You're in a Data Breach: What to Do in the First 24 Hours
With billions of records leaked every year, “your data was in a breach” is a when, not an if. What matters is what you do next — and most of it should happen in the first day.
When a company you use is breached
First, find out what was actually taken — the breach notice says. Your response depends on it:
- Password (even “encrypted”): change it on that site now, and on every site where you reused it. This is the moment reuse becomes an emergency — a password manager (our picks) makes it a non-event next time.
- Email address and phone: expect targeted phishing that references the breach itself (“Following the incident, please verify your account…”). The breach notice becomes the phishing bait. Re-read how to spot phishing.
- Card numbers: you generally aren’t liable for fraud, but request a replacement card and turn on transaction alerts rather than waiting.
- SSN / national ID, date of birth, address: freeze your credit at all bureaus. This is the data that enables new-account fraud, and it never expires.
Sign up at haveibeenpwned.com to get notified automatically when your email shows up in future breaches.
When your own account is taken over
Move fast and in this order:
- Try the password reset. If it still goes to your email/phone, reset, then immediately turn on 2FA.
- Check the account’s settings for persistence: attackers add their own recovery email, phone number, forwarding rules (in email accounts) and app passwords so they can get back in after you reset. Remove anything you don’t recognise, and sign out all other sessions/devices.
- If you’re locked out entirely, use the platform’s account-recovery flow immediately (Google, Meta, Apple and banks all have dedicated hijacked-account processes) — recovery gets harder the longer the attacker holds the account.
- Warn your contacts from another channel: hijacked accounts are used to scam friends (“I’m stranded, can you send money?”) within hours.
- Audit connected accounts: anything that used “Log in with” the stolen account, and any account whose resets went to a stolen email.
If money was stolen
Call your bank’s fraud line the moment you notice — recall windows for wire transfers are short. Then report to ic3.gov (US) or your national cybercrime portal; reports feed the investigations and takedowns that stop the operation. Keep every email, screenshot and reference number.