Credentials can open other accounts
A current or reused password, recovery detail or session token may allow access beyond the service where the breach happened.
Public systems and disruption
What should I do after a data breach?
What you should do after a data breach depends on the information involved. A password, account token, payment record, identity document, contact detail and sensitive record create different risks and do not require the same action.
Page S-007Guidance pageReviewed 29 August 2026
Key Guidance
Confirm the breach through the organisation independently and identify the exact data involved. Secure exposed sign-in details and accounts first, then protect payment, identity or sensitive information as relevant. Expect follow-up messages that use real details to appear convincing.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
A breach is an exposure event, not a single fixed effect. The useful question is what the exposed information could allow someone to do now or later.
Payment data requires route-specific action
Card details, bank information and transaction history create different monitoring, replacement and dispute needs.
Identity data can remain useful
Names, addresses, dates of birth and document details may support applications, account changes or convincing impersonation long after the event.
Contact and sensitive data shape later harm
Email, phone, health, location or relationship information may enable targeted approaches, distress, discrimination or safety concerns.
Consequences and movement
What may happen next
Begin with the highest-effect information confirmed in your record. Do not perform every possible security step without evidence that it applies.
Password or account access data
Change the password anywhere it remains in use, remove unfamiliar sessions or recovery details and turn on two-step verification or a passkey.
Payment or banking information
Contact the provider through a trusted route, follow its monitoring or replacement advice and challenge unfamiliar activity promptly.
Identity documents or fixed details
Tell the document issuer if appropriate, check credit records where relevant and watch for unfamiliar accounts, applications or address changes.
Contact or sensitive records
Prepare for personalised messages, adjust privacy or safety arrangements where necessary and keep evidence of threatening or harmful misuse.
Practical response
What you should do
Contain immediate access first, then confirm a proportionate monitoring and reporting plan for effects that may appear later.
- Verify that your record was affectedUse the organisation's official website, app or trusted contact route. Do not use a link in an unexpected breach, reset or compensation message.
- Get the field-level factsAsk which information, accounts and dates apply to you and whether passwords, tokens, payment details or documents were exposed.
- Secure the most important accountProtect email first when it controls password resets, then financial, social, cloud and other high-value accounts.
- Review evidence of misuseCheck sign-in history, statements, credit records, account recovery details and correspondence according to the data involved.
- Preserve the notice and later contactKeep the organisation's notification, dates, messages, transactions and complaint correspondence without sharing them publicly.
- Escalate actual harmContact the relevant bank, account provider, document issuer, data-protection route or police service when misuse, loss, threats or danger are visible.
Look more closely
The right response depends on what information was exposed
Different data creates different possibilities, from targeted messages to account or identity misuse. Match protection to the confirmed information and remain cautious of later contact that uses accurate details as proof of legitimacy.
Information leaves its intended control.
A notice or personalised message creates attention.
Real details support a claimed organisation or helper.
A reset, compensation, security or recovery route is supplied.
Focused account and identity action limits what the data can enable.
Selected history
Historical cases and lasting lessons
Action based on the affected information
UK cyber guidance tells individuals to confirm whether they are affected, change current or reused exposed passwords and check accounts for unauthorised activity.
Lasting lesson: The breach label begins the assessment. The exposed field determines the protective action.
Documents, statements and credit records
The UK data regulator advises affected people to report lost documents to issuers and look for unfamiliar financial or credit activity.
Lasting lesson: Monitoring should follow the type of misuse the information could support.
Transferable understanding
Patterns over time
Accurate details increase trust
A later caller may know a service, address or old password and use that knowledge as false identity proof.
Risk differs within the same incident
Two records in one system may contain different fields and therefore require different responses.
Consequences can be delayed
Account or identity misuse may appear after the immediate news and notifications have faded.
Overreaction can obscure priority
Changing unrelated settings may consume time while a breached email account or payment route remains exposed.
Plain-language answers
Common questions
Should I change every password?
Change any exposed password that is still used and every reused copy. Prioritise email and important accounts, then use unique passwords and stronger sign-in protection.
Does a breach mean my identity has been stolen?
No. It confirms exposure or possible exposure. Identity fraud requires later misuse, although some data justifies monitoring before misuse is visible.
Should I pay for breach protection?
Do not buy protection through an unsolicited message. First understand what the organisation offers and independently assess whether any extra service is useful.
What if the organisation gives little detail?
Ask in writing which information applied to you and keep the response. Use its complaint process and the relevant data-protection route if the answer remains inadequate.
Protect the information that was actually involved
Confirm the event and affected fields, secure sign-in details and money routes, then monitor identity or sensitive effects in proportion to the evidence.
Scamology Insights
Turn an exposure notice into a focused action map
These learning resources can help you see how exposed information may be used in a later contact or identity claim, and where you can interrupt the attempt. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency