← Breach Safety · // RESPONSE PLAYBOOK

What to do after a data breach

Speed matters — but order matters more. Do these steps in sequence so attackers don’t keep a foothold while you scramble.

1. 1. Lock down the breached account

   Change that account’s password now. Review active sessions / devices and sign out anything you don’t recognize. Update recovery email and phone if they look wrong.

2. 2. Turn on strong 2FA

   Prefer authenticator apps or passkeys over SMS when possible. SMS is better than nothing, but SIM-swap risk is real.

3. 3. Hunt password reuse

   If that password (or a close variant) was used elsewhere — email, banking, social, work VPN — rotate those immediately. Reuse is how one leak becomes account takeover across your life.

4. 4. Expect phishing

   Breach headlines trigger fake “reset your password” and “verify your identity” emails. Go to sites by typing the URL or using a bookmark — never from a panicked email link.

5. 5. Protect money and identity

   Enable bank transaction alerts. Check credit / identity monitoring if government ID or financial data may have leaked. Watch for new loans or SIM changes.

6. 6. Clean the long tail

   Revoke third-party app access, check email filters/forwarding rules, and rotate API keys or app passwords if you use them.