Your Data Appeared in a Leak. Now What?

New York Times

18-07-2025

My personal information has been leaked in a data breach not once or twice or even thrice. By now I've lost count. I've learned about the breaches in letters offering me free credit monitoring, in apologetic emails from affected companies, and in news reports. You've probably been there, too.
The urge to shrug and do nothing is strong, but that approach is almost certain to cause you some future pain. Learn from my mistakes — someone once took over my Facebook account using stolen data because I recycled my passwords. (Tip: Don't do this.)
Data breaches are now an unfortunate fact of modern life, and there's not much you can do about preventing them. But that doesn't mean you can't protect yourself in the aftermath. Here's what to do.
Leaks and data breaches can take many forms — a hacker releases stolen records online, a company accidentally leaves a server available, the list goes on — but the result is that your personal information ends up somewhere it shouldn't.
Don't panic, but don't ignore it. The sad truth is, decades of data breaches and a thriving market for data brokers mean that an uncomfortable amount of your personal information is likely already out in the open.
'It doesn't worry me too much anymore, just simply because there's so much of that data out there anyway, and a new data breach doesn't particularly change that,' says Troy Hunt, the founder of HaveIBeenPwned, a site that lets you search data breaches to see if you've been affected. But some breaches, particularly those involving sensitive data such as passwords or other personal information, demand attention.
Here's what to do immediately after a data breach to protect yourself in the future:
Set up a password manager and enable two-factor authentication. Because attackers know that many people use the same password across multiple accounts, they'll attempt to use a password exposed on one website across others. Hunt says that due to password recycling, 'one data breach of a fairly benign service is suddenly a digital key to everything else.'
Even if your password wasn't exposed, take the breach as an opportunity to level up your online security. First, choose a password manager (our picks are 1Password and Bitwarden) and use it to create a new, unique password for the site that was breached. Then, take a minute to activate 2FA, if it's available, to keep attackers out even if they have your password. Two-factor authentication adds another layer of protection on top of your password, often in the form of a PIN, security key, or face scan (if you've ever been prompted to enter a texted code after entering your password, that's 2FA). Once you've done that, change the password on another site or two every day (or whenever you log in), and add it to your password manager. Eventually, you'll have unique and complex passwords protected with 2FA for all of your accounts, which will help protect you after future data breaches. I Tried, and Failed, to Disappear From the Internet
Go directly to the source to find more information about the breach. If you hear about a data breach from a letter, email, or news report, go to the affected company's website to get more information. Be sure to avoid links in emails or text messages, as these can sometimes be from opportunistic scammers.
Look for explanations of what information was exposed and what, if any, additional steps the company is taking to protect those affected. If you can't find any information on the website, try contacting the company by phone using a verified phone number. Many companies list their contact numbers on their official websites, so use that number instead of whatever pops up on Google.
Once you know what information was exposed, you can decide what to do about it. Assessing your risk is deeply personal, and how you react might depend on how much and what kind of information the company had on you, though some personal information is obviously sensitive.
If your account password, address, or Social Security number has been exposed, you need to take action. Another important piece of information that is often overlooked is your date of birth: 'You can never change it,' Hunt says. 'And unfortunately, we've got everything from [telecommunication companies] to banks regularly using that as an identity proof.'
Change your passwords. Companies sometimes require a password reset after a data breach, so you'll have to create a new password before you can log in. If the company doesn't require a reset, you can do it yourself in your account settings. If you can't log in to change your password, though, an attacker may have already taken control of your account; use the site's password-recovery tool and replace your old password with a strong new one. Store that new password in your password manager and then turn on 2FA. If that doesn't work, contact the company through a verified phone number listed on its site or another trusted source to regain control of your account.
Also change the password on any other site where you reused it. As we mentioned earlier, attackers know people's bad password habits and sometimes try confirmed passwords on multiple sites, hoping to get lucky.
Share this article with a friend.
Monitor your bank and credit card accounts. Log in to your financial accounts and look for fraudulent charges. Most bank accounts in the US are insured by the Federal Deposit Insurance Corporation for up to $250,000, so if you see incorrect charges, contact your bank to file a claim and get your money back. In the US, customers are not responsible for fraudulent credit card charges, either, so report any of those as well to get them removed from your account.
When contacting your bank, credit card company, or brokerage, be sure to do so through a verified phone number. Most banks and credit card issuers list a fraud-support phone number on the back of your debit or credit card.
Check and freeze your credit. Sometimes, scammers try to use your personal information to open new bank accounts or take out loans. You can check for this kind of fraudulent activity by examining your credit reports from the three major credit bureaus: Equifax, Experian, and TransUnion. The Federal Trade Commission recommends against contacting the credit bureaus individually and instead directs people to use AnnualCreditReport.com to request one free report from each credit bureau per year.
You can also request a credit freeze, which helps prevent new accounts or loans from being opened in your name. If you have children, the FTC recommends freezing their credit, as well; because youngsters are unlikely to be checking their own credit reports, fraud using the information of minors can go unnoticed for years. A credit freeze lasts until you choose to lift it, but keep in mind that it can't protect against all kinds of fraud.
The Federal Trade Commission offers resources for reporting identity theft and recovering your accounts if you're concerned that someone is using your Social Security number.
If the affected companies offer free credit monitoring or identity-theft support, use it. Many companies offer credit-monitoring services in the wake of a data breach. You should take advantage. However, all of them require you to activate such services, and you have to watch for notifications if these services find anything suspicious. Typically, you have a limited time during which you can activate the services, and they run for only a year or so.
File your taxes early. Tax scammers sometimes try to claim your US income tax refund by using stolen information to file a return before you do. If you were involved in a recent data breach, or if sensitive information such as your Social Security number was leaked, consider filing your taxes early to beat scammers to the punch.
You can also set up a PIN with the IRS to add an extra layer of protection to your taxes. This is a smart thing to do, even if your data hasn't been exposed.
Be on alert for scams purporting to help after a breach. Scammers sometimes send legitimate-looking emails or texts about data breaches that are actually links to phishing sites, which look like reputable sites but are actually designed to convince you to divulge your passwords or sensitive information. It's a cruel manipulation: exploiting your very anxiety about a security leak to steal your information.
To protect yourself, be skeptical of messages with links or demands for immediate, dramatic action. Before you follow any instructions from an email, a text message, or even a phone call, confirm that information by going to an official website or contacting support through a verified phone number.
Phishing sites have a short lifespan, and most browsers are good at blocking malicious sites. If your browser warns you to stay away, pay attention. Most password managers store a related URL along with your password and notify you when you visit a site with a saved password. If you're on a familiar-looking site but your password manager doesn't recognize it, double-check the URL to confirm that it isn't a cleverly designed look-alike. Your Phone Is Stolen. Your Laptop Gets Lost. Here's What to Do.