What to do after a data breach or if your account is hacked

TUREFF• •0

Finding out that a company you use has been breached, or that someone has got into one of your accounts, is unsettling. The right steps depend on what was taken, but acting calmly and in the right order limits the damage. This guide covers both situations.

If a company tells you about a data breach

A breach notice should say what kind of information was exposed. That decides what you need to do.

Passwords, even scrambled ones: change the password for that service, and for any other account where you used the same or a similar one.
Email addresses and phone numbers: expect more targeted phishing. Scammers may mention the breach, or the company's name, to seem convincing.
Card details: contact your bank or card issuer. They may cancel and replace the card.
Dates of birth, addresses or identity documents: watch for identity fraud, such as credit applications in your name.

Be careful with the notice itself. Fake breach notices are a common scam. Check the company's official website or app rather than clicking links in an email.

If one of your accounts has been hacked

The National Cyber Security Centre sets out these steps in its guidance on recovering a hacked account.

Contact the service. Most providers have an account recovery page. Find it by going to the official website or app directly.
Secure your email first. Your email can reset every other password, so regain control of it before anything else. Check its filters and forwarding rules, because attackers often set up a rule that copies your incoming mail to them.
Change passwords for the hacked account and any account that shares the same password. Use a strong, unique password for each.
Sign out of all devices and sessions. Most services have an option to log out everywhere, which removes the attacker's access.
Turn on two-step verification, or use a passkey where offered.
Update your devices, so known security holes are closed.
Tell your contacts, especially if messages were sent from your account asking for money or containing links.
Check bank statements and shopping accounts for payments or orders you did not make.
Report it. In the UK, report fraud and cybercrime to Report Fraud, the national service that replaced Action Fraud in December 2025.

If the service cannot restore your account, you may need to start a new one and update any other sites that used the old one.

Check what else the attacker might have touched

Recovery details. Make sure the recovery phone number and email address on the account are yours.
Connected apps. Remove any third-party apps or services you do not recognise.
Saved payment methods. Remove cards you do not need stored.
Social media posts and messages sent while you were locked out.

Protecting yourself from identity fraud

If personal details such as your date of birth or address were exposed:

Check your credit file with the main credit reference agencies. In the UK these are Experian, Equifax and TransUnion, each of which offers a free way to see your report. Look for applications or accounts you do not recognise.
Consider protective registration with Cifas, the UK fraud prevention service, if you are at particular risk. It is a paid service that flags your details so lenders make extra checks.
Tell your bank if identity documents were exposed.

Your rights

Organisations that hold personal data have legal duties to protect it. In the UK, you can ask the organisation for details of what happened, and if you are unhappy with its response you can complain to the Information Commissioner's Office.

Making the next breach less harmful

Use a password manager so every account has a different password, and a single breach cannot unlock the rest.
Turn on two-step verification or passkeys on important accounts: email, banking, social media and shopping.
Keep recovery codes somewhere safe and offline.
Share less. Give sites only the information they need, and close accounts you no longer use.
Sign up for breach alerts from your password manager or a reputable breach notification service, so you hear about exposures quickly.

Have you dealt with a breach or a hacked account? Share what helped in the comments, leaving out anything personal.