Data Breach Checklist
Interactive step-by-step checklist for what to do after a data breach. Track progress through password changes, credit monitoring, and more.
Immediate Actions (First 1-2 Hours)
Take these steps right away to minimize ongoing damage from the breach.
Change the password for the breached account right away. Use a strong, unique password with at least 16 characters combining uppercase, lowercase, numbers, and symbols. Do not reuse any password you have used before.
If you reused the breached password on other accounts, change those immediately. Credential stuffing attacks test stolen passwords across hundreds of services automatically. Each account should have a completely unique password.
Enable 2FA on the breached account and any other important accounts. Use an authenticator app (like Authy or Google Authenticator) or a hardware key (like YubiKey) rather than SMS, which can be intercepted via SIM swapping attacks.
Log in to all bank accounts, credit cards, and payment services (PayPal, Venmo, etc.). Look for any transactions you do not recognize, no matter how small. Criminals often test with micro-transactions before making larger fraudulent charges.
Most services have an option to sign out of all devices/sessions (check security settings). This terminates any session an attacker may have established using your stolen credentials.
Check your email address, phone number, recovery options, and connected apps on the breached account. Attackers often change recovery information to maintain access even after you change your password.
Take screenshots of breach notifications, suspicious emails, unauthorized transactions, or any other evidence. This documentation may be needed for filing reports with your bank, law enforcement, or the FTC.
Within 24 Hours
Complete these actions within the first day to protect your identity and finances.
Contact Equifax (equifax.com/personal/credit-report-services), Experian (experian.com/freeze), and TransUnion (transunion.com/credit-freeze) to freeze your credit. A freeze prevents anyone from opening new credit accounts in your name. It is free and does not affect your credit score.
Place an initial fraud alert with one of the three credit bureaus (they are required to notify the other two). This alert requires creditors to verify your identity before opening new accounts. An initial alert lasts one year and is free.
If any of your security question answers were exposed, change them on all accounts that use them. Consider using random answers stored in a password manager rather than real answers, which can often be found through social media.
Attackers often set up email forwarding rules to silently receive copies of your emails (including password resets). Check your email settings for any forwarding addresses, filters, or rules you did not create.
Use a reputable password manager (like Bitwarden, 1Password, or KeePass) to generate and store unique passwords for every account. This prevents password reuse, which is the number one cause of account compromise after breaches.
Call your bank and credit card companies to inform them of the breach. Request enhanced fraud monitoring, new card numbers if payment data was exposed, and ask about their fraud protection policies and dispute procedures.
Go to the security settings of your breached account and review all third-party apps with access. Revoke any you do not recognize or no longer use. Attackers can use OAuth tokens from connected apps to maintain access.
If you used the same password for work accounts or if work data was potentially exposed, inform your IT department or security team immediately. They can take steps to protect company systems and data.
Within 1 Week
Follow up with these protective measures during the first week.
Sign up for a credit monitoring service to receive alerts about changes to your credit report. Many breach notifications include free monitoring (check the breach notification email). You can also use free services like Credit Karma or annualcreditreport.com.
If SSN, driver's license, or other identity documents were compromised, file a report at IdentityTheft.gov (FTC). This creates an official Identity Theft Report you can use to dispute fraudulent accounts and transactions.
Review login history and recent activity on all your important accounts: email, social media, cloud storage, shopping sites, and financial services. Look for logins from unfamiliar locations, devices, or IP addresses.
Ensure your recovery contact information is current and secure on all accounts. Use a secondary email address that is not publicly associated with your primary accounts. Consider using a Google Voice number for account recovery.
Check the breach notification and resources like HaveIBeenPwned.com to understand exactly what data was exposed (passwords, emails, SSN, financial data, etc.). This helps you prioritize your response based on the specific risks.
Attackers use personal information from social media for targeted phishing and social engineering. Review privacy settings on all social platforms, remove personal details from public profiles, and be cautious about what you share.
If your Social Security Number was compromised, create an account at IRS.gov to check your tax records. Consider filing an IRS Identity Protection PIN request to prevent fraudulent tax returns filed in your name.
