A service you use reported a data breach. Act in the right order

A breach notice may involve passwords, payment details, contact information or data you no longer remember giving the service. A generic warning on social media is not enough to tell which records were affected. Start with the provider's official notice and your own account activity.

Turn the notice into a checklist​

1. Open the service directly, not through an unsolicited message. Confirm the incident notice, the affected data, the relevant dates and what the provider says it has already reset or revoked.
2. If a password or sign-in token may be exposed, change that account's password to a unique one. Replace the same password anywhere you reused it, starting with email. Turn on MFA and review active sessions.
3. If payment details were involved, contact the card issuer through its official channel, review charges and ask whether replacement or monitoring is appropriate. If identity data was exposed, use your country's official identity-theft guidance.
4. Watch for follow-up messages that quote real details from the incident. A convincing breach-themed message can still be a separate phishing attempt.

Check the result​

Confirm you can sign in with the new password, other devices or sessions behave as expected, and recovery information still belongs to you. Keep the notice and your actions in case the scope changes. The FTC's breach-response guide distinguishes actions by exposed information. Our credential-stuffing explanation shows why reused passwords are the first priority.

If the notice is vague​

Do not assume every field was taken or that nothing important was. Check the provider's updates for a more specific scope, and keep an eye on your account while the investigation develops. If only an email address was exposed, a password reset may not be required, but targeted phishing can still use your name and service history.