1. Confirm the notice
Visit the company’s official website or app directly. A message about a breach can itself be a phishing attempt. Check what information was affected and which action the company recommends; do not enter a password through an unexpected message.
2. Protect access
If a password was exposed, change it on that service and anywhere you reused it. Use a different strong password for each account, preferably stored in a password manager. Enable multifactor authentication where available and review active sessions and recovery contacts.
3. Match the response to the exposure
- Payment details: contact your bank or card provider through its official number or app. Review transactions and ask about replacement or restrictions.
- Identity information: watch for accounts or applications you did not make. In the U.S., consider a free credit freeze with the credit bureaus.
- Email, phone or address: expect more convincing messages. Verify requests for money, login codes or personal details independently.
4. Keep checking
Keep the breach notice and any correspondence. Review account activity and statements for unfamiliar changes. If your identity has been misused, IdentityTheft.gov offers a U.S. recovery plan. Outside the U.S., use your national consumer-protection or cybercrime reporting service.
Reduce what remains exposed
Once urgent access problems are contained, review the accounts you still need, remove unnecessary public details and consider requests to the companies holding your data.