What to Do When Your Data Is Leaked in a Breach: Step-by-Step

If your data was leaked in a breach, act fast: change passwords on the breached service and everywhere you reused them, enable two-factor authentication, check your bank accounts for unauthorized transactions, and freeze your credit if national IDs (Aadhaar, SSN) were exposed. Start with an official breach-notification service, and use Kaval on WhatsApp if you want help interpreting the situation or planning next steps.

You find out a company you use got breached. Maybe you got an email. Maybe you saw it in the news. Maybe you ran a check and your email popped up in a leak you’d never heard of.

That sinking feeling is normal. But here’s what matters: breaches happen to practically everyone at this point, and the outcome depends almost entirely on what you do next. A fast, thorough response in the first day or two can be the difference between “annoying but fine” and months of dealing with compromised accounts or identity theft.

Here’s exactly what to do, what to prioritize, and how to set things up so the next breach doesn’t hit as hard.

How to Find Out If Your Data Was Leaked

Most people find out way too late, through unauthorized charges, a notification email months after the fact, or their credentials showing up for sale somewhere. You don’t want to be in reactive mode. Check proactively.

Start with a breach-notification service

Have I Been Pwned is a well-known breach notification service by security researcher Troy Hunt. Enter your email and see which publicly disclosed breaches it appeared in. It covers a large number of known breaches and offers email alerts for future exposures. Do not enter a password, OTP, or other secret into a checker.

You can send Kaval the notification or surrounding message on WhatsApp if you want help understanding what to do next. Kaval is a practical guide, not a replacement for the underlying notification service. For the full workflow, see our email breach checking guide.

Credit Monitoring

In India, CIBIL lets you monitor your credit report for unauthorized inquiries or accounts opened in your name. In the US, the three major bureaus (Equifax, Experian, TransUnion) provide free annual reports through annualcreditreport.com.

Credit monitoring won’t detect the breach itself, but it catches downstream effects, like someone taking out a loan with your leaked identity documents.

Company Notification Emails

Companies that get breached are often legally required to tell affected users. These emails usually arrive weeks or months later and explain what was exposed. Don’t ignore them. But also be careful, scammers send fake breach notification emails with phishing links. Verify the sender and go directly to the company’s website instead of clicking anything in the email.

Immediate Steps After a Breach

You’ve confirmed your data was exposed. Here’s what to do, in order.

1. Change Your Passwords

Start with the breached service. Then change passwords for any other account where you used the same password (or something close to it). Yes, it’s tedious. But password reuse is what turns one breach into a cascade, a single leaked password can unlock dozens of accounts if you’ve recycled it.

Do it properly:

• Use a password manager to generate unique passwords (more on this below)
• At least 16 characters each
• Don’t reuse passwords across services
• Priority order: breached service, then email, then banking, then social media

If you can’t log into the breached service because the attacker changed your password, use account recovery immediately. If your recovery email was also compromised, contact support directly.

2. Enable Two-Factor Authentication (2FA)

Turn on 2FA for every account that supports it, especially email, banking, social media, and cloud storage. Even if someone has your password, 2FA stops them without the second factor.

Options, from strongest to weakest:

1. Hardware security key (YubiKey, Google Titan), phishing-resistant, strongest option
2. Authenticator app (Google Authenticator, Authy, Microsoft Authenticator), time-based codes on your phone
3. SMS OTP: better than nothing, but vulnerable to SIM-swap attacks

For your most critical accounts (email and banking), avoid SMS-based 2FA if you have the option to use an authenticator app or hardware key.

3. Check Your Financial Accounts

Log into your banking apps, UPI accounts, credit cards, and investment platforms. Look for:

• Transactions you don’t recognize, even tiny ones (scammers test with small amounts before going big)
• New payees or beneficiaries you didn’t add
• Changes to your registered email or phone number
• Pending loan applications or credit inquiries you didn’t initiate

Anything suspicious? Call your bank immediately. Most have dedicated fraud helplines. In India, the cybercrime helpline 1930 can help freeze fraudulent transactions if you report quickly.

