What to Do After a Data Breach — Step-by-Step (2026)
You've received a breach notification, or you've discovered your data was exposed. The first 48 hours determine how much damage is done. Here is exactly what to do, in the right order, to protect your accounts, money, and identity.
Quick Answer
After a data breach: (1) Identify exactly what data was exposed, (2) Change passwords for the breached service and any account using the same password, (3) Enable two-factor authentication everywhere, (4) Check if your email appeared in any other breaches, (5) Monitor your bank statements, and (6) Place a fraud alert with credit bureaus if financial data was exposed.
Data breaches — the scale in 2025–2026
5.6B
Records breached in 2025
$4.88M
Average cost of a data breach
197
Average days to detect a breach
33B
Stolen accounts on dark web markets
Step 1: Find Out Exactly What Was Exposed (First 30 Minutes)
Before you can respond effectively, you need to know what was stolen. Not all breaches are equal — a breach of your email address alone requires different actions than a breach that included your password, payment card details, or government ID number.
How to find out what was exposed:
- Read the breach notification email carefully — reputable companies are legally required to disclose what categories of data were involved
- Check the company's official breach notice page (search "[company name] data breach 2025/2026")
- Run your email through SafeSearchScan's breach checker — it shows breach details per service
- Check media coverage — major breaches are reported in tech news with specifics about what data was taken
What the exposed data means for you:
Step 2: Change Passwords for Affected Accounts (First 2 Hours)
Start with the breached service. Then, critically, identify any other accounts where you used the same or similar password. This is where most damage from breaches spreads — via password reuse.
- 1Change the password for the breached service first, using a strong unique password
- 2Think back: which other accounts use the same or similar password? Change those too
- 3Prioritise: email account, banking, social media, Amazon/Apple/Google
- 4Use a password manager to generate and store unique passwords going forward
- 5Do not use a device that may be compromised (if malware is suspected) — change passwords from a clean device
Step 3: Enable Two-Factor Authentication Everywhere (Hours 2–4)
If an attacker has your new password (from a future breach), 2FA prevents them from using it. After a breach is the ideal time to enable 2FA on all accounts you care about — you're already changing passwords, so add 2FA at the same time.
Start with email — your email account controls every other account via password resets. Then banking, social media, and any account linked to your payment details. Use an authenticator app (Google Authenticator, Authy, or Aegis) rather than SMS wherever possible.
Step 4: Monitor Your Financial Accounts (First 24 Hours)
If the breach exposed payment card details, bank account numbers, or other financial data, take these steps:
- Contact your bank immediately: Inform them of the breach. Ask about temporary holds, new card issuance, or fraud monitoring enhancements.
- Review recent transactions: Look for unfamiliar small charges — fraudsters often test with small transactions before making larger ones.
- Set up transaction alerts: Enable instant notifications for all transactions above a threshold (often configurable in banking apps).
- Request a new card number: If your card number was directly exposed, a new card number is safer than waiting for fraud to occur.
- Check your credit report: Look for new accounts you didn't open, credit enquiries you didn't authorise, or address changes you didn't make.
Step 5: Place a Fraud Alert or Credit Freeze (If Identity Data Was Exposed)
If your Social Security Number, National Insurance Number, passport number, or date-of-birth and address combination was exposed, placing a fraud alert or credit freeze is one of the most powerful protections available.
Fraud Alert
Tells credit bureaus to add a flag to your credit file, meaning lenders must take extra steps to verify your identity before opening accounts. Free, lasts 1 year, and notifying one bureau (Equifax, Experian, or TransUnion) legally requires them to notify the others.
Credit Freeze (Security Freeze)
Completely locks your credit file so no new accounts can be opened in your name — even by you. Free in the US since 2018. Must be placed with each bureau separately. Requires lifting temporarily when you want to apply for credit. The strongest protection available.
UK: CIFAS Protective Registration
If you are in the UK, you can register with CIFAS (fraud prevention service) for a protective registration flag on your credit file. This costs £25 and lasts 2 years, but is worth it if your identity documents were exposed.
Step 6: Stay Vigilant for 12 Months After the Breach
Breach damage is not always immediate. Stolen data is sold and traded on dark web markets for months or years. After a breach, stay alert for:
- Phishing emails that reference details exposed in the breach (attackers use personal data to create convincing lures)
- Credit applications you didn't make — check your credit report quarterly
- Accounts you don't recognise appearing in password manager or Google/Apple account
- Tax return fraud — identity thieves may file a tax return in your name to claim a refund
- Medical identity theft — fraudulent claims in your name on your health insurance
Check If Your Email Appeared in a Breach
Find out which breaches your email address appeared in — including what data was exposed and when. Free and instant.
Check for Breaches Free →See Exactly What Was Leaked About You
Enter your email to see every breach it appeared in, what data was exposed, and when.
Check Email Breaches Free →Frequently Asked Questions
How do I know if my data was in a breach?
You might receive a notification from the breached company (legally required in many jurisdictions), or you can proactively check using a breach monitoring service. Enter your email address into SafeSearchScan's email breach checker to search known breach databases instantly. The service will tell you which companies were breached, what data was exposed, and when.
Should I pay for identity theft protection after a breach?
Many companies offer free identity monitoring after a breach — always accept it. Paid identity theft protection services (like LifeLock or Experian IdentityWorks) add features like insurance, resolution support, and wider monitoring. Whether they're worth paying for depends on what data was exposed. If financial account numbers, SSN, or passport details were exposed, paid protection may be worthwhile. If only email and hashed passwords were exposed, free monitoring is usually sufficient.
How long does identity theft take to appear after a breach?
It can be immediate or take months to years. Attackers often "age" stolen data — selling it on dark web marketplaces or waiting for security teams to stop actively monitoring. Financial fraud tends to happen quickly (within weeks). Identity fraud (opening credit accounts in your name) can happen months or years after a breach. This is why ongoing monitoring is more valuable than one-time checks.
What data from a breach is most dangerous?
In rough order of danger: (1) Social Security numbers / National Insurance numbers — can be used for identity fraud; (2) Bank account details — direct financial access; (3) Credit card numbers — used for fraud within days; (4) Passwords (especially if reused) — enables account takeovers; (5) Date of birth + address combinations — used for identity verification; (6) Email addresses alone — enables targeted phishing. Multiple categories together are exponentially more dangerous.
Can I sue a company after a data breach?
In many jurisdictions, yes — class action lawsuits against breached companies have resulted in significant settlements. The UK GDPR and US state laws (CCPA in California, etc.) establish rights to compensation for damages caused by data breaches. However, individual lawsuits are rarely cost-effective unless you suffered substantial proven losses. Joining a class action (often requires no upfront cost) is the more practical route for most individuals.
Related Guides
Has Your Email Been Hacked?
Signs of compromise and how to recover
What Is Two-Factor Authentication?
Stops 99% of account hacks
How to Create a Strong Password
Passwords that take centuries to crack
How to Prevent Identity Theft
10 protective habits to set up today
How to Spot a Phishing Email
9 warning signs to check every time
What Is Malware?
8 types explained with real examples