Change the exposed password immediately by opening the affected service’s official app or typing its known web address yourself. Do not use an unexpected breach notification link. Then change every identical or similar password you used elsewhere, give each account a unique replacement, turn on multifactor authentication (MFA), and secure the email account used for password resets.
A breach notice does not necessarily prove that someone signed in to your account, but an exposed password should be treated as public. The steps below limit damage, help you detect an existing takeover, and show when a password incident has expanded into an identity-theft problem.
As an Amazon Associate I earn from qualifying purchases.
1. Change the exposed password through the real service
Go directly to the company’s known app or website. Type the address yourself, use a bookmark you created earlier, or open the app from your device rather than following a link in an email, text message, or social-media post. Attackers sometimes imitate breach notices to steal the replacement password.
- Sign in through the official service.
- Open the account, security, or password settings.
- Replace the exposed password with a new, unique one.
- Save the change and note any confirmation or security alerts.
- Review active sessions or logged-in devices and sign out of anything unfamiliar.
The Federal Trade Commission (FTC) states: “If a company or website tells you it lost your password in a data breach, change your password right away.” Changing only the password on the breached service is not enough if you reused it anywhere else.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Find and replace every reused password
Password reuse is the bridge between one breach and many account takeovers. Attackers can test an exposed email-and-password combination on shopping, banking, social, work, cloud-storage, and government services. NIST explains that passwords exposed after a breach can become easy to find online, making reuse especially dangerous.
Search your password manager, browser-saved credentials, or personal records for the exposed password. Also look for variants: the same base word with a different number, capitalization, punctuation mark, or year. The FTC recommends changing the password on other services when the same or a similar password was reused.
- Start with email, financial accounts, health portals, workplace systems, cloud storage, and accounts containing personal data.
- Change accounts that used the exact password before lower-risk accounts.
- Do not “modify” one password with a predictable suffix; create a genuinely different credential for every service.
- If you cannot remember where a password was used, assume it may have been reused and reset likely accounts.
3. Create a long, unique replacement
Use a random password or a long passphrase that has not appeared on another account. The FTC advises aiming for at least 12 characters and suggests random-word passphrases. NIST’s consumer guidance, updated August 20, 2025, says to use at least 15 characters when a person must create a password themselves. These are source-specific thresholds, not a reason to shorten a password generated by a password manager.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Situation | Practical choice | Guidance |
|---|---|---|
| You create the password yourself | Use a memorable random-word passphrase of at least 15 characters | NIST consumer guidance, updated August 20, 2025 |
| You follow FTC consumer advice | Aim for at least 12 characters, preferably as a random-word passphrase | FTC password-breach guidance |
| A password manager generates it | Use a long random string accepted by the service | Check the service’s length and character rules; never reuse it |
Do not use names, birthdays, addresses, sports teams, keyboard patterns, or publicly visible facts. NIST Digital Identity Program leader Ryan Galluzzo put the basic risk plainly: “The worst password I can think of is ‘password’ or ‘12345,’”
4. Use a generator or password manager if it helps
A browser’s built-in generator can create and save a unique credential at no extra cost. A standalone password manager can make credentials available across different browsers and devices, organize them, and alert you to duplicate entries, depending on its features. Neither is required to respond to a breach, and no particular vendor is universally best.
| Option | Ease of setup | Across-device access | Protection to check |
|---|---|---|---|
| Browser generator and vault | Usually simplest when you use one browser ecosystem | Depends on that browser account and device support | Protect the browser account with MFA and a strong unique password |
| Standalone password manager | More setup, with dedicated import and organization tools | Often designed for multiple browsers, phones, and computers | Protect the manager account with MFA and keep recovery information safe |
NIST recommends password managers for accounts that require passwords because they can generate and store unique credentials. The FTC also describes browser-generated passwords and third-party managers. A paid plan is optional; the security benefit comes from unique credentials and a protected vault, not from buying a particular product.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Turn on MFA, choosing the strongest practical method
MFA means a stolen password alone should not be enough to sign in. Enable it first on the breached account, then on email, financial services, work systems, and other high-value accounts. The FTC identifies authenticator apps and security keys as more secure than text or email codes when those choices are available. NIST likewise notes that MFA methods differ in security.
| Method | Security and phishing resistance | Convenience and recovery | Use when |
|---|---|---|---|
| Security key | Strong protection against many phishing attacks; requires compatible service and device | Carry the key and keep a spare or documented recovery method in a secure place | The account supports FIDO2-compatible keys and you can manage the physical device |
| Authenticator app | Generally stronger than text or email codes and works without cellular service | Requires access to the enrolled device; save the service’s recovery codes securely | The service supports an app and you can protect or restore the app account |
| Text message or email code | Less secure than a security key or authenticator app | Familiar and widely supported, but depends on phone or email access | No stronger method is offered; enable it rather than leaving MFA off |
A FIDO2-compatible hardware security key is an optional physical choice, not a requirement. Confirm that the affected service supports security keys and that the key works with your phone or computer before relying on it. Store recovery codes offline or in another protected location so losing a device does not lock you out.
