Your Email Was in a Data Breach. Here's Exactly What to Do.

Getting a breach notification email is alarming. Your instinct is probably to change your password and hope for the best. That's a start, but it's not enough — and the next 48 hours are more important than most people realize.

First: Understand what was actually exposed

Not all breaches are equal. A breach that exposed your email address and username is very different from one that exposed your password, home address, financial information, or social security number. Every breach notification should tell you what data was compromised — read it carefully before doing anything else.

If your password was exposed

Change it immediately — not just on the breached site, but on every other site where you use the same password or a similar one. Password reuse is how one breach becomes five. Use a password manager to generate and store unique passwords for every site. If you don't have one, 1Password, Bitwarden, and Dashlane are all solid options.

Enable two-factor authentication on every account that supports it, especially email, banking, and social media. SMS-based 2FA is better than nothing, but an authenticator app (Google Authenticator, Authy) is significantly more secure.

If your email address was exposed

Your email address alone enables phishing attacks. In the weeks after a breach, expect an increase in suspicious emails — offers that seem too good, password reset requests you didn't initiate, urgent messages claiming to be from your bank or a service you use. Be more skeptical than usual. When in doubt, go directly to the website rather than clicking links in emails.

If your financial information was exposed

Contact your bank or credit card company immediately. Request new card numbers. Place a fraud alert with the three major credit bureaus (Equifax, Experian, TransUnion) — this is free and requires creditors to verify your identity before opening new accounts. If the breach included your social security number, consider a credit freeze, which is more restrictive but provides stronger protection.

If your home address or phone number was exposed

This data feeds directly into data broker databases. Within weeks of a breach, your address and phone number can appear on people-search sites even if they weren't there before. This is the time to proactively audit and remove your information from broker sites before it spreads further.