4. Freeze Your Credit (If Sensitive IDs Were Leaked)

If the breach exposed Aadhaar, PAN, SSN, or passport details, take extra steps.

In India:

• Contact CIBIL to place a fraud alert
• File a report with the National Cyber Crime Portal
• Lock your Aadhaar biometrics through the mAadhaar app or the UIDAI website

In the US:

• Place a free credit freeze with Equifax, Experian, and TransUnion
• This stops anyone from opening new credit accounts in your name
• You can temporarily lift it when you actually need to apply for credit

5. Revoke Suspicious Sessions and App Permissions

Go to security settings on your major accounts and:

• Revoke active sessions on devices you don’t recognize
• Remove third-party app permissions you don’t use anymore
• Check for unfamiliar email forwarding rules, attackers set up silent forwarding so they can see your emails even after you change your password

That last one is sneaky and people miss it constantly. If an attacker has your email forwarding to them, they can intercept password reset emails for your other accounts. Check your email forwarding settings right now.

What Types of Leaked Data Actually Matter

Not all breaches are the same. What was exposed changes how urgently you need to act.

Passwords: Critical

A leaked password gives direct access to the breached account and (thanks to reuse) potentially many others. If it was stored in plaintext or with weak hashing like MD5, attackers can use it immediately. Even strongly hashed passwords get cracked eventually.

Action: Change it on the breached service and everywhere you reused it. Start using a password manager.

Email Addresses: High Risk

Your email is the recovery key for almost every account you own. A leaked email doesn’t give direct access, but it makes you a prime phishing target. Attackers will send convincing emails using breach context, “We noticed suspicious activity on your account…”, because they know you were in the breach.

Action: Enable 2FA on your email. Be extra skeptical of emails in the weeks after a breach. Navigate directly to websites instead of clicking links.

Phone Numbers: High Risk

Used for SMS 2FA, account recovery, and identity verification. Leaked numbers open you up to SIM-swap attacks, targeted SMS phishing, and WhatsApp scams. See our guide on spotting WhatsApp scams for more.

Action: Set a PIN with your mobile carrier to prevent SIM swaps. Switch from SMS 2FA to authenticator apps where possible.

Aadhaar / SSN / National IDs: Critical

These can’t be changed like a password. Leaked national IDs enable identity theft, opening bank accounts, applying for loans, filing fake tax returns in your name. A leaked Aadhaar number combined with other personal data makes eKYC fraud possible.

Action: Lock Aadhaar biometrics. Place fraud alerts with CIBIL. Monitor credit monthly for at least a year. File a police report if you suspect misuse.

Credit Card Numbers: Critical (Short-Term)

Can be used for unauthorized purchases immediately. But credit cards actually have the best fraud protection of any data type, you can dispute charges and get a replacement card relatively easily.

Action: Call your card issuer to block and replace the card. Review recent statements and dispute unauthorized charges. High urgency but straightforward resolution.

Physical Addresses and Dates of Birth: Moderate

Used for identity verification questions at many institutions. An attacker with your address, DOB, and email can sometimes pass basic verification over the phone. This data also makes phishing attacks more convincing.

Action: Be aware that someone might try to impersonate you using these details. Treat unsolicited calls that reference your personal info with suspicion, knowing your address doesn’t make a caller legitimate.

Long-Term Protection

Cleaning up after a breach is necessary but it’s not enough. These changes prevent the next breach from doing the same damage.

Get a Password Manager

A password manager generates, stores, and auto-fills unique strong passwords for every account. This kills password reuse, which is the thing that turns one breach into twenty compromised accounts.