If you experienced financial loss or identity theft, file a report with your local police department. While they may not investigate directly, the report can be valuable when disputing charges or dealing with creditors.
Ongoing Monitoring
Continue these practices to protect yourself long-term after a breach.
Request your free credit reports from annualcreditreport.com. Stagger requests across the three bureaus (one every 4 months) for year-round monitoring. Look for accounts you did not open, inquiries you did not authorize, and incorrect personal information.
After a breach, expect increased phishing attempts using your leaked data to look legitimate. Be suspicious of emails, texts, or calls referencing the breach, asking you to verify information, or creating urgency. Never click links in unexpected messages.
Check bank and credit card statements at least weekly for the first few months after a breach. Set up transaction alerts for any purchase over a threshold amount. Report unauthorized transactions immediately to benefit from fraud protection policies.
Use services like HaveIBeenPwned.com, your password manager's breach monitoring, or credit monitoring services that include dark web scanning. These can alert you if your data appears in new breaches or is being sold.
Monitor your physical mailbox for unexpected credit cards, loan offers, bills for unknown accounts, or tax documents. These could indicate someone is using your identity to open accounts. Set up USPS Informed Delivery to track incoming mail.
Periodically change passwords for your most sensitive accounts (email, banking, cloud storage). Use your password manager to generate and store strong unique passwords. Also rotate passwords if you hear about any new breach affecting a service you use.
Store your two-factor authentication recovery codes in a secure, offline location (printed and locked, or encrypted offline storage). If you lose access to your 2FA device, these codes may be the only way to recover your accounts.
Evaluate whether identity theft insurance makes sense for your situation. Many homeowner or renter insurance policies offer it as an add-on. Standalone policies typically cover expenses related to identity theft recovery, such as legal fees and lost wages.
About This Checklist
This checklist provides a comprehensive response plan for data breaches. Your progress is saved automatically in your browser. Focus on Critical items first, then Important, then Recommended. If you suspect ongoing unauthorized access, consider contacting a cybersecurity professional for assistance.
How to Use Data Breach Checklist
Identify breach type
Figure out which scenario you're in — a personal account that got popped, financial or identity data exposed somewhere, or a business breach where you have customers to think about. Each scenario has a different response sequence, and starting on the right one matters because the time-sensitive steps are different.
Follow checklist items
Work through the ordered actions in sequence. Change passwords on affected services (and reuses), enable two-factor authentication on the accounts that matter, monitor your financial accounts if anything financial was involved, and consider a credit freeze. For business breaches, the early steps are about containment and notification timelines rather than personal account hygiene.
Document each action
Keep a running log of what you did, when, and what the outcome was. This matters for insurance claims around identity theft costs, regulatory reporting if you're handling a business breach, and tax purposes if you ended up paying for credit monitoring or other recovery services. The documentation is also useful if the same breach causes new problems months later.
Maintain ongoing vigilance
Set calendar reminders to check back at one month, three months, and a year after the breach. Watch for phishing emails that reference the breached service, unusual account activity, and the slow-moving signs of identity theft like unfamiliar lines on a credit report. Most actual misuse happens months after the breach hits the news, not in the first week.
When to Use Data Breach Checklist
Personal account audit
When you suspect your credentials might have been part of a breach (or you just want a periodic check), the checklist walks you through the basics — looking up your email on HaveIBeenPwned, changing any compromised passwords, enabling two-factor authentication on the accounts that matter most. Everyone with online accounts ends up needing this eventually.
Post-breach response
You get the 'your data may have been compromised' email and your stomach drops. The checklist gives you a sequence to work through under stress: change passwords on the affected service and anywhere you reused them, watch your accounts for suspicious activity, consider freezing your credit if financial data was involved, and document everything for taxes or insurance claims down the line.
Business breach response
Small businesses and teams without dedicated security staff need a runbook when something goes wrong. The checklist covers regulatory notification timelines (GDPR's 72-hour rule, varying US state laws), how to communicate with affected customers, what evidence to preserve, and which authorities to contact. Having this written down before a breach means you don't have to figure it out under pressure.
