What to Do After a Data Breach Email From a Company

An email lands from a shop, a gym or a streaming service you used three years ago, saying your details were exposed in a data breach. It is vague, it is apologetic, and it does not tell you what to do next. Most people either panic and change every password they own, or shrug and delete it.

Neither reaction is right. A data breach notice deserves about 30 minutes of focused work, done in a specific order. Here is what to do, what to skip, and how to tell a genuine notice from a fake one.

First, check the data breach email is real

Breach notices are a favourite disguise for phishing. A fake one will usually push you to click a link and "verify your account" or "claim compensation". A genuine notice tells you what happened and what the company is doing, and it rarely needs you to log in through the email itself.

Do not click anything in the message. Instead:

Open a new browser tab and type the company's address yourself.
Look for a news or security page that mentions the incident. Large breaches are often reported by the press within a day or two.
Check the sender address character by character. A single swapped letter is a common trick.

If anything feels off, treat it as phishing. Our guide on how to spot a phishing email before you click anything covers the details worth checking.

Work out what was actually exposed

A breach notice should list the types of data involved. That list decides how worried you should be and what to do next.

Data exposed	Real risk	What to do
Email address only	More spam and phishing	Be extra careful with emails for a few months
Email and hashed password	Password may be cracked if weak	Change it there and anywhere it was reused
Plain text password	High, attackers can log in now	Change it immediately everywhere it was used
Phone number	Scam texts and calls, SIM swap attempts	Add a PIN with your mobile carrier
Home address and date of birth	Identity fraud and targeted scams	Watch post and bank statements closely
Partial card number	Low on its own	Check statements, no need to cancel
Full card number and expiry	Fraudulent payments	Ask the bank for a new card

"Hashed" means the password was scrambled before storage. A long, unique password stays safe for a long time even if stolen in hashed form. A short one like "Summer2021" can be cracked in minutes.

Change the right passwords in the right order

Start with the breached account. Log in by typing the address yourself and change the password to something long and unique. If you no longer use the account, change the password anyway, then look for a "delete account" option in the settings.

Next, think about where else you used that password or something close to it. Attackers take leaked email and password pairs and try them on email providers, banks and shopping sites within hours. This is called credential stuffing, and it is the real damage most breaches cause.

Change passwords in this order:

Your main email account. Whoever controls your email can reset almost everything else.
Banking and payment apps. Anything that can move money.
Accounts with saved cards. Large shopping sites and food delivery apps.
Social media. Hijacked accounts are used to scam your friends.

If that list made you realise you reuse a handful of passwords everywhere, now is the moment to fix it. Setting up a password manager without losing access takes about an hour and makes the next breach notice a two minute job.

Turn on two-factor authentication while you are there

While you are in each account's security settings, switch on two-factor authentication. Use an authenticator app or a passkey rather than text messages where possible. With 2FA turned on, a leaked password alone is no longer enough for someone to log in.

Why changing every password at once is the wrong move

A common reaction to a data breach is to sit down and change all 80 passwords in one evening. It sounds thorough. In practice it is one of the fastest ways to lock yourself out of things.

People doing mass resets in a hurry tend to pick weaker, more memorable passwords, forget which ones they changed, and skip recovery options. A week later, they cannot get into an account they need, and the recovery email goes to an address they abandoned years ago.

The better approach is targeted. Change the breached account and any accounts sharing that password today. Then work through the rest gradually, a few each day, as part of moving them into a password manager. The risk from a single breach is concentrated where the password was reused, not spread evenly across every login you have.

Watch for the follow-up scams

The breach itself is often less dangerous than what comes after. Criminals know who was affected and use that to make scams believable. Over the next three to six months, watch for:

Emails or texts that mention the breach and offer a refund or "protection service".
Phone calls from someone claiming to be the company's security team, asking you to confirm details.
Delivery texts that use your real name and address.
Small test charges of 1 or 2 on your card, which often come before larger fraud.

A genuine company will not call you to ask for a full password, a card PIN or a one-time code. If someone does, hang up and call the number printed on the company's website or on the back of your card.

How to check if you were in a breach you were not told about

Not every company sends a notice, and some send them months late. Free breach lookup services let you enter your email address and see which known breaches it appeared in. Many password managers now include this check and warn you when a saved password shows up in a leak.

Run a check once, fix anything flagged, and then turn on alerts so you hear about new breaches automatically. That single habit replaces a lot of anxious guessing.

Frequently asked questions

Should I cancel my bank card after a data breach?

Only if the notice says the full card number and expiry date were exposed. A partial card number or the last four digits alone are not enough for fraud. Either way, check your statements for small unfamiliar charges for the next few months.

Can I sue a company for leaking my data?

In some countries you can claim compensation, usually through a group action rather than on your own. Be very cautious of emails offering to start a claim for you, as these are often scams. Search for official guidance from your national data protection authority instead.

How long after a data breach should I stay alert?

Stay extra careful for at least six months. Leaked data is often sold and reused long after the original breach, and targeted scams can appear a year later. Keeping 2FA turned on and using unique passwords protects you no matter when the attempt comes.