Your password was exposed in a data breach. What to do

Whatever told you about it — a letter from the company, a warning from your browser, or your own address turning up on Have I Been Pwned — the practical meaning is the same.

That password is now public. Retire it everywhere.

Here is the whole first response, before any of the explanation:

1. Change the password on the breached account. Go to the site directly. Do not use a link from the notification.
2. Change it everywhere else you used it, including near-variations. Email first, because email resets everything else.
3. Turn on two-factor authentication, starting with email and anything financial.
4. Check the account for activity you do not recognise — sign-ins, purchases, changed settings, messages you did not send.

If only your password leaked, that is genuinely the end of it. If other things leaked too, the rest of this page is about those.

Why a hashed password is still an exposed password

Companies often say passwords were "hashed", and it is usually meant to be reassuring. It is worth understanding what it actually buys you.

Hashing scrambles a password one way. The stored file contains the scrambled result, not the password, and the process cannot be run backwards. So an attacker cannot simply read your password out of the file.

What they do instead is guess. They take likely passwords, hash each one, and look for a match. This runs offline on their own hardware, with no login page to slow it down and no lockout to trip.

OWASP's guidance is explicit about the consequence: fast algorithms such as SHA-256 are unsuitable for storing passwords "because they allow attackers to perform large numbers of guesses quickly". Slow, purpose-built algorithms — Argon2id, scrypt, bcrypt — exist to make each guess expensive.

Salting adds a unique random value to each password before hashing. It stops an attacker cracking every account at once with a precomputed table. It does not make an individual weak or reused password safe.

How you found out, and what each source means

The browser and manager checks are worth turning on if they are not already. Chrome compares your credentials against known breached data in encrypted form, and Google says it "never learns your usernames or passwords during this process". Microsoft Edge's Password Monitor works the same way and says "not even Microsoft knows" which of your passwords are compromised. On an iPhone, the Passwords app has a Security section listing weak, reused and leaked passwords, controlled by a Detect Compromised Passwords setting.

Have I Been Pwned's password check uses a model called k-anonymity. Only the first five characters of the password's hash leave your device. Roughly 800 possible matches come back, and your device compares them locally. The service never receives the password itself. It also will not tell you which of your passwords leaked, by design.

What else was exposed, and what each thing needs

This is the part that actually varies. Read the notice for the list of data types, then work down this table.

The FTC's own breakdown follows the same shape. For a leaked login it says to change the password, change the username if you can, and change it anywhere else you used it. For bank details it says to contact your bank to close the account and open a new one, and for a card, to cancel it and request a new one.

Freezes and fraud alerts, if identity data leaked

If a national identity number, or enough of your identity to open an account in your name, was exposed, this is the step that does real work.

A credit freeze stops new credit accounts being opened in your name — by anyone, including you, until you lift it. The FTC confirms it is free and that it does not affect your credit score. The Identity Theft Resource Center calls it "the most effective way to prevent unauthorized accounts from being opened in your name". You place one with each credit bureau separately.

A fraud alert is lighter. It tells businesses to check with you before opening an account. An initial alert lasts one year and is renewable, an extended alert lasts seven years, and you only need to contact one bureau — it must tell the other two.

Free credit monitoring offered by the breached company is worth taking, and the FTC says so directly. Understand what it is, though: it tells you after something has happened. A freeze prevents it.

In the UK, the ICO suggests checking bank statements and your credit report, reporting lost or stolen documents to whoever issued them, and applying to Cifas for protective registration.

Expect the phishing that follows

This is the most predictable consequence and the least anticipated one.

The NCSC warns to be alert to suspicious messages "which may be sent some time after the breach is made public", giving examples of official-sounding messages about resetting passwords, receiving compensation, scanning devices or missed deliveries. The ICO makes the same point: criminals use information from breaches to create phishing "that can be very difficult to spot".

The Identity Theft Resource Center surveyed people who had received a breach notice. It found 88% experienced at least one negative consequence. The most common was an increase in phishing or scam attempts, reported by 53.7%.

So a message that references the breach is not evidence it came from the breached company — it is the single most likely thing a criminal would write. The checks in how to identify phishing apply unchanged.

Why one breach reaches accounts that were not breached

The breached company is rarely where the damage lands.

Leaked email-and-password pairs are merged into large lists and fed into the login forms of hundreds of other services automatically. Nothing is guessed; the password is already correct somewhere. That attack is credential stuffing, and Verizon's 2025 research found it made up a median 19% of all daily authentication attempts.

It works entirely because of password reuse, and the same research found that in the median case only 49% of a person's passwords were distinct from each other.

Which is why the "change it everywhere you used it" step is not padding. It is the step that decides whether one company's failure becomes your problem.

What the rules say, on both sides

For you. NIST's current guidance requires services to screen new passwords against a blocklist that includes "Passwords obtained from previous breach corpuses", so a password known to be leaked should be refused when you try to set it. The same document says services must not force routine password changes on a schedule, but must force a change "if there is evidence that the authenticator has been compromised". A breach is that evidence.

For them. Under UK law an organisation must report a qualifying breach to the ICO within 72 hours of becoming aware of it, where feasible, and must tell affected individuals "without undue delay" where the breach is likely to result in a high risk to their rights and freedoms. The notice must describe what happened, the likely consequences, and what is being done. You can complain to the organisation, which then has 30 days to acknowledge it.

When you are finished

Work down this list and stop worrying about it.

• The breached password is changed, and is not in use anywhere else
• Every account that shared it has a new, unique password
• Email has its own strong password and a second factor
• Two-factor authentication is on for anything financial
• No unfamiliar sign-ins, devices, forwarding rules or recovery addresses
• A credit freeze is in place, if identity data was exposed
• Your password manager reports zero reused and zero breached passwords

That last line is the goal, and it changes what a breach means to you. Breaches will keep happening and are outside your control. Uniqueness is what turns the next notification into an item of mild interest rather than an evening's work.

Where passkeys are offered, take them — there is no shared secret in the service's database to leak in the first place.