Found on Have I Been Pwned — What To Do

Work through this prioritized checklist to secure your accounts and reduce risk after a data breach.

This checklist runs entirely in your browser. No data is sent anywhere.

1) Confirm what was exposed

Note the breached service and the breach date, not the date you discovered it.

Check which data types were leaked, for example email, password hashes, names, addresses, phone numbers, DOB, MFA info.

List any other accounts where you reused the same or similar password.

Password reuse is the number one risk. Attackers try the same credentials on many sites.

Change the password immediately. Use a unique, long passphrase that you have never used elsewhere.

Turn on multi-factor authentication. Prefer an authenticator app or hardware security key over SMS.

Sign out of all other sessions and browsers from the account’s security page.

Revoke application passwords, API keys, and third-party app access that you no longer need.

Review recovery email, phone, and security questions. Remove outdated options and set answers that are not guessable.

Adopt a password manager and store a unique password for every account.

Identify other accounts that reused the same password and change those next, starting with email, banking, payroll, and social media.

Consider using email aliases or plus-addressing for future signups to identify which service leaked your address.

Enable MFA on your main email and set a unique passphrase.

Check for unauthorized forwarding rules and inbox filters that auto-delete or forward messages.

Review connected apps and OAuth tokens. Remove anything you do not recognize.

Be skeptical of urgent messages about account recovery or payment issues. Navigate to sites manually rather than using links.

Turn on security alerts for logins, password changes, and new devices where available.

Watch bank and card statements. Set up transaction alerts through your bank.

Subscribe to breach notifications from Have I Been Pwned for ongoing monitoring.

Place a fraud alert with a credit bureau if you suspect identity abuse.

Consider a credit freeze to stop new credit being opened in your name. Unfreeze temporarily when needed.

Check your country’s consumer protection site for local equivalents if you are outside the United States.

Update your devices and browsers, then reboot to apply patches.

Run a reputable malware scan if you suspect compromise.

Ask your mobile carrier about a SIM-swap lock or account PIN.

If this involves a work account, notify your employer or security team and follow internal policy.

If government ID numbers were exposed, check your government’s guidance for added protections and monitoring.

If a child’s account is affected, change credentials, enable MFA, and monitor for identity misuse.

Keep passwords unique everywhere and let your manager suggest strong ones.

Consider hardware security keys for important accounts such as email, banking, domain registrars, and cloud consoles.

Store MFA backup codes securely and keep an up-to-date account recovery plan.

Legal Disclaimer and Important Notice:

Open Have I Been Pwned Print