Your Data Was Breached. Now What? (An Honest Timeline)

Getting a breach notification email is jarring. The instinct is panic or denial. Here's the actual response sequence, organized by what matters most.

In the First Hour

Change the password for the breached account immediately. Don't wait to gather more information — do this first.

Then: find every other account where you used the same or similar password and change those too. This is the cascade prevention step. If you use a password manager, this is where its value becomes clear — you can audit in minutes.

Enable two-factor authentication on the breached account and any others where it isn't already active.

In the First Day

Check what was actually exposed. The breach notification email or the company's breach disclosure (usually on their blog or a dedicated breach information page) will tell you what data types were included. Common exposures: email addresses, hashed passwords, names, phone numbers, billing addresses. Less common but more serious: credit card numbers (usually only partial last 4 digits are stored), SSNs, date of birth.

If financial information was exposed: check your recent transactions on affected accounts, contact the financial institution if you see anything suspicious, and consider setting up fraud alerts with credit bureaus.

If SSN or Financial Data Was Exposed

Place a credit freeze with all three major credit bureaus (Equifax, Experian, TransUnion) — it's free and prevents anyone from opening new credit accounts in your name. This is the most effective identity theft prevention measure available, and it costs nothing. You can temporarily lift the freeze when you want to apply for new credit.

File an identity theft report at IdentityTheft.gov (FTC) if you discover actual fraudulent activity. This creates an official record that's useful when disputing fraudulent accounts.

The Long Tail

Stay alert for phishing attempts referencing the breach. Attackers sometimes send targeted phishing emails to breach victims, pretending to be from the company: 'We need you to verify your account following the recent security incident.' Legitimate companies will not ask for your password by email.

The Real Prevention: Before the Next Breach

• Unique passwords for every account. One breach can't cascade.
• Use a password manager. HaveIBeenPwned breach monitoring built into most major managers.
• Enable 2FA on email and banking — the highest-value targets.
• Sign up for HaveIBeenPwned notifications at haveibeenpwned.com.
• Don't use real answers for security questions — a breached site often has your mother's maiden name from a previous breach. Use random nonsense and store it in your password manager.