Short answer
A data breach means a company lost data that included yours — often an email address, sometimes a password, phone number or home address. Check what was exposed (the company’s notice, Have I Been Pwned, Google Password Checkup or Apple’s Security recommendations). Then, in this order: change the exposed password and every account where you reused it, starting with your email; turn on two-step verification or a passkey; and expect follow-up phishing — the UK’s NCSC warns that scam messages often arrive weeks after a breach is announced. If ID or card data leaked, watch your bank statements and, in the US, consider a free credit freeze.
First, find out what leaked
| What leaked | The risk | What to do |
|---|---|---|
| Email address only | Phishing and spam that feel personal | Distrust messages “about the breach”; don’t use their links |
| Password | Account takeover, above all where it was reused | Change it everywhere you used it; turn on 2FA |
| Phone number | Scam texts and calls, SIM swap attempts | Ask your carrier for a PIN — see SIM swap |
| Address, date of birth | Targeted scams that “verify” your details | Be wary of callers who already know them |
| ID or card numbers | Fraud and new accounts in your name | Call your bank; consider a credit freeze or fraud alert (US) |
Change passwords in the right order
- Your email account first — every other password reset goes through it.
- The breached service itself.
- Every account where you used the same or a similar password: attackers try leaked passwords on other sites automatically.
- Banking, payment, shopping and social media accounts.
Use a different password for every account — a password manager makes that realistic — and where it’s offered, a passkey removes the password altogether.
Tools that tell you if you’re exposed
- Have I Been Pwned (haveibeenpwned.com): a free search of public breaches by email address. The UK NCSC points people to it.
- Google Password Checkup: at passwords.google.com, it flags saved passwords that are exposed, reused or weak.
- Apple Passwords: Security recommendations flag leaked, reused and weak passwords on iPhone, iPad and Mac.
Watch for the follow-up scam
Breaches are followed by emails, texts and calls that use the leaked details to sound genuine: “your account is compromised, click here”, a “refund for the breach”, or a caller who already knows your address. The NCSC’s advice is to contact the company through its official website or app, never through the links or numbers in the message. Never give a code or password to someone who contacted you. Report what you receive — see how to report phishing.
If ID or financial data leaked
- Tell your bank and check statements for payments you don’t recognise.
- In the US, a credit freeze is free to place and lift, and must be set with each of the three credit bureaus; an initial fraud alert lasts one year and can be renewed, according to the FTC.
- Elsewhere, ask your bank or national fraud service what protection exists — see where to report online fraud by country.
Frequently asked questions
Only my email address was in the breach. Do I need to do anything?
Nothing urgent, but expect more targeted phishing. If the breached site also stored your password, change it there and anywhere you reused it.
Is Have I Been Pwned safe to use?
Yes. It is a widely used free service that the UK NCSC refers people to, and you only enter an email address — never a password.
Should I delete the breached account?
If you no longer use it, closing it reduces future risk. Change the password first, then delete the account through the service’s official settings.
How long does a US fraud alert last?
An initial fraud alert lasts one year and can be renewed, according to the FTC. A credit freeze stays in place until you lift it, and placing or lifting it is free.
Sources: NCSC — data breaches: guidance for individuals and families, Have I Been Pwned, Google Account Help — change compromised passwords (Password Checkup), Apple iPhone User Guide — change weak or compromised passwords, FTC — credit freezes and fraud alerts