What to Do After a Password Breach: A Simple Checklist

If a service reports a breach or you suspect someone accessed an account, act quickly and calmly. The key risk is password reuse: attackers often try an exposed password on other websites.

Immediate steps

1. Change the password on the affected account.
2. If you reused it anywhere, change those accounts too—start with your email account.
3. Generate new, unique passwords with the Strong Password Generator.
4. Enable MFA or a passkey where available.
5. Review account recovery email addresses, phone numbers, active sessions, and recent activity.

Secure the most important account first

Email is often the recovery route for other services. Use a unique password and MFA for your primary email account before working through lower-priority accounts.

Avoid common mistakes

Do not simply add a number or symbol to the old password. Do not reuse the replacement password. Save new passwords in a trusted password manager so each account can have a different one.

FAQ

Do I need to change every password?

Change the breached password immediately and any account where you used the same or a very similar password. Unique passwords limit how far a breach can spread.

Is MFA enough if my password was exposed?

MFA adds protection, but you should still replace an exposed password and review the account for unauthorized activity.