What to Do After a Data Breach Guide: Plain-English Steps to Stay Safe

When a company you use loses your personal details in a data breach, the real danger often comes afterwards, from criminals who use those details to trick you or get into your accounts. A data breach means someone who should not have it has got hold of information a company or organisation held about you, such as your email address, password, phone number, address or bank details. You cannot undo the breach, but you can make the stolen information much less useful to criminals. This guide explains, in plain English, what to do in the first hour, the first week and the months after. It is written for individuals, families, older people and very small businesses. For organisations handling a breach, see the Incident Response Guide.

Key takeaways

• Check the news is real first. Confirm the breach through the company's own website or app, never through a link or phone number in a message you were sent.
• Change any exposed or reused password. If the leaked password is used anywhere else, change it there too, and use a different password for every account.
• Turn on two-step verification. A second check, such as a code on your phone, stops most criminals who only have your password.
• Expect scam messages for months. Criminals often contact breach victims long after the news, pretending to be the company, your bank or the police.
• Report losses quickly. If money has gone, call your bank straight away and report it to Report Fraud (UK) or the FTC (US).

First hour: work out what was taken

Do not panic, and do not act on the first message you receive. The NCSC (the UK's National Cyber Security Centre) advises contacting the organisation through its official website or social media, not through the links or contact details in any message you have been sent. Criminals send fake "your data was breached" emails precisely because people are worried.

Once you know the breach is real, find out what kind of information was involved. The organisation's notice should say. What you need to do depends on what was taken:

If the notice is vague, assume the worst likely case for that service. A shop that took your card is likely to have held your name, address, email and card details.

First day: lock down your accounts

Most harm after a breach comes from passwords. Criminals take leaked email and password pairs and try them on many other websites automatically. This is called "credential stuffing". It works because many people use the same password in several places. In the 23andMe breach, attackers used passwords stolen from other websites to get into more than 18,000 accounts, and information about nearly 7 million people was exposed through a feature that linked relatives. Fewer than 22 percent of customers had turned on extra login protection.

1. Change the password for the breached account. Make it long and unique. Three random words joined together is a good way to make one you can remember.
2. Change it everywhere else you used it. The NCSC is clear that any other account sharing that password needs changing too. Start with your email, because whoever controls your email can reset the passwords for almost everything else.
3. Use a password manager. This is an app that creates and remembers a different strong password for each site, so you only need to remember one. See the Password Managers Explained for Everyone Guide.
4. Use a passkey where offered. A passkey lets you sign in with your phone's fingerprint, face or PIN instead of a password. The NCSC suggests using one where it is available, because there is no password to steal.
5. Turn on two-step verification. Also called two-factor authentication or 2SV, this asks for a second proof, such as a code from an app, when someone signs in. Start with email, banking and shopping. See the Two-Factor Authentication for Everyone Guide.
6. Sign out everywhere. Most accounts have an option in their Settings, Security or Privacy menus to log out of all devices. Anyone using your old password will then be locked out. Menu names change, so check the provider's help pages if you cannot find it.

First week: check for signs of misuse

Look over your important accounts for anything you did not do. The NCSC lists these warning signs:

• You cannot log in, or your password or security settings have changed.
• Messages you do not recognise in your sent folder or social media.
• Logins from unusual places or at odd times. Many services show a list of recent sign-ins or devices.
• Payments or orders you did not make on bank, card or shopping accounts.

Check your email account carefully. The NCSC's guidance on recovering a hacked account warns that criminals often set up forwarding rules or filters so they quietly receive copies of your emails, including password reset links. In your email settings, look at forwarding, filters and connected apps, and remove anything you did not set up. Also check that the recovery phone number and backup email address on the account are still yours. See the Securing Your Email Account Guide.

If an account has already been taken over, use the provider's official recovery process (each service has its own on its help pages). If you cannot get it back, the NCSC suggests creating a new account, telling your contacts the old one is no longer yours, and updating your bank and other services with the new details.

Check where else your details have leaked

Breaches are common, so your details may already be in older ones. The NCSC suggests a breach checking tool such as Have I Been Pwned, or a similar feature in your password manager or antivirus. Have I Been Pwned lets you search your email address to see which known breaches it appears in. Its "Notify Me" service emails you if your address turns up in a future breach. It does not show you any leaked password. Its separate Pwned Passwords check tells you whether a password has appeared in a breach. If it has, stop using it.

The months after: protect your credit and your identity

If your name, address, date of birth or ID numbers were taken, someone could try to open accounts or take out credit in your name. These steps make that harder.

In the UK

• Check your credit report. Credit reference agencies, such as Experian, Equifax and TransUnion, keep a record of loans, cards and accounts in your name. You can check your report for free. Look for searches or accounts you do not recognise.
• Consider Cifas Protective Registration. Cifas is a UK fraud prevention service. For £30 for two years, it places a warning flag against your details so that member organisations make extra checks when someone applies for credit in your name. It does not affect your credit score, is not insurance, and Cifas says it cannot guarantee every application will be checked. Applications are online only, and it does not remind you when it expires.