Good options:

• Bitwarden: Open source, free tier, works everywhere
• 1Password: Polished experience, family sharing, built-in breach monitoring
• Apple/Google built-in: Fine if you’re fully in one ecosystem

Honestly, which one matters less than actually using one. Any password manager is dramatically better than reusing passwords or storing them in a notes app.

Enable 2FA on Everything

After a breach, go through your accounts systematically. Priority order:

1. Email: the master key to your digital life
2. Banking and financial services: direct money risk
3. Social media: used for impersonation
4. Cloud storage: might contain sensitive documents
5. Shopping and subscriptions: stored payment methods

Set Up Breach Monitoring

Instead of manually checking every few months, subscribe to alerts from an official breach-notification service such as Have I Been Pwned. Kaval Membership includes ongoing reminders and follow-through under the current terms; send a notice to Kaval on WhatsApp if you want help interpreting it or planning next steps.

Start with the official notification service, then send the notice to Kaval on WhatsApp if you want help with the next step.

Shrink Your Digital Footprint

Every account is a potential breach surface. Reduce exposure:

• Delete accounts you don’t use anymore (JustDeleteMe helps find deletion links)
• Use email aliases for throwaway signups (Apple’s Hide My Email, SimpleLogin)
• Minimize personal info on social media profiles
• Opt out of data broker sites that collect and sell your information

Keep Software Updated

Plenty of breaches exploit known vulnerabilities in outdated software. Keep your OS, browser, and apps current. Enable automatic updates on your phone, computer, and router.

How to Tell If Someone Is Using Your Leaked Data

Sometimes the signs are subtle. Watch for these in the weeks and months after a breach.

Account compromise:

• Password reset emails you didn’t request
• Login notifications from places you’ve never been
• 2FA codes arriving when you didn’t try to log in
• Friends getting messages from your accounts that you didn’t send

Identity theft:

• Letters about accounts or credit cards you didn’t open
• Calls from debt collectors about debts you know nothing about
• Unexpected credit score changes
• Tax filing rejected because “you already filed”

Financial fraud:

• Small test transactions on your cards
• New payees in your banking app
• Subscription charges for services you never signed up for
• UPI collect requests from unknown merchants

If you spot any of this, go back to the immediate response steps. Change passwords, enable 2FA, call your bank, and file reports. Use the relevant service’s official notification or account-security tools to check for further exposure.

FAQ

How long after a breach should I be worried?

Longer than you’d think. Attackers don’t always use stolen data right away. Breach databases get bought, sold, and combined over time, your data from a 2024 breach might get merged with a 2026 breach to build a fuller profile. The first 48 hours are most critical for securing accounts, but keep monitoring for at least 12 months. Identity theft from leaked national IDs can surface years later.

Can deleted accounts still show up in breaches?

Yes. Deleting your account removes your access, but the company may keep your data in backups or archives. If those get breached, your old info is exposed. This happens more often than you’d expect. It’s another reason to use unique passwords everywhere, a leaked password from a “deleted” account can still compromise active accounts where you reused it.

What’s a stealer log and why is it worse than a normal breach?

A stealer log comes from malware installed on someone’s actual computer. Unlike a normal breach (where hackers hit a company’s servers), infostealers capture data directly from a victim’s machine, saved browser passwords, session cookies, autofill data, crypto wallets, screenshots. Everything.

They’re dangerous because stolen browser data can include active sessions and saved credentials. If a notification or investigation indicates a stealer infection, treat it seriously: change all passwords stored in your browser, invalidate sessions on important accounts, and run a malware scan. You might want to switch from browser password storage to a dedicated password manager. More in our email breach guide.

---

Breaches aren’t going to stop. As long as companies store your data, some of it will eventually get exposed. Your protection isn’t hoping it won’t happen, it’s being set up so that when it does, the damage is minimal.

Check whether your data has appeared in a public breach through Have I Been Pwned or the affected service’s official notice. If you want help interpreting the notice, send it to Kaval on WhatsApp at +91 7200218310. Do not share a password, OTP, or other secret.