What to Do After a Data Breach: Check If You Were Leaked and Lock Down Your Accounts

Updated October 30, 2026.

If a company has just told you your details were in a data breach, here is what to do after a data breach, in the order that matters. Most of the harm doesn't come from the leak itself. It comes later: a reused password that opens a second account, a hijacked phone number, or a convincing "refund" message that quotes your real details back to you.

Below: how to check if your data was leaked, seven steps to lock your accounts down, credit freezes in the US, UK, EU and Japan, and what criminals can do with each kind of data. It's all based on official guidance, linked at the end.

What to do after a data breach: the short version

• Find out exactly what leaked. Read the company's notice on its own website, not through a link in a message. The fix depends on the type of data.
• Change the leaked password today, and every reuse of it. Reused passwords turn one breach into many.
• Upgrade how you sign in. Use a passkey where you can, otherwise an authenticator app. The US cyber agency CISA rates text and email codes as the weakest option.
• Lock your email and phone number. They are the reset buttons for almost every other account.
• Freeze or flag your credit if ID numbers leaked. It's free in the US; the UK, EU and Japan have different tools.
• Treat every follow-up message as a possible scam. The UK's National Cyber Security Centre (NCSC) warns scam messages can arrive well after a breach goes public.

How to check if your data was leaked

Start with the company's own notice

Companies are often legally required to tell you. Under Article 34 of the EU's GDPR, a company must tell affected people "without undue delay" when a breach is likely to put them at high risk, in plain language, including the likely consequences. In Japan, the Personal Information Protection Commission (PPC) has required businesses to report leaks and notify affected people since April 1, 2022, when sensitive data is involved, there is a risk of financial harm, the leak was malicious, or more than 1,000 people are affected.

The notice is the best source for which data was taken, but find it yourself: the NCSC advises contacting the organisation through its official website, not through links or phone numbers in a message. Don't expect it to explain the attack. The Identity Theft Resource Center (ITRC) found 70% of US breach notices in 2025 included no attack information.

Have I Been Pwned: was my email in a data leak?

Have I Been Pwned (HIBP) is a free service from security researcher Troy Hunt. Type in an email address and it lists the known breaches that address appears in. On October 30, 2026, it counted more than 17.8 billion "pwned addresses" from 1,048 breached websites, and the NCSC names it as a tool for checking your details.

At a high level, HIBP indexes the email addresses from breach data that has become public. Its FAQ says it doesn't load the matching passwords alongside them, and breaches it classes as "sensitive" can only be searched by the verified owner of the address. Its free Notify Me service emails you if your address turns up in a future breach.

A separate tool, Pwned Passwords, checks a password. It's hashed on your device (turned into a fixed-length scrambled code), only the first five characters of the hash are sent, and the match happens on your side, so the password itself stays private.

A clean result isn't an all-clear: HIBP only knows about breaches whose data has surfaced.

Password manager breach alerts

Most password managers run similar checks automatically. 1Password's Watchtower, for example, checks saved passwords against Pwned Passwords using the same five-character hash method, and flags saved logins for breached sites where the password hasn't changed since. The NCSC notes antivirus and password manager tools often include these checks.

Google Password Checkup and Apple's leaked-password alerts

If you save passwords with Google, run Password Checkup (in Chrome's Google Password Manager, or at passwords.google.com). It flags passwords that are compromised, reused or weak. Google's security blog says Chrome sends a hashed, encrypted copy of your login and uses "private set intersection with blinding" to find matches without revealing your username or password.

On Apple devices, Password Monitoring does the same for saved passwords. Apple's Platform Security guide says the most commonly leaked passwords are checked on the device itself; for the rest, only a 15-bit prefix of a hash is shared in a cryptographic exchange with Apple.

These checks matter because breaches are constant. The ITRC counted a record 3,322 US data compromises in 2025, and the FTC says people reported losing about $16 billion to fraud that year.

Data breach: what to do, step by step

1. Change the leaked password, and every reuse of it

If a leaked password is one you still use anywhere, change it everywhere. The NCSC says to do it as soon as you can, and "don't panic". Attackers routinely try leaked email-and-password pairs on other sites (credential stuffing), so a reuse on your email or bank is the real danger. Start with email, then banking, then everything else.

Company says passwords were "hashed"? Change it anyway. The NCSC says attackers can still recover passwords from stolen hashes with brute-force guessing and pre-computed tables, especially when the hashing was poor. Short, common passwords fall first.

2. Switch to passkeys, or at least an authenticator app

A passkey replaces your password with a cryptographic key pair: the private half stays on your device and the site keeps only the public half. The FIDO Alliance, which developed the standard, says this removes shared secrets from the server, so a breach has no password to steal. In April 2026 the NCSC said passkeys should be the first choice for logging in, calling them "highly resistant to phishing attacks".