In the US

• Freeze your credit. The FTC (Federal Trade Commission) says a credit freeze with each of the three bureaus, Experian, TransUnion and Equifax, blocks new credit being opened in your name. It is free to place and lift.
• Place a fraud alert. An initial fraud alert is free, lasts one year, and asks businesses to check with you before opening a new account. You only need to contact one bureau, which must tell the other two.
• Check your reports. You can get free credit reports weekly from AnnualCreditReport.com, which the FTC says is the only authorised site for them.

The sibling Credit Freezes and Fraud Alerts Guide explains these options in more detail.

Should you pay for monitoring? Some breached companies offer free credit or identity monitoring. It can be worth accepting, but sign up through the company's official website, not a link in an email. The FTC notes you can do most of this protection yourself at little or no cost, and that identity theft insurance generally does not repay money stolen from you.

Signs of a breach-related scam

The NCSC warns that scams can arrive well after a breach is in the news. Criminals use the stolen details to sound convincing: they may know your name, your address or what you bought. Watch for:

• Urgency: "act now or your account will be closed".
• Requests for personal information: your bank or any other official organisation will never ask you to send passwords, PINs or full card details.
• Offers of compensation or refunds for the breach that ask for your bank details.
• Calls offering to "scan" or "fix" your device, or asking you to install software.
• Fake delivery messages asking for a small payment.

If in doubt, hang up or close the message, and contact the organisation using a number or website you already trust. See the How to Spot a Phishing Email Guide.

Where to get help

United Kingdom

• Suspicious emails: forward them to the NCSC's Suspicious Email Reporting Service ([email protected]).
• Suspicious texts: forward them to 7726, a free number run by mobile networks.
• Suspicious calls: hang up and tell your phone provider.
• Lost money or been hacked: tell your bank, then report to Report Fraud online or on 0300 123 2040 (England, Wales and Northern Ireland). In Scotland, call Police Scotland on 101.
• Unhappy with how the company handled your data: complain to the company first, then you can raise it with the ICO (Information Commissioner's Office), the UK data protection regulator.
• Threats or blackmail using your stolen data: call the police on 101, or 999 if you are in danger.

United States

• Identity theft: report it at IdentityTheft.gov to get a free, personal recovery plan from the FTC.
• Online crime: report to the FBI's Internet Crime Complaint Center (IC3).
• Free credit reports: AnnualCreditReport.com or 1-877-322-8228.

Common failure patterns

• Changing only one password. People update the breached account but leave the same password on email and shopping sites, which is exactly what credential stuffing targets, as the 23andMe case showed.
• Clicking the link in the "breach notice". Fake breach emails and texts are common. Always go to the company's site yourself.
• Forgetting the email account. If criminals control your email, or have set up a hidden forwarding rule, they can reset everything else.
• Relaxing after a few weeks. Scams using breached data can arrive months later.
• Using text message codes as the only protection on a phone number that was leaked. Where an app or passkey is offered, prefer it. See the SIM Swap Fraud Guide.
• Not reporting a loss quickly. Banks can act faster the sooner you tell them.

Lessons from incidents

The 23andMe breach shows two lessons for everyone. First, a password leaked from one website can unlock another, so unique passwords matter more than complex ones. Second, some information cannot be changed. You can reset a password, but not your date of birth or your DNA, so think about what you share with any company in the first place.

Practitioner checklist

• Confirm the breach on the company's official website or app, not through a message.
• Find out what was taken: email, password, phone, address, bank details or ID.
• Change the breached password and every other account that used it, starting with email.
• Turn on two-step verification or a passkey for email, banking and shopping.
• Sign out of all devices, and check email forwarding rules, recovery phone and backup email.
• Search your email on Have I Been Pwned and sign up for alerts.
• Check your credit report; in the UK consider Cifas Protective Registration, in the US a credit freeze and fraud alert.
• Treat every unexpected call, text or email about the breach as a possible scam for at least the next year.
• If money has gone, call your bank and report to Report Fraud (UK) or IdentityTheft.gov (US).

Standards and references

• NCSC: Data breaches: guidance for individuals and families
• NCSC: Recovering a hacked account
• Report Fraud: Report cyber crime and fraud
• FTC: What to know about identity theft
• FTC: Free credit reports
• Cifas: Protective Registration
• Have I Been Pwned: FAQs
• ICO: Make a complaint

Related NHI Mgmt Group resources: Identity Theft Recovery Guide · Credit Freezes and Fraud Alerts Guide · Password Managers Explained for Everyone Guide · Data Breach Statistics Guide