# A company was breached. What you do next depends on what leaked. Knowing what to look for · 04 · 10 min read A breach notice may be long, but one line does most of the practical work: the categories of information involved. Start there, because a password, phone number, payment card, and government document each call for a different response. This page helps you: - Find the part of a breach notice that matters - See what each kind of leaked data can mean - Stop one leaked password from reaching other accounts A personal data breach means information held by an organization was lost, changed, accessed, or disclosed in a way it should not have been. It may involve a stolen database, a misdirected file, a misplaced device, or access to an account. For the person named in the notice, the practical question is the same: _which data was involved?_ A leaked password calls for different steps than a leaked national ID number. ## A useful notice tells you what happened to your data There are two ways to find out. Both should end with the same two facts: which company, and which kind of data. **Two ways to find out** **A notice from the company, or the news** - What it can tell you: The data involved and the period of the incident, in a useful notice. - Before you use it: Do not enter a password or card number through a link in the notice. Open the company's official site or app yourself to confirm it. - What it cannot tell you: Whether a company must notify you, and how quickly, depends on local law and what happened. **Checking yourself with [Have I Been Pwned](https://haveibeenpwned.com)** - What it can tell you: Which known breaches an email address has appeared in. - Before you use it: It asks for an email address, not a password. Entering an address sends it to that service. - What it cannot tell you: Breaches outside its database. Use the result to identify a company and data type, not as a complete account history. If you would rather not submit your address, rely on notices and the official account pages of companies you use. ## What leaked? Pick what the notice says leaked. See what it may mean. The next step depends on the data involved and the organizations that hold the relevant account or record. ### A password Where to begin · Change reused copies The breached account needs a new password. If you reused that password, other accounts need attention too. What to do: - Change it on the breached site, then anywhere you reused the same password. - If that password was also used for your email, change the email account first. Email is often where other accounts send reset links. - Review the breached account's recovery email, phone number, and recent sessions for changes you do not recognize. - Give each account a different password. A password manager makes that practical, and another sign-in step can limit what a stolen password does. ### Email address only Where to begin · Expect tailored messages An email address can bring more targeted messages and may be combined with details from other sources. What to do: - Treat messages that name the breached company as unverified until you check through its official site or app. - Make sure the email account itself has a strong, unique password. ### Phone number Where to begin · Secure the carrier account A phone number can make calls and messages more specific. Knowing the number is not the same as controlling the phone line. What to do: - Ask your carrier whether it offers an account PIN or number-transfer lock, and what that protection covers. - Check which important accounts use text messages for sign-in or recovery. Where another method is available, an authenticator app, passkey, or security key does not depend on the phone number. - Treat a caller or message that knows your number and details from the breach as unverified. Contact the organization through its official app, site, or a number you already trust. ### Home address Where to begin · Watch the mail record An address can make impersonation more convincing or direct unwanted contact. Its appearance in a breach does not show that anyone has redirected your mail or opened an account. What to do: - Watch for expected post and any notice about a mail redirect you did not request. If something changes, contact your postal service through its official route. - Do not treat someone quoting your address as proof of who they are. Addresses may be shared, old, or available from other records. - If the same notice also names payment, account, or identity-document data, follow the steps for those details too. ### Card or payment details Where to begin · Check the payment account The card issuer can explain whether monitoring, replacement, or a dispute process applies. What to do: - Watch statements and report anything you did not make. - Ask your bank whether it recommends monitoring or replacing the card. ### National ID number Where to begin · Check official records A national ID number may be used with other details for new accounts, benefits, or impersonation. What to do: - Ask the issuing authority and credit-reporting agencies which alerts, freezes, or replacement steps apply where you live. - In the United States, IdentityTheft.gov has steps for a Social Security number that may have leaked, including credit freezes. - Watch for accounts or loans you did not open. ### Government ID image or number Where to begin · Ask the document issuer A passport or driver's license image gathers several official details in one place. A leaked copy can support impersonation, but it is not proof that the document has been used. What to do: - Read the notice closely: an image of the document, its full number, and a partial number are different disclosures. - Use the issuing authority's official guidance. Tell it whether you still hold the physical document and exactly what the notice says was involved, then ask whether reporting or replacement is appropriate. - Review the accounts or official records named in the notice. Credit-file protections, where available, cover some new-credit activity but not every form of impersonation. ### Security questions Where to begin · Replace leaked answers Security questions rely on facts that may be public, reused, or difficult to change. Some sites still use them for account recovery. What to do: - Change a leaked answer anywhere you reused it. If the service allows an unrelated answer, store it in your password manager rather than relying on a public fact. - Prefer a passkey or another sign-in step over security questions where the service offers one. ### Health or account history Where to begin · Read the notice closely The effect depends on the records involved. It may concern privacy, account access, billing, or targeted messages. What to do: - Be wary of callers who quote real details as "proof" of who they are. - Ask the provider how to report account, billing, or record changes you do not recognize. Reviewed July 2026. Official starting points: in the United States, [IdentityTheft.gov gives data-specific starting points](https://www.identitytheft.gov/Info-Lost-or-Stolen). In the United Kingdom, the [ICO explains what a breach notice should contain](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/). The authority, notice rules, and remedies differ elsewhere. ## About "the dark web" Some products offer to search breach collections for your data. A result may help identify a known incident, but it does not show every place a detail may have traveled or predict whether anyone will use it. Use the company notice and the data type to choose a response. Change a leaked password, ask the relevant issuer what to do with a payment or identity detail, and verify later messages through an official channel. A search result is one source of context, not a protection on its own. ## A reused password carries the breach into other accounts A breached password affects the account it belongs to. Reuse can spread the same problem to other accounts. Watch the difference between a reused password and a different one for each account. ### Same password everywhere - Streaming · breached - Email · password reused - Bank · password reused - Shopping · password reused - Work · password reused - Social · password reused The streaming-site password was reused. Automated login attempts may now try that same email and password on the other five accounts. ### A different password each - Streaming · breached - Email · different password - Bank · different password - Shopping · different password - Work · different password - Social · different password The streaming-site password is different from the others. The breached password still needs changing, but it is not the password for those accounts. ## Find the details that determine your next step 1. The data involved: The sentence naming the data determines which accounts or records need attention. Save it. 2. The response offered: Find the monitoring, replacement, or support the company is offering. Confirm the offer and its terms through the company's official site. 3. Dates and contacts: Keep the notice. Its dates, contact details, and description of the data may matter later. Use an official channel if anything in it is unclear. 4. What any monitoring watches: Read what it watches and how long the company pays for it. Credit monitoring can alert you to changes in a credit file. It does not see every kind of account, tax, benefit, or medical misuse. ### Keep breach and misuse separate A breach notice does not tell you whether the data has been misused. A breach and later misuse are separate events. Use the data type to decide which account, issuer, or official record to check, and which preventive options are available where you live. How stolen details may be used later lays out that timeline. ## After you read the notice 1. A password manager makes a different password for every account practical. Then one breached password is less likely to work anywhere else. Here's how that works. 2. If a national ID number or information used for new credit was involved, ask whether a credit freeze or alert is available where you live. It's covered in Freezing your credit. 3. Two-factor adds another step after a password and can block many login attempts, depending on the method and the account's recovery settings. Here's how two-factor and passkeys work. 4. Expect messages that reference the breach by name. A real incident gives a fake follow-up message useful detail, so confirm any "secure your account now" request through the company's app or site instead of the message. --- _Part of Identity Explained (by Persona). https://explained.withpersona.com/your-identity-online/data-breaches_