What to do after a data breach: a 2026 response checklist
IBM's 2026 Cost of a Data Breach report puts the average time from breach to victim notification at 73 days. By the time that email hits your inbox, attackers have had more than two months to use your credentials. This guide covers exactly what to do, in order, once you know your data was exposed.
What is a data breach? A data breach is an incident in which personal data held by an organisation, including email addresses, passwords, payment details, or government ID numbers, is accessed, copied, or exposed without authorisation. The exposed data often appears on criminal marketplaces or dark web forums within hours of the breach occurring.
The first 30 minutes
Do not ignore a breach notification. Do not wait until the weekend. Credential abuse is automated: within hours of a breach going live on criminal forums, bots test the leaked email/password combinations across thousands of sites. The window for stopping account takeover is short.
These are the actions to take first, in this order:
- Confirm the notification is legitimate. Phishing emails impersonating breach notifications are common. Do not click any links in the email. Go directly to the company's official site (type the URL yourself or use a bookmark) and check your account settings or the company's security blog for breach confirmation.
- Check HaveIBeenPwned. Go to haveibeenpwned.com and enter your email address. This shows every known breach your address appears in, not just the one you were notified about. An email that has been in a breach is not a one-breach email. Most active addresses appear in three to twelve separate incidents.
- Write down what data was exposed. The breach notification will list the data types involved: passwords, email, phone number, home address, credit card numbers, social security or national insurance numbers. The response steps differ depending on which categories are confirmed.
Change the affected password immediately
If a password was exposed, it must be replaced on the breached site and on every other site where you used the same password. That second part is where most people stop short.
According to NCSC research published in 2025, 55% of surveyed users reuse at least one password across five or more accounts. A single breach becomes a skeleton key if the same credential works elsewhere.
What the new password needs:
- At least 16 characters
- No connection to the breached site or your personal details
- Not used on any other account, including variations like
MyBank2026!vsMyBank2025!
A password manager makes this feasible. Generating a unique 20-character random credential for every account takes seconds, and storing it requires no memory. NordPass checks your stored passwords against known breach databases automatically, flagging reused or compromised credentials without you having to run the check yourself.
Use this site's password generator to produce replacement credentials directly.
Enable multi-factor authentication on the affected account
A changed password improves your position, but an attacker who still holds your email/password combination will try it again if you ever use a similar credential elsewhere. MFA means a stolen password alone is not enough to get in.
Preference order for MFA methods, from strongest to weakest:
- Hardware security key (FIDO2): phishing-resistant by protocol design. Cannot be intercepted by a real-time relay attack.
- Authenticator app (TOTP): Google Authenticator, Aegis, Authy. Time-based codes generated locally. Better than SMS.
- Push notification: Approves logins via a phone app. Vulnerable to MFA fatigue attacks (repeated approval prompts at odd hours). Acceptable but not ideal.
- SMS code: Better than no MFA. Vulnerable to SIM-swap attacks. NIST SP 800-63B deprecates SMS as a standalone authentication factor for high-value transactions.
Enable MFA on the breached site first, then on every other account that still relies solely on a password: at minimum your primary email, password manager, bank, and cloud storage.
Set up dark web monitoring
A data breach is not necessarily a single event. Credentials sold on criminal forums are traded, resold, and combined with other breach datasets for months or years. Without ongoing monitoring, you have no visibility into when your data surfaces in a new context.
Dark web monitoring services scan criminal marketplaces, paste sites, and known breach databases for your email addresses and alert you when they appear. NordPass Premium includes breach monitoring as part of its password management subscription, which means alerts are delivered in the same interface you use for credential management.
Free alternatives include the HaveIBeenPwned notification service (email alerts for future breaches only) and Firefox Monitor. For broader coverage, including phone numbers and physical address monitoring, a paid identity monitoring service provides more complete detection.
Financial account actions
If the breach included payment card numbers, bank account details, or your social security/national insurance number, the response steps go beyond password changes.
Payment card numbers
- Call your bank's fraud line immediately. Request a card reissue with a new number. You do not need to wait for fraudulent charges to appear.
