Your Data Was Leaked: What to Do in the First 48 Hours

When a data breach exposes your account, the urgent work is narrow: change the leaked password everywhere you used it, secure your email first, and expect phishing that uses whatever else leaked. Everything else (2FA, monitoring, credit freezes) matters, but it can wait until those are done. The order matters because automated credential stuffing usually starts long before most people read the notification.

What to do after a data breach, in order

1. Read what actually leaked. The notification, or the breach entry on Have I Been Pwned, lists the data classes: email addresses, password hashes, plaintext passwords, phone numbers, addresses, payment details. The table below maps each one to the action it needs.
2. Change the breached site's password, then every site where you used the same or a similar password. Email accounts go first, because whoever controls your inbox can reset everything else.
3. On your email account, sign out all other sessions and check the forwarding rules and recovery address. A forwarding rule quietly added by an attacker survives a password change.
4. Turn on 2FA on email, banking and your password manager, using passkeys where a service supports them.
5. Treat any message that quotes your leaked details (order numbers, your address, your phone) as suspicious for the next few months.
6. Set up monitoring so the next breach reaches you before it reaches the bots.

The second step is where most of the damage is prevented. If the password you used on the breached site was unique, the breach costs you one password change. If you reused it, every account that shares it is now one script away.

When the "breach" is a stealer log

Some of the largest entries on Have I Been Pwned aren't company breaches at all. Since February 2025 the service has loaded stealer logs: records collected by infostealer malware on infected computers. The Synthient set, added on 21 October 2025, holds 183 million unique email addresses, and each entry ties an address to the website where the password was typed and to the password itself.

An entry like that changes the order of the steps above. The password wasn't taken from a company's database; it was captured on a device you, or someone using your account, logged in from. Changing it from the same machine just hands the new password to the same malware. So:

1. Find and clean the infected device first: a full antivirus scan, removal of pirated software and unknown browser extensions, or a reinstall if you can't be sure.
2. Change the passwords from a clean device, starting with the site named in the entry and your email.
3. Sign out of every session on those accounts. Stealers also copy session cookies, and a valid cookie skips both the password and 2FA.

The same malware is why browser vaults get emptied, which I cover in are browser password managers safe.

How fast a leaked password hash falls

A breached service usually stores hashes, not passwords, and the hash function decides how long yours lasts once the dump is offline. For a random 8-character password using all 95 printable characters, trying the whole keyspace on one RTX 4090 (hashcat 6.2.6 benchmarks):

Those times are for random passwords. A password you made up yourself skips the brute-force math entirely: attackers run wordlists of billions of previously leaked passwords plus mutation rules first, and Summer2024! or a pet's name with a birth year falls in minutes regardless of the hash. Salting doesn't change the speed per guess. It only stops the attacker from cracking every user's identical password at once, so a fast hash with a salt is still a fast hash.

You rarely know which of these rows the breached company used. Assume the worst case and change the password even if the notice says it was "encrypted". More on the numbers behind this table in how long it takes to crack a password.

Credential stuffing is what actually hits you

Cracking is optional for the attacker. The usual first use of a breach dump is credential stuffing: a bot takes every email and password pair and tries them on mail providers, shops, streaming services and banks, routing requests through residential proxies so no single IP looks unusual. Each attempt is a real login with a real password, so it doesn't look like guessing, and it succeeds on the first try wherever the password was reused.

That's also why a "strong" password offers no protection here. A 20-character password reused on two sites is exactly as exposed as 123456 once one of those sites leaks it in plain text.

Finding your reused passwords is easier with a password manager than from memory. I use Psono together with the browser's built-in manager. Chrome's Password Checkup and the Passwords app on Apple devices both flag passwords that are reused or appear in known breaches. Without a manager, search your inbox for "welcome" and "verify your email" to rebuild the list of accounts you've opened.

Replace passwords with generated ones

For every password you replace, use a generator, not a variation of the old one. MyDog2019! becoming MyDog2024! is the first mutation a rule file tries. The Password Generator runs entirely in your browser and draws characters from the Web Crypto API, so the new password isn't sent anywhere. I'd use 16 to 20 random characters for anything stored in a manager, since you never type it.

The one password you do type, the manager's master password, works better as a passphrase: six random words from the EFF list give about 77.5 bits, which is beyond offline cracking and still typeable. If you want to check a password you already have, the Password Strength Checker does the math locally; just remember that a password that appeared in a breach is burned no matter what its score says.

Second factor: passkeys first, SMS last

A second factor makes a leaked password useless on its own, but the methods aren't equal:

• Passkeys (WebAuthn/FIDO2) are bound to the real site's domain, so a phishing page can't capture anything reusable. Use them where offered, starting with email and your password manager. The Passkey Checker tells you whether your browser and device support them.
• Authenticator apps (TOTP) keep codes off the phone network, which defeats SIM swapping. They are not phishing-resistant, though: a fake login page can ask for the 6-digit code and replay it within the 30-second window.
• SMS codes are the weakest option, exposed to SIM swapping and to the same real-time phishing. Still far better than nothing.

The trade-offs are covered in more depth in 2FA vs MFA.

When personal data leaked too

If the breach included your name, address, date of birth or government ID numbers, the risk shifts from account takeover to fraud in your name. In the United States, freezing your credit at Equifax, Experian and TransUnion has been free since September 2018, and it stops new credit lines from being opened until you lift it. Elsewhere, the closest equivalent is telling your bank and watching statements more closely.

Expect the leaked details to show up in phishing. A message that knows your real order number or delivery address is more convincing, not more trustworthy. Contact the company through its app or a number you already have, never through the link in the message.

Two habits reduce the blast radius of the next breach. Have I Been Pwned's free notification service emails you when your address appears in a newly loaded breach. Email aliases (Apple's Hide My Email, SimpleLogin, Firefox Relay) give each site its own address, so a leak exposes only that alias and you can switch it off.

If you run the service that leaked

Hash passwords with Argon2id, scrypt or bcrypt (cost 10 or higher), per the OWASP Password Storage Cheat Sheet, and force a password reset for every affected account; NIST SP 800-63B requires a change when there's evidence a password was compromised. Invalidate sessions and API tokens too. My own habit is simple: .env files go into .gitignore before the first commit, because a leaked secret in a repository history is a breach you created yourself. For the broader checklist, see password security best practices.

FAQ

What should I do immediately after a data breach?

Change the breached password on that site and everywhere you reused it, email account first. Then sign out other sessions on your email, check its forwarding rules and recovery options, and turn on 2FA. Monitoring and credit freezes come after.

How do hackers use stolen passwords from data breaches?

Plaintext passwords go straight into credential stuffing tools that test them on hundreds of other sites. Hashed passwords are cracked offline first; with a fast hash like MD5, common and short passwords are recovered within hours, and the cracked ones join the stuffing lists too.

How long does it take to crack a leaked password?

On one RTX 4090, a random 8-character password using all printable characters lasts about 11 hours against unsalted MD5 and about 36,600 years against bcrypt at cost 10. A password based on a word or pattern can fall in seconds against either, because attackers try leaked-password lists before brute force.

Is it safe to type my real password into a strength checker?

Only into one that runs entirely client-side. Check that the page makes no network request when you type (the browser's developer tools show this). The checker on this site computes everything in the browser tab.

What is credential stuffing and how is it different from brute force?

Brute force guesses passwords it doesn't know. Credential stuffing uses passwords it already has, taken from one breach and tried on other sites. Rate limits barely slow it down because each account gets only one or two attempts, and only unique passwords stop it.