information from 2.5 million users, including email addresses, geolocation information, and passwords described as not securely encrypted. That is a case-specific figure, not an estimate of your individual risk.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →If a password was exposed, change it and stop reusing it
Change the password on the breached service, then change it anywhere else you used the same or a similar password. An old account can still matter if its password was reused on an account you use today. The FTC’s breach guidance specifically advises changing passwords on accounts that use a similar password.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Make each replacement password unique. The FTC recommends aiming for at least 12 characters; a passphrase made from random words is another option. A browser or mobile browser may generate and save passwords, and a password manager can do the same. Choose a method you can use consistently, and protect access to the manager or browser profile. The FTC’s password guidance explains these options.
Secure your email and other important accounts with MFA
An exposed email address is not proof that your email account was accessed. Still, your inbox is especially important to protect because it can receive password-reset links for other services. Turn on multifactor authentication (MFA) for email first, then prioritize banking, credit cards, social media, tax filing, and payment apps.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
MFA adds a second factor beyond your password. Which options you can use depends on the service:
| Method | What to know |
|---|---|
| Physical security key | The strongest option described in the FTC guidance, when the account supports it. |
| Authenticator app | A safer option than codes sent by text or email; it avoids the cited risks of SMS SIM swaps and relying on email access. |
| Text or email code | Common but weaker than the options above. If this is all the service offers, the FTC says it is better than no second factor. |
Check the account’s security settings to see which methods it supports. Never share a verification code with someone who contacts you unexpectedly. See the FTC’s MFA guidance for more.
Check for signs that an account was taken over
Look for evidence of activity or changes you did not make. The FTC’s account-recovery guidance and 2024 consumer alert identify warning signs such as:
- You cannot log in with your usual credentials.
- Your recovery email address or phone number has changed.
- You see unexpected login alerts or messages sent without your permission.
Also check sent and deleted folders for messages you did not send. A breach listing your email address alone is not one of these takeover signs.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
If you cannot log in or find unauthorized changes
- Use the service’s account-recovery process. Start with the provider’s official recovery route if you cannot sign in; avoid links in unexpected messages.
- After regaining access, end other sessions. Sign out all other devices or sessions if the service offers that option.
- Restore trusted recovery details. Confirm that the recovery email address and phone number are yours.
- Remove unauthorized access or activity. Delete email-forwarding rules you did not create and check sent and deleted folders.
- Warn people who may have received messages. Ask contacts to ignore suspicious messages or requests for money from the compromised account.
The FTC also advises updating trusted security software and scanning your device during recovery. Its guide has further steps for recovering a hacked email or social account.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchTake additional steps if identity or financial information was exposed
If the notice includes a Social Security number, financial information, or other sensitive identity data—or if you find actual misuse—use IdentityTheft.gov/databreach for a tailored response plan. The FTC’s breach-response video discusses checking credit reports and considering a fraud alert or credit freeze where appropriate. If the breached company offers free recovery or monitoring services, the FTC advises taking advantage of them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
