Data breach: what to do when it happens to you

You’re having a quiet dinner when breaking news comes on: a major company was hacked and the data of millions of customers was exposed. You’re one of their customers. Now what?

Data breaches are increasingly common and, unfortunately, the victim is often completely blameless — the company failed to protect their information. But what you do from that moment forward makes all the difference.

First: confirm whether you were affected

Before panicking, verify. The website haveibeenpwned.com (“Have I Been Pwned?”) maintains a database of known breaches. Just type in your email and it shows whether it appeared in any breach and what data was exposed.

Many companies also notify customers directly by email when an incident occurs. Keep an eye out for official communications, but be suspicious of any emails about the breach that look off — scammers take advantage of these situations to run phishing campaigns.

Change your passwords immediately

If the breach is confirmed, the first action is changing the password for the compromised account. But don’t stop there: if you were using the same password on other services — and many people do — change it on all of them too.

This is also the perfect moment to finally adopt a password manager and ensure every service has a unique, strong password.

Enable two-factor authentication

If you didn’t have 2FA enabled, enable it now. Even if the password was leaked, the second factor prevents a criminal from accessing your account without the additional code.

Keep an eye on your financial accounts

If your financial data, credit card numbers, or social security number were exposed, the risk of fraud is higher. Monitor your bank statements carefully for the next few months. Regularly check your credit report for unfamiliar debts or accounts opened in your name.

If you notice suspicious activity, contact your bank immediately and file a police report.

Your legal rights

In many countries, data protection laws require companies to notify both regulators and affected individuals when a breach occurs. You have the right to know which of your data was exposed and how the company is handling the incident.

If the company fails to take proper action or doesn’t inform you about the breach, you can file a complaint with the relevant data protection authority.

Stay calm and take action

Finding out your data was leaked is frustrating and scary, but it doesn’t have to be catastrophic. With the right steps taken quickly, you dramatically reduce the chances of real harm. The worst thing you can do is ignore the problem and take no action.