The email rarely shouts. It says something like "we're writing to let you know about an incident that may have affected your personal information," then buries the useful part — which data, how much, when it happened — under three paragraphs of apology. You read it twice, feel a small drop in your stomach, and start wondering whether you should be doing something right now.
You should. Not everything, and not all at once, but the first hour matters. You cannot un-leak a database, and nobody expects you to. What you can do is make the stolen data a lot harder to turn into money, an loan in your name, or a locked account you can't get back into.
First, Work Out What Actually Leaked
The way you respond depends far more on the type of data than on the size of the breach. A newsletter list containing your email address is annoying. Your passport scan, card number and password reuse habits are a different problem entirely.
Read the notification again and look for the categories. If the company is vague, check your own records: which card did you have on file, did you upload a document during verification, was the password one you've used elsewhere. Write down three things: what leaked, which company, and the date you found out.
- Passwords or email access — highest urgency, because email is the reset key to almost everything else.
- Card or bank details — urgent, but usually contained with a phone call.
- ID documents — passport, driving licence, national ID, tax number. Slower to exploit, harder to fix.
The goal in the first hour isn't to undo the breach. It's to make what was taken useless to whoever has it.
Leaked Passwords: Change the Account, Then the Pattern
Do this from a device you trust, and do not use the link in the breach email. Open a new tab and type the site's address yourself. Breach notifications are one of the most copied phishing templates going.
- Change the password for the affected account, then sign out of all other sessions from the security settings.
- Revoke third-party apps and connected services you don't recognise — old calendar tools, fitness apps, anything with access to your mail or files.
- Change the same password anywhere you reused it. Your primary email address comes first.
- Turn on two-factor authentication, ideally with an authenticator app or a hardware key. Codes by text message are weaker, but far better than nothing.
- Move your remaining passwords into a password manager and let it generate new ones as you go. You don't have to do all of them tonight.
Why email comes first
If someone has your email password, they can request a reset for your bank, your shopping accounts and your cloud storage, and intercept every confirmation message. A few minutes spent locking down that inbox protects everything downstream.
Leaked Bank or Card Details: Contain It in Minutes
Call the number printed on the back of your card or open your bank's app. Do not use a phone number from an email, a text or a search result — look it up independently.
Ask them to freeze or block the card, and request a replacement if the card number itself was exposed. Then switch on transaction alerts so every charge pings your phone. Read your last few statements line by line; fraud often starts with a small test charge to see whether anyone is watching.
Two things worth remembering. First, how much you're liable for often depends on how quickly you report — so make the call today, not next week. Second, no genuine bank employee will ever ask for your full PIN or a one-time code over the phone. Anyone who does, including someone who says they're from the fraud team, is a criminal.
If money has already gone, ask for the fraud or disputes team, not general customer service, and get a reference number before you hang up.
Leaked ID Documents: Passport, Licence, National ID
A stolen passport number or licence scan can be used to open accounts, rent property or pass verification checks. Start by reporting it to the authority that issued it — a passport office, a licensing agency, a tax authority — and ask whether a replacement invalidates the old document number. It usually does, which helps you.
Then limit how easily new credit gets opened in your name. In the United States you can place a free security freeze on your credit files with the three major credit bureaus; the UK and several other countries run protective registration or fraud alert schemes. Check what your country offers before you assume there's nothing you can do. Where money or legal exposure is involved, a consumer advice service, your bank's fraud team or a lawyer can tell you what you're entitled to.
Finally, check the boring places: tax filings, benefits claims, and your post. Identity thieves often go quiet for months and then file a return in your name.
Report It and Keep a Record
Screenshots and reference numbers are the difference between a fraud claim that gets resolved and one that drags on for months. Save the breach notification; don't delete it because it's upsetting.
- The company that was breached — they may need to know what's being used and how.
- Your bank or card issuer, for every affected account.
- Your national fraud or cybercrime reporting service — the FTC's identity theft service in the US, Action Fraud and the National Cyber Security Centre in the UK, or your local equivalent.
- The police, if money has actually been stolen. A report number helps with disputes.
Keep a simple timeline: when you found out, who you spoke to, what they said, what you changed. Five lines in a notes app is enough.
What Not to Do
- Don't click links in the breach email, even if it looks perfect.
- Don't pay anyone who calls you offering to "fix" the breach. Real recovery help doesn't arrive as a cold call.
- Don't reuse the new password anywhere else.
- Don't announce the details on social media — that's more material for whoever is targeting you.
- Don't wait for the weekend. Fraud teams are easier to reach on a weekday morning.
After the First Hour: What to Watch For
Put three reminders in your calendar: one in a month, one in three months, one in a year. Check your statements and credit report at each. Expect follow-up phishing that references the breach by name and looks more convincing than the original — that's how stolen lists get turned into stolen accounts.
Tell anyone who shares your finances, too. If it's a joint account, your partner's card is frozen along with yours, and a heads-up saves a confused phone call at a checkout.
Then let it go a little. You've changed what needed changing, frozen what could be frozen, and reported what should be reported. Most people who act quickly hear nothing more about it. The ones who get hurt are usually the ones who assumed somebody else was handling it.
Photo: JESHOOTS-com / Pixabay