6. Secure your email account first
Email is a priority because password-reset links for other accounts commonly arrive there. Someone who controls your inbox may be able to reset accounts whose passwords were never breached.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Give the email account a unique password that has never been used elsewhere.
- Enable MFA, preferring a security key or authenticator app when supported.
- Check the recovery email address and phone number; remove anything you do not recognize.
- Review forwarding rules, filters, delegated access, sent mail, deleted mail, and recent sign-ins for changes you did not make.
- Inspect connected apps and revoke access that is unfamiliar or no longer needed.
Use the email provider’s current help pages for exact menu names because controls vary by service, device, region, and time.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Check whether the account was already taken over
Warning signs include an unfamiliar login alert, changed recovery details, unexpected password-reset messages, messages or posts you did not send, new contacts, deleted mail, or devices you do not recognize. A breach notification alone does not establish that an attacker accessed the account, so distinguish an exposed credential from evidence of active compromise.
If you can still sign in
- Change the password from the official security settings.
- Sign out all devices or terminate all other sessions.
- Enable MFA and save recovery codes securely.
- Verify recovery addresses, phone numbers, authenticator devices, and security keys.
- Review account activity, connected applications, forwarding rules, sent and deleted messages, posts, purchases, and contacts.
- Remove unauthorized changes and notify contacts if messages were sent from the account.
If you cannot sign in
Use only the provider’s official account-recovery flow. Avoid people or services that promise to “recover” the account through a payment or an unsolicited message. After regaining access, perform every step in the previous checklist and check whether the attacker changed recovery information before you were locked out.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
8. Decide whether the breach involved identity information
A password-only exposure and exposure of identity data require different responses. If the notice says a Social Security number or other sensitive personal information was involved, consult IdentityTheft.gov for the appropriate U.S. recovery plan.
- Order your free credit reports through the official process and look for unfamiliar accounts or inquiries.
- Consider a credit freeze or fraud alert if identity information was exposed; either can make it harder to open new credit in your name.
- Follow the breached organization’s notice for specific monitoring or replacement steps.
- Keep copies of the notice and a record of the dates you changed passwords and reported suspicious activity.
Do not assume that every password breach requires a credit freeze. That decision depends on what personal data was exposed, not merely on the existence of a compromised password.
9. Avoid the mistakes that prolong exposure
- Waiting for more details: Change the password as soon as you receive a credible notice; you can investigate scope afterward.
- Using the notification link: Navigate independently to reduce phishing risk.
- Changing only one account: Replace identical and similar passwords wherever they were reused.
- Creating predictable variations: A new year or punctuation mark does not make a reused base password unique.
- Leaving email until last: Protect the reset channel before working through lower-priority accounts.
- Assuming MFA makes passwords irrelevant: MFA adds a layer but does not justify ignoring suspicious sessions, recovery changes, or phishing.
- Buying software under pressure: A password manager or hardware key can help, but neither is a prerequisite for immediate protection.
- Freezing credit automatically: Reserve identity-theft measures for cases involving identity data or suspicious credit activity.
10. Understand what the breach notice does—and does not—tell you
Organizations describe incidents differently. A notice may say that passwords were exposed, hashed, encrypted, or accessed by an unauthorized party, and the practical risk depends on those details and on whether you reused the credential. Treat any password identified as exposed as unsafe even when the notice says the password was protected.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe scale of the broader problem is substantial: NIST’s consumer article attributes more than 3,000 data breaches in 2024, potentially exposing hundreds of millions of online accounts, to the Identity Theft Resource Center. That figure describes reported incidents overall, not the probability that your particular account was accessed.
NIST also uses an illustration that a modern PC can attempt 100 billion guesses per second when discussing offline password guessing. That is an example of the risk to stolen password data, not a universal speed for every attacker or online login system. Rate limits, hashing methods, MFA, and the attacker’s access all affect the real situation.
Quick Recap
11. Keep a short recovery checklist
- Change the breached password through the official service.
- Change every reused or similar password, beginning with email and high-value accounts.
- Use unique, long credentials; follow the FTC’s 12-character aim or NIST’s 15-character self-created-password guidance as applicable.
- Turn on MFA, preferring a security key or authenticator app when supported.
- Review sessions, recovery details, forwarding rules, connected apps, and account activity.
- Use the provider’s recovery process if access is lost.
- Check IdentityTheft.gov and your credit reports when an SSN or other identity data was exposed.
- Continue watching for password-reset messages, unfamiliar logins, unauthorized transactions, or messages sent from your accounts.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