- Set up transaction alerts if you do not already have them. Most banks allow SMS or push notification for every transaction over a configurable amount.
- Check your recent statement for small test transactions. Fraudsters often run a micro-charge (under $1) to validate a card before using it for larger purchases.
Social security / national insurance number
In the US, a compromised SSN warrants placing a credit freeze with all three bureaus: Equifax, Experian, and TransUnion. A freeze blocks new credit applications in your name. It is free, does not affect your credit score, and can be lifted temporarily when you apply for credit legitimately.
In the UK, flag the exposure to Action Fraud (0300 123 2040) and consider a protective registration with CIFAS, the UK's fraud prevention service.
Bank account details
Contact your bank directly. Depending on the data exposed, they may recommend changing your online banking credentials, adding a voice or PIN confirmation requirement for outbound transfers, or issuing a new account number in severe cases.
Complete response checklist
Use this table as a working checklist. Tick each item once confirmed complete.
| Priority | Action | Applies when |
|---|---|---|
| 1 | Confirm the notification is genuine via the company's official site | Always |
| 2 | Check HaveIBeenPwned for other known breach exposure | Always |
| 3 | Change the password on the breached site | Password was exposed |
| 4 | Identify and change that password everywhere it was reused | Password was exposed |
| 5 | Enable or upgrade MFA on the breached account | Always |
| 6 | Enable MFA on email, password manager, and bank if not already set | Always |
| 7 | Request card reissue from your bank | Payment card number exposed |
| 8 | Place a credit freeze at all three bureaus | SSN/NIN exposed |
| 9 | Set up dark web monitoring for ongoing alerts | Always, ongoing |
| 10 | Review active sessions and revoke unknown devices in account settings | Always |
Long-term credential hygiene
A breach response is not just about the incident that triggered it. The underlying vulnerability, reused passwords across accounts without MFA, is the condition that makes any single breach dangerous.
CISA's 2026 guidance on credential hygiene identifies three practices as the most effective controls at the individual level:
- A unique password for every account, managed with a password manager
- MFA on every account that supports it, starting with email and financial services
- Periodic breach checks to detect exposure before attackers exploit it
The order of these matters. A password manager makes unique passwords practical. MFA makes a stolen password insufficient. Breach monitoring gives you lead time to respond before a dormant credential is weaponised.
On the question of how long to stay alert after a breach: the IBM 2026 data shows that 30% of identity fraud cases traced to a breach occur more than six months after the incident date. A notification in October does not mean the risk expires in November. A compromised email address remains a valid target for credential stuffing until every account that shared that password has been updated.
The 72-hour principle: According to CISA's incident response guidance, the first 72 hours after a confirmed credential breach are when the highest-value actions have the most impact. Immediate password rotation on the affected account and its reuse targets, combined with MFA activation, eliminates the most likely attack paths before automated exploitation scales up. Everything after 72 hours is important but less urgent.
Frequently asked questions
Do I need to do anything if only my email address was exposed, not my password?
Yes. An exposed email address enables targeted phishing. Attackers who know your email was associated with a specific service can craft convincing impersonation emails referencing that service. Be more sceptical of emails from that company's domain for the next several months, and verify any password reset or security alert requests by navigating to the site directly.
Should I close the account on the breached site?
Closing the account does not remove the already-exposed data from criminal databases. It also eliminates your ability to monitor the account for unauthorised activity. For most services, changing the password, enabling MFA, and continuing to monitor is a better approach than closing. The exception is a service you no longer use, where account deletion genuinely reduces your surface area.
How do I know if a breach notification is a phishing email?
Legitimate breach notifications typically: come from an official company domain, do not ask you to click a link to "verify your account", and direct you to check settings in the app or website you already use. Phishing impersonations often include urgent language, suspicious sender domains, or links to look-alike sites. When in doubt, navigate to the company's site manually and look for a security notice in your account dashboard or on their blog.
Does changing my password after a breach guarantee safety?
It closes the most immediate threat. If the breached service stored passwords in plain text (rather than as salted hashes), a change cuts off direct access. But changing only the breached account while leaving identical passwords active elsewhere leaves the majority of your exposure intact. Full protection requires rotating every reuse of that credential.