Where passkeys aren't offered, CISA ranks two-step options from strongest to weakest: security key, authenticator app with number matching, authenticator app codes, biometrics, and last, text or email codes.

3. Lock down your email account and phone number

Your inbox resets everything else. The NCSC lists signs of unauthorised access to look for: being unable to log in, security settings you didn't change, messages you don't recognise, and sign-ins from unusual places or times.

If your phone number leaked, ask your carrier for a PIN or a lock on SIM changes and number transfers. In late 2023 the US Federal Communications Commission (FCC) adopted rules requiring carriers to use secure authentication before a SIM change or port-out, notify customers, and offer a free account lock. If your phone suddenly loses service, call your carrier from another phone.

4. Freeze or flag your credit if ID details leaked

If a government ID number, passport or licence details leaked, stop new accounts being opened in your name. The tools differ by country (next section).

5. Bank and card steps

• Card numbers leaked: call the number on the back of the card and ask for a replacement.
• Bank details leaked: tell your bank, ask what protection it can add, and check statements for withdrawals you didn't make.
• Never move money to "protect" it. The FTC says some of the costliest scams start with a fake security alert from "your bank", and bank impersonators caused the highest losses among business impersonators in 2025.
• Lost money? Tell your bank first, then report it: in the US at ReportFraud.ftc.gov or IdentityTheft.gov; in the UK to Report Fraud, or Police Scotland on 101.

6. Treat every follow-up message as a scam until proven otherwise

Leaked details make phishing convincing, because the message can quote your real name, number or account ID. The NCSC lists typical lures after a breach: "resetting passwords", "receiving compensation" and "missed deliveries". Scammers may also phone you. In the UK, forward scam texts to 7726 and report emails to the NCSC's Suspicious Email Reporting Service.

7. Keep watching

Turn on HIBP's Notify Me. In the US, check your credit report from each bureau free once a week at AnnualCreditReport.com, the only site authorised to fill those orders. The FTC's warning signs: a bill that stops arriving (your billing address may have been changed), charges you didn't make, and accounts on your credit report you don't recognise.

Credit freeze after a data breach: US, UK, EU and Japan

United States: credit freeze, fraud alert and IRS IP PIN

• Credit freeze: free, and blocks new credit in your name. Contact each of Equifax, Experian and TransUnion. It lasts until you lift it; the Consumer Financial Protection Bureau (CFPB) says it doesn't affect your credit score, and a lift requested online or by phone must take effect within an hour.
• Fraud alert: free; contact one bureau and it must tell the other two. It lasts a year and can be renewed. Identity theft victims with an FTC or police report can get an extended alert that lasts seven years.
• Social Security number leaked: get an IRS Identity Protection PIN, a six-digit code, new each year, that stops anyone else filing a tax return with your SSN.
• Identity already misused: report it at IdentityTheft.gov for a personal recovery plan.

United Kingdom: Cifas Protective Registration

The UK tool for this is Cifas Protective Registration: £30 for two years. It flags your name in the National Fraud Database, so organisations that use it run extra checks on applications in your name. Cifas says it doesn't affect your credit score, isn't insurance, and doesn't cover payments on existing accounts. There's no expiry reminder, so note the date. Report losses to Report Fraud, which replaced Action Fraud in England, Wales and Northern Ireland (0300 123 2040), or to Police Scotland on 101.

European Union: use your GDPR rights

EU law doesn't give you a US-style credit freeze, and credit reporting is run country by country. Your strongest tools are GDPR rights. Ask the company, or its data protection officer, exactly which of your data was taken. If you're unhappy with the answer, the European Data Protection Board says you can complain to the data protection authority where you live, work, or where the infringement took place. Report fraud to your bank and the police.

Japan: 本人申告 (self-declaration) at the credit bureaus

Japan's closest equivalent is 本人申告 (honnin shinkoku), a self-declaration note on your credit file that lenders see when they check an application. The Japanese Bankers Association's credit center (PCIC) explicitly accepts declarations when ID document details were leaked; online filing uses a My Number Card and costs ¥500. PCIC says the note doesn't guarantee to stop misuse and isn't checked when someone opens a deposit account. CIC keeps declarations for five years, and JICC runs its own version, so file with each bureau. For technical help, such as a hijacked account or fake SMS, the IPA runs an information security consultation desk (情報セキュリティ安心相談窓口).

What can hackers do with your leaked data?

It depends on the data type, and combinations are worse than any single item. Tap a row for details.

What can hackers do with your email address?

On its own, an email address is a phishing target and half of a login. Paired with a password you reuse, it opens accounts. Expect emails that name the breached company and quote real details from the leak.

What can hackers do with your phone number?

