← All articles

Your Password Was Leaked. Here Is What to Do Next.

How Breaches Happen

Data breaches are not your fault. They happen when a company's security is compromised and their user database is stolen. Your email, password hash, and sometimes personal information end up on hacker forums.

Common breach sources include:

• Company servers hacked through software vulnerabilities
• Employee credentials stolen via phishing
• Misconfigured cloud storage exposing databases
• Third-party vendors with weak security

Step 1: Change the Breached Password Immediately

The moment you learn a password was compromised, change it. Do not wait. Use a password generator to create a new, completely random password with at least 16 characters.

Do not base the new password on the old one. Do not just add a number or change a letter. Create something entirely new.

Step 2: Change Every Account Using That Password

If you reused the breached password on other accounts (most people do), those accounts are now vulnerable too. Attackers will automatically test your credentials on hundreds of popular services within hours of a breach.

Go through your accounts and change every one that shared the same password. This is the most time-consuming step, but it is the most important.

Step 3: Enable Two-Factor Authentication

After changing your passwords, enable 2FA on every account that supports it. This adds a second barrier even if a password is compromised in the future.

Prefer authenticator apps (like Google Authenticator or Authy) over SMS codes, which can be intercepted.

Step 4: Check for Unauthorized Activity

Review recent activity on your affected accounts:

• Look for login attempts from unfamiliar locations
• Check for password reset emails you did not request
• Review sent messages, purchases, or transactions
• Check if account recovery options were changed

If you find unauthorized activity, report it to the service immediately.

Step 5: Use a Password Manager Going Forward

The only reliable way to use unique passwords for every account is a password manager. It stores and fills your credentials automatically.

Combined with a password generator for creating new passwords, this prevents the cascade effect where one breach compromises multiple accounts.

Step 6: Monitor for Future Breaches

Sign up for breach notification services that alert you when your email appears in new data leaks. This gives you early warning to act before attackers can use your credentials.

Prevention Checklist

• Every account has a unique, randomly generated password
• Passwords are at least 16 characters
• Two-factor authentication is enabled everywhere
• You use a password manager
• You monitor for breach notifications
• You never send passwords via email or text