A data breach alert does not always mean an attacker has accessed your account, but it does mean you should treat exposed information as a security signal. This checklist explains what to do after a data breach, which accounts and identity risks to track, how often to review them, and when new activity requires immediate action.
Overview
A breach can expose different types of information, including an email address, phone number, password, authentication token, payment details, or identity documents. The correct response depends on what was exposed and whether you reused the same information elsewhere. A notice about contact details calls for careful phishing awareness; a credential leak requires faster account protection; exposed identity data may require longer-term monitoring.
Start by verifying that the alert is genuine. Do not use a login link inside an unexpected breach notification. Instead, visit the affected company through a website or app you already know, or contact it using an independently located support channel. This reduces the chance that a fake notification turns an account breach warning into a phishing scam.
Once the alert is confirmed, work from the affected account outward. Protect the exposed account first, then review other services that share its email address, password, recovery address, or payment details. Keep a written record of what you changed and when. That record makes recurring reviews easier and helps you distinguish a one-time warning from a continuing account problem.
What to track
1. The information involved
Record the breach date, the organization involved, and the categories of information reported as exposed. Pay particular attention to passwords, security questions, authentication codes, session tokens, government identifiers, financial information, and account recovery data. The more sensitive the category, the longer your monitoring period should be.
2. Password reuse and credential exposure
Change the affected password immediately, using a unique password that is not used on any other service. If you reused that password, change it everywhere it appeared. Prioritize email, password managers, financial accounts, cloud storage, social platforms, workplace systems, and accounts that can reset other passwords.
Use a password manager to generate and store unique credentials. Do not respond to messages offering to “check” whether your password was exposed by asking you to paste it into a form. A legitimate security review should never require you to disclose your current password.
3. Active sessions and connected applications
Review the affected service’s list of signed-in devices and active sessions. Sign out of unfamiliar devices and use a full “sign out everywhere” option when available. Check connected applications, browser extensions, API keys, forwarding rules, and third-party integrations. Remove anything you no longer recognize or need.
For developers and administrators, rotate exposed tokens, secrets, access keys, and service credentials rather than simply changing a human login password. Review authentication logs for unusual locations, devices, privilege changes, or repeated failed sign-ins.
4. Multi-factor authentication and recovery settings
Enable multi-factor authentication on the affected account and on high-value accounts connected to it. An authenticator app or hardware security key may provide stronger protection than text messages, but any available second factor is generally preferable to password-only access. Save recovery codes in a secure location that is separate from the account itself.
Inspect recovery email addresses, phone numbers, trusted devices, security questions, and delegated users. Attackers may try to preserve access by changing recovery settings even after a password reset.
5. Financial and identity signals
If payment or identity information may have been exposed, watch statements, transaction alerts, account notices, and correspondence for activity you do not recognize. Review your credit reports and consider the protective monitoring or account controls available in your location. Be cautious of anyone asking for an upfront payment, remote access, passwords, or verification codes while claiming to help with the breach.
Common identity theft warning signs include unfamiliar accounts, unexpected password-reset messages, changes to account details, bills for services you did not request, or official-looking notices about applications you do not recognize. Treat each sign as a reason to contact the relevant organization through an independent channel.
6. Follow-up phishing and impersonation attempts
A public breach can give criminals a reason to impersonate the affected company. Track unexpected emails, text messages, calls, and social media messages that mention the incident, refunds, account verification, or urgent security steps. Do not click a link simply because it uses the company’s logo or familiar wording.
When in doubt, perform a separate website safety check before visiting a domain. The Malicious Link Checker Guide explains what to inspect in a suspicious URL, while the Brand Impersonation Scam Tracker covers patterns seen across email, social media, and fake websites.
Cadence and checkpoints
Use a staged response instead of treating breach recovery as a single password change.
- Immediately: verify the alert, change exposed or reused passwords, revoke sessions, enable multi-factor authentication, and secure recovery settings.
- Within the first few days: review connected applications, payment activity, email forwarding rules, security notifications, and other accounts that used the same credentials.
- Weekly for the first month: check account activity, password-reset messages, statements, and new communications referring to the breach.
- Monthly or quarterly: review important accounts, remove unused access, confirm that multi-factor authentication remains enabled, and check whether contact or recovery information has changed.
- After a new notice: reassess the response whenever the organization reports additional exposed data, a changed timeline, or a newly identified attack method.
Maintain a simple tracker with columns for service, exposed data, password changed, sessions revoked, multi-factor authentication enabled, recovery settings reviewed, and last check date. Avoid placing passwords or full identity numbers in this document.
How to interpret changes
Not every unusual message proves that an account was taken over. A breach may lead to an increase in spam or targeted phishing without producing a successful login. Look for patterns rather than isolated events: repeated password-reset requests, new devices, unfamiliar login locations, changed recovery details, or transactions that appear together are more concerning than a single generic email.
Prioritize signals according to the access they could provide. A suspicious sign-in to an email account is especially important because email can often be used to reset other accounts. A new forwarding rule, unknown administrator, or changed authentication method deserves prompt investigation. If you see evidence of active takeover, use a trusted device to secure the account, contact the provider, preserve relevant records, and avoid negotiating with the suspected attacker.
For a broader account review, see Account Takeover Warning Signs. If the incident involves a website or login portal you do not recognize, compare its domain, security signals, and behavior with the guidance in Is This Website Legit? A Practical Website Safety Check Guide.
When to revisit
Revisit this checklist monthly while the breach is still producing notices, suspicious messages, or account changes, then move to a quarterly review once activity has stabilized. Return sooner if the affected organization updates its disclosure, confirms that credentials or tokens were exposed, reports a new attack, or contacts you about an account change.
Use each review as a practical checkpoint. Confirm that important passwords remain unique, old sessions and unused applications are removed, multi-factor authentication works, recovery details are correct, and financial or identity records show no unexplained activity. Also review the security of the email account that receives breach notifications, because it may control access to many other services.
Take immediate action rather than waiting for the next scheduled review if you notice an unknown login, an unexpected password reset, a changed recovery method, a missing device, an unfamiliar transaction, or a message asking for a verification code. Save the alert, record the time, use the provider’s official recovery process, and report suspected fraud through the appropriate organization. A data breach cannot always be undone, but a structured response can limit reuse of exposed information and make later warning signs easier to recognize.
