What to Do Immediately After a Data Breach

By Zakria Ahmad · 2 November 2026 · Last updated: 2 November 2026

What is a data breach?

A data breach is when a company or service loses control of user data — for example email addresses, passwords, phone numbers, or card details — to attackers. You may hear about it in the news, get an email from the company, or find your email in a breach-check tool. A breach does not always mean money was stolen, but it does mean your details may now be used for phishing, fake calls, or account takeover attempts.

How does it work after a breach?

First, attackers get a list of leaked emails and passwords. Then they try those passwords on many other sites, because many people reuse the same password. Then they send phishing emails and fake bank calls that look more convincing, because they already know your name, email, or phone number. This is why leaked-password reuse is so dangerous.

Red flags to check after a breach

• You get password-reset emails you did not request.
• You get login alerts from accounts you did not open.
• You get more phishing emails, fake bank calls, or fake support messages than usual.
• Someone tries to log in to your email or bank account.
• You realise you used the same password on many sites — that password is now the weakest link.

Guard tip: Change passwords in this order: first email, then bank, then other important accounts. Your email is the key to password resets everywhere, so protect it first. Use a different password for each important account, and turn on two-factor authentication.

What to do — in order

1. Change your email password first, then your bank passwords, then other important accounts. Do not reuse the old leaked password anywhere.
2. Turn on two-factor authentication on email and bank accounts, if you have not already.
3. Check your bank and email accounts for unknown logins or transactions, and report anything you do not recognise at once.
4. Be extra careful with emails and calls for the next few weeks — attackers will use your leaked details to make phishing more convincing.
5. Consider a password manager, so each account can have a different, strong password without you having to remember them all.

What not to do

• Do not keep using the leaked password on any site, even if "nothing happened yet."
• Do not click links in breach emails that ask you to "check" or "verify" — go to the official site or app yourself.
• Do not pay anyone who claims they can "remove" your data from the breach, or "recover" money for a fee — that is a second scam.

If money was already taken

1. Call your bank at once, ask them to freeze the account, and report the unauthorised transactions.
2. Change all related passwords, starting with email and bank.
3. Report the incident to your bank and to the official cybercrime reporting service in your country, for example FIA Cybercrime in Pakistan, Action Fraud in the UK, or the FTC in the USA.
4. Keep records: dates, amounts, messages, and reference numbers from the bank.