Your data was in a breach: the checklist that actually helps

Work in this order: passwords first, then money, then identity, then monitoring. That sequence is not arbitrary. It runs from the things you can fix in minutes and that close the biggest hole, down to the things that only pay off over months. Most people do it backwards, spending the first evening enrolling in a free credit monitoring offer while the reused password that actually matters sits unchanged. Before anything else, find out which fields were exposed, because the whole checklist depends on that one answer.

The first thirty minutes

Five moves, in this order, and none of them require you to know anything technical.

1. Change the password on the breached account. Do it by typing the site address yourself, never through a link in the notification.
2. Change it everywhere you reused it. This is the whole point. A breach at a hobby forum matters only because the same password opens your email. Include variations with a different number or year on the end, because cracking tools generate those automatically.
3. Secure email first if email was involved. Your inbox can reset almost every other account, so it outranks your bank.
4. Turn on two-factor authentication on email, banking and anything holding a saved card. An app or a hardware key beats SMS, and how a second factor actually blocks a stolen password explains why.
5. Check for sessions and devices you do not recognize. Most major services have a security page listing active sessions. Sign them all out. A changed password does not always kill a stolen session cookie, and that is the step people skip.

If you are staring at a long list of reused passwords, this is the moment a password manager stops being optional. Doing forty by hand takes a weekend and you will not finish it.

Match the action to the field that leaked

Different fields need different responses, and doing all of them for a breach that leaked only email addresses is wasted effort.

Security answers deserve their own note. Mother's maiden name and first school never change, so once they are in a dump they are a permanent key to phone support at every company still using them. Stop answering them truthfully: store a random string as the answer, the same way you store a password.

Freezing your credit and the equivalents elsewhere

This is the single highest value move after passwords when identity data leaked, and in several countries it is free. What follows is general information rather than advice for a specific situation, and the exact mechanics change, so confirm the current process with each agency.

United States. A security freeze locks your credit file so a lender cannot pull it, which means a new account cannot be approved in your name. Federal law requires the nationwide bureaus to place and lift freezes free of charge, and you must do it with each bureau separately, since there is no single switch. Lifting one for a real application takes minutes online. A fraud alert is the weaker sibling: it tells lenders to verify identity but does not block anything, it expires, and placing it with one bureau obliges that bureau to tell the others. If you have a confirmed case of identity theft, an extended alert lasts considerably longer than the standard one. Freeze beats alert whenever you are not about to apply for credit.

United Kingdom. There is no identical statutory freeze. The nearest equivalent is a protective registration with the national fraud prevention service, which flags your details so lenders apply extra checks, renewed annually for a small fee. You can also add a Notice of Correction to your file at each credit reference agency explaining the situation, which forces manual review of applications.

Elsewhere in Europe. Practice varies by country. Some have a national credit bureau where you can register a fraud note, some have a central bank register, and some have nothing consumer facing at all. The reliable universal step is telling your own bank that your identity data is exposed, and checking your credit record with whichever agency operates where you live.

What the free monitoring offer is actually worth

Most breach letters include a year or two of free credit or identity monitoring. Accept it, because it costs nothing, but understand what you are getting.

Monitoring is detection, not prevention. It tells you after the fact: a new account appears on your file, your details show up in a fresh dump, an address change is filed. Useful, but a freeze prevents the event that monitoring only reports. Given one choice, take the freeze.

Three limits are worth knowing before you rely on it. Many offers cover only one of the credit bureaus, so activity at another goes unseen. Dark web scanning sounds impressive but mostly reports that your email appeared in a list you can look up yourself for free, which checking whether your credentials have leaked covers. And the enrollment window usually expires, so if you want it, sign up within the deadline in the letter rather than filing it away.

The identity theft insurance attached to these offers typically reimburses costs such as lost wages, notarization and legal fees rather than the stolen money itself, and it comes with a deductible and exclusions. Read what it actually covers before treating it as a safety net.

Cards, carriers and SIM swap protection

If a full card number leaked, ask for a replacement rather than relying on fraud detection. Card fraud is the most reversible kind of loss, though the protections differ by region, and this is general information rather than advice. In the US, credit card liability for unauthorized charges is capped at a small statutory amount and issuers commonly waive it, while debit card protection depends on how fast you report. In the UK and the EU, the rules on unauthorized payments generally require a refund unless you acted fraudulently or with gross negligence. Everywhere, reporting speed is what protects you. A payment you authorized that turns out to be a scam follows a different route, covered in how chargebacks and payment disputes work.

The phone number deserves more attention than it gets. If your number, name and address leaked together, someone has enough to attempt a SIM swap: convincing your carrier to move your number to their SIM, after which every SMS code goes to them. Call your carrier and ask for a port out PIN, a number lock or a transfer freeze, which is free with every major carrier and takes one call. Then move your important accounts off SMS codes and onto an authenticator app or a passkey.

The phishing wave that follows

Expect contact. Two kinds arrive after any breach that makes the news, and both work because they contain real details.

The first impersonates the breached company: a notice linking to a convincing password reset page. The second impersonates a bank fraud team, calling about suspicious activity and walking you through moving money to a safe account. That script works unusually well in the weeks after a public breach, because the story matches something you already believe.

One rule handles both: you contact them, never the reverse. Hang up, find the number on your card or in the official app, call back. No real fraud team objects, and none will ever ask you to read out a code or move money. The wider pattern is in how phishing gets past careful people.

The week after, and then the year after

Once the urgent work is done, spend twenty minutes making the next breach cheaper. Review account recovery everywhere that matters, because a stale backup email or dead phone number is the gap an attacker walks through, and setting recovery up before you need it is the one piece you can only do in advance. Replace SMS second factors with an authenticator app. Keep the notification and any reference numbers in one folder.

Then set two reminders. At three months, pull your credit report and read it line by line. At twelve months, do it again, because identity data gets used long after the news cycle ends, for reasons explained in what a breach actually exposes and when it gets used. If something unfamiliar does appear, the response is a different and more procedural one, set out in the early signs of identity theft and the first moves.