Annual security check
A proactive walk-through of your security posture — which accounts exist, what data each one holds, what's been part of any breach in the past year. Doing this once or twice a year catches the slow accumulation of stale credentials, forgotten accounts, and reused passwords that turn into a real problem when one of them gets popped.
Data Breach Checklist Examples
Personal checklist
After learning email leaked1. Pull the full list of breaches affecting your address from HaveIBeenPwned. 2. Change the password on the affected service. 3. Change the password anywhere else you used the same one. 4. Turn on two-factor authentication on every important account. 5. Watch your email and financial accounts for anything unusual over the next few weeks. 6. Look at what data actually leaked — was it just your email, or full profile information?Most people stop after step 2 and call it done, but that misses the real risk. The reused-password sweep and the 2FA rollout are what actually reduce your exposure for the next breach (and there will be a next one).
Credit freeze process
Financial data potentially leaked1. Place a fraud alert with one of the three bureaus (Equifax, Experian, or TransUnion — they share alerts). 2. Pull your free credit reports from all three. 3. Consider a credit freeze — free since 2018, and the strongest tool you have. 4. Watch your financial accounts for unauthorized charges. 5. File a police report if fraud is confirmed.A credit freeze is more powerful than fraud alerts because it actually prevents new accounts from being opened in your name rather than just flagging applications. The minor inconvenience (you have to thaw it temporarily for legitimate credit applications) is well worth the protection.
Business response timeline
Discovered customer database leakedHour 1: activate incident response, isolate the breach. Hour 2 to 24: identify the affected data and contain the spread. Hour 24 to 72: determine notification requirements (GDPR 72-hour rule, US state laws). Day 3 to 7: customer notification, regulatory reporting. Week 2 onward: investigation, remediation, and figuring out what changes prevent the next one.GDPR's 72-hour notification window is real and the fines for missing it are significant. Notice that everything before the formal notification — containment, scoping, evidence preservation — has to happen in parallel with regulatory work, which is why the process needs to be planned before a breach happens, not during.
Tips & Best Practices for Data Breach Checklist
- 1.Use unique passwords for every account. When a breach exposes one of your passwords, the damage is contained to a single service rather than rolling through everything. A password manager like 1Password or Bitwarden makes this practical without your needing to remember anything.
- 2.Turn on two-factor authentication for the accounts that matter — your primary email (because it's the recovery path for everything else), your financial accounts, and your work accounts. Even a compromised password can't be used without the second factor, which removes most of the value of stolen credentials.
- 3.Sign up for HaveIBeenPwned breach notifications. It's free, takes about a minute, and means you find out about new breaches affecting your email automatically rather than catching it weeks later in a news article.
- 4.Don't dismiss breach notifications, even ones that say the leaked data was 'low risk.' Email addresses alone enable targeted phishing, and combined with other leaked data they enable identity theft. Take the time to change passwords and review affected accounts every time.
- 5.Know your rights under GDPR and CCPA. You can request to know what data a company has on you, demand deletion, and opt out of certain types of processing. After a breach, exercising those rights is a reasonable response and sometimes uncovers more than you expected.
- 6.Document everything. Breach notifications, the dates you changed passwords, fraudulent charges and their resolution, communications with the breached company. This paper trail matters for insurance claims, tax write-offs of identity-theft costs, and any legal action you decide to pursue.
Frequently Asked Questions
Related Tools
Robots.txt Generator
Generate robots.txt files online with crawler rules and sitemap directives. Free robots.txt generator for SEO and search engine control.
Sitemap Generator
Generate XML sitemaps online for better search engine indexing. Free sitemap generator with priority, frequency, and lastmod options.
.htaccess Generator
Generate .htaccess rules online for Apache web servers. Free htaccess generator for redirects, caching, security, and URL rewriting.
User Agent Parser
Parse and analyze user agent strings online to detect browser, OS, device, and bot details. Free user agent string parser and analyzer for web developers.
URL Parser
Parse and analyze URL components online including protocol, host, path, and query parameters. Free URL parser for web developers.
HTML Viewer
Render and preview HTML code live in your browser online. Free HTML viewer with responsive device frames and instant rendering.