Key Takeaways
- Changing your password immediately on the affected account is the single most urgent first step.
- Reused passwords on other accounts must also be changed without delay.
- Enabling two-factor authentication greatly reduces the risk of further unauthorized access.
- Notifying your bank or credit card provider quickly can prevent fraudulent financial transactions.
- Placing a credit freeze is a free, powerful tool that limits new account fraud in your name.
- Official breach notifications from companies are legal obligations — watch for them and act on them.
Summary
18 items · 30–60 minutes
Why the First Hour Counts
When a data breach exposes your personal information — whether it's an email address, password, Social Security number, or payment card details — the window between exposure and harm can be surprisingly short. Attackers use automated tools to test stolen credentials across dozens of services within minutes. Fraudulent charges, account takeovers, and identity theft applications can all begin before you've finished reading the breach notification.
This checklist gives you a clear, prioritized sequence of actions to take in that critical first hour. You don't need to be technically sophisticated to follow it — you just need to move methodically. For context on how credentials end up compromised in the first place, see why strong passwords keep getting compromised.
Immediate Account Actions (First 10 Minutes)
Financial Protection (First 20 Minutes)
Assess and Verify the Breach (Next 15 Minutes)
Broader Security Sweep (Remaining Time)
Tools You'll Need Close at Hand
Before working through the steps, gather the resources below. Having them ready prevents you from losing momentum mid-process.
Password Manager
Generates and securely stores strong, unique passwords so you can update multiple accounts quickly without reusing credentials.
Authenticator App
Provides time-based one-time codes for two-factor authentication, which is more secure than SMS-based verification.
Have I Been Pwned (haveibeenpwned.com)
Lets you check whether your email address appears in publicly known data breach databases.
Credit Bureau Freeze Portals
Online portals for Equifax, Experian, and TransUnion allow you to place a credit freeze quickly and for free.
FTC IdentityTheft.gov
The Federal Trade Commission's official resource for filing identity theft reports and generating a personalized recovery plan.
After the First Hour: What Comes Next
Once you've completed the immediate steps, shift into a monitoring posture. Set calendar reminders to check your credit reports at regular intervals — in the US, you are entitled to free reports from the three major bureaus. If the breach involved your Social Security number or government-issued ID, consider filing an identity theft report with the Federal Trade Commission (FTC) at IdentityTheft.gov, which generates a personalized recovery plan.
Watch Out for Post-Breach Phishing Scams
After a high-profile breach, scammers frequently send fake emails or text messages impersonating the breached company, offering "urgent account assistance" or links to reset your password. Do not click links in unsolicited messages — go directly to the company's official website by typing the address into your browser. If you're unsure whether a communication is legitimate, contact the company through a phone number or address listed on their official site, not one provided in the suspicious message.
Keep a written log of every action you've taken and every organization you've contacted, including dates and reference numbers. This documentation matters if you later need to dispute fraudulent accounts or work with law enforcement.
Your longer-term security posture should also be reviewed. If you haven't audited your home network settings recently, home network security habits that actually matter outlines the changes worth making. And if you recently set up a new device, verify you didn't skip foundational security steps — setting up a new device safely covers what's most commonly overlooked. For help identifying whether an account has already been accessed without your knowledge, recognizing a compromised account before it causes real damage walks through the key warning signs.
Email Account Breaches Require Extra Urgency
If your primary email account is compromised, the stakes are especially high: email is used to reset passwords on virtually every other service you use. Treat an email account breach as a top-priority emergency. Secure it first, update its recovery options (backup email and phone number), and then work through all accounts linked to that address. Consider whether you need to notify anyone — including employers or financial institutions — that your email may have been used to send fraudulent messages.