Send scam texts and calls, and attempt a SIM swap. The FTC describes scammers calling your carrier, claiming your phone was lost, and getting your number moved to their SIM, so they receive your one-time login codes. That's why CISA ranks text codes last.

Birth date, address, bank details and ID numbers

A birth date never changes, so a leaked one stays useful for good; combined with your name, phone and address it helps someone pass basic identity checks. The FTC says thieves use details like your name, address and Social Security number to open accounts in your name, steal tax refunds and get jobs or medical care. Bank details make "your account is at risk" calls far more convincing. These are the leaks where freezes, IP PINs and 本人申告 earn their keep.

Real examples: what recent breaches teach

Sony So-net and Docomo plala (October 2026). In the Sony data breach, up to 2,585,481 member records left Sony's systems, including names, phone numbers, email addresses, user IDs and birth dates. Of those, 54,401 people had an email password exposed and 16 had bank details exposed. Sony reset the exposed passwords, told users to type its My Page address directly, and reported to the PPC. The lesson: most victims lost no password, but their name, phone and birth date are exactly what makes a follow-up scam feel genuine.

Binance (October 2026). The Binance hack wasn't a customer-data leak: roughly $6.3 billion was drained from Binance's own wallets, and Binance says it will cover customer losses. But it shows the second wave after any big incident, unsolicited "compensation" and "refund" messages. The advice fits every breach: ignore payout offers you didn't ask for and use only official channels.

Spot the post-breach phishing

Data breach FAQ

How do I check if my email was leaked in a data breach?

Search your address at Have I Been Pwned, which counts more than 17.8 billion pwned addresses. Then run your password manager's breach report, Google Password Checkup or Apple's security recommendations, which flag saved passwords found in leaks. Also read any notice from the company, reached through its official website rather than an email link.

Is Have I Been Pwned safe to use?

The UK's NCSC names it as a tool for checking breaches. HIBP says searches aren't logged and travel over an encrypted connection, and it doesn't store passwords alongside email addresses. Its password checker sends only the first five characters of a hash of your password, so the password itself stays private.

What should I do if my email is in a data breach?

Find out what leaked with it. If a password was included, change it there and anywhere you reused it, starting with your email account, and turn on a passkey or authenticator app. Then expect phishing that names the breached company, and contact that company only through its official website.

What can hackers do with my phone number?

Send scam texts and calls that look official, and try a SIM swap, convincing your carrier to move your number to their SIM so they get your one-time codes. Ask your carrier for a PIN or account lock, and move important accounts from text codes to an authenticator app or passkey.

Should I freeze my credit after a data breach?

If a Social Security number, ID document or other identity data leaked, yes. In the US a freeze is free at each of the three bureaus, doesn't affect your score, and can be lifted within an hour online. The UK uses Cifas Protective Registration and Japan uses 本人申告. If only an email address leaked, a freeze adds little.

How long should I watch for fraud after a data breach?

There's no safe cut-off. The NCSC warns scam messages can arrive well after a breach goes public, and leaked birth dates and ID numbers never change. A US fraud alert lasts a year and a freeze until you lift it, so keep breach alerts on and keep checking statements.

What should a company do after a data breach?

Notify the people affected and the regulator. In the EU, GDPR Article 34 requires telling people without undue delay when there's a high risk, in plain language, with the likely consequences. In Japan, businesses must report qualifying leaks to the PPC and notify those affected. A good notice names the exact data types exposed.

Cleus is an uncensored AI assistant: paste in a breach notice and it explains what the leaked data means for you, and searches the live web for the latest on that breach, with sources.

Sources

• FTC: What To Know About Credit Freezes and Fraud Alerts
• FTC: What To Know About Identity Theft
• FTC: Free Credit Reports
• FTC: People Reported Losing $3.5 Billion to Imposter Scams in 2025
• FTC: SIM Swap Scams
• FCC: Port-Out Fraud Targets Your Private Accounts
• CFPB: What is a credit freeze?
• IRS: Get an Identity Protection PIN
• CISA: Require Multifactor Authentication
• NCSC: Data breaches guidance
• NCSC: Passkeys are the future
• NCSC: Password administration
• FIDO Alliance: Passkeys
• Have I Been Pwned, FAQs, Pwned Passwords
• Google: Password Checkup help
• Google Security Blog: Password protections in Chrome
• Apple: Password Monitoring
• 1Password: Watchtower breach checks
• Cifas: Protective Registration
• City of London Police: Report Fraud goes live
• GDPR Article 34
• EDPB: FAQ
• PPC Japan: 漏えい等報告・本人通知の義務化
• PCIC: 本人申告
• CIC: 本人申告
• IPA: 情報セキュリティ安心相談窓口
• ITRC: 2025 Annual Data Breach Report
• Cleus: Sony data breach 2026
• Cleus: Binance hack explained