PanicStation.org
UK USA
uk Technology & digital loss data breach notice • breach notification email • password reused • reused password everywhere • same password multiple accounts • leaked password • compromised credentials • credential stuffing • account takeover risk • change breached password • change all reused passwords • email account security • two step verification • unexpected login alert • password manager help • phishing after breach • scam breach notice • suspicious activity check • sign out other devices • banking password reused

What to do if…
you get notified of a data breach and you reuse that password on other services

Short answer

Assume that password is now “public” and change it everywhere you used it (starting with your email account), then turn on two-step verification on your most important accounts.

Do not do these things

  • Don’t click links in the breach email unless you independently navigate to the company’s website/app first (breach notices are often used for phishing).
  • Don’t “tweak” the old password (like adding a number) and reuse it again — attackers try common variations.
  • Don’t start with low-value accounts first; secure email, banking, and your mobile/Apple/Google accounts before anything else.
  • Don’t store the new password in notes, screenshots, or an unprotected document.
  • Don’t ignore “no suspicious activity yet” — credential-stuffing can happen days or weeks later.

What to do now

  1. Make a quick list of everywhere that password was used.
    Include “similar” versions (same base word with small changes). If you’re unsure, assume it counts.

  2. Secure your email account first (this is the reset key for everything).

    • Change the email password to a strong, unique one.
    • Turn on two-step verification (2SV).
    • Check your email filters and forwarding rules, and remove anything you didn’t set.

  3. Change the breached account password next — using a completely new, unique password.
    If the service provides a “devices/sessions” or “where you’re logged in” page, sign out of other sessions/devices and review recent login activity.

  4. Change that reused password everywhere else — in priority order.
    Do these first:

    • banking, credit cards, PayPal/other payment apps
    • Apple ID / Google account / Microsoft account
    • mobile network account (SIM/number control)
    • any work accounts, password manager, cloud storage
      Then do shopping, social, forums, etc.

  5. Turn on 2SV on the most important accounts (even after changing passwords).
    Prefer an authenticator app or hardware key where available. Keep backup/recovery codes somewhere safe.

  6. Add “tripwires” so you’ll know fast if someone tries again.

    • Enable login alerts / new device alerts where possible.
    • Add/confirm a recovery email and phone number you control (and that are themselves secured).

  7. Watch for signs of misuse and act quickly if you see them.
    Examples: password reset emails you didn’t request, new logins, changed profile details, new payees/orders. If you see any, use the service’s account-recovery flow immediately and contact your bank/payment provider if money is involved.

  8. If the breach includes personal details (not just a password), consider identity-fraud precautions.

    • If you’re worried someone could apply for products/services in your name, Cifas Protective Registration can add extra checks when your details are used. It’s a paid service, can slow down genuine applications because checks are added, and it doesn’t guarantee prevention of all fraud.
    • If you think an organisation has handled your personal information badly, complain to the organisation first. If you’re not satisfied with their response (or they don’t respond after a reasonable period, often up to a month), you can escalate a data protection complaint to the ICO.

What can wait

  • You do not need to decide today whether to close accounts or change email address/phone number.
  • You do not need to overhaul every security setting everywhere — focus on unique passwords + 2SV + securing email first.
  • You do not need to reply to the breach email (unless you’re sure you’re communicating via the official site/app).

Important reassurance

Reusing passwords is extremely common — attackers rely on automation, not personal targeting. Taking the “email first, then everything else” approach quickly cuts off most of the damage.

Scope note

This is first steps only for the next hour or two. If you find evidence of account takeover, financial loss, or identity fraud, you may need additional steps specific to that service/bank.

Important note

This guide provides general information for immediate stabilisation and harm reduction, not legal, financial, or cybersecurity professional advice. If you’ve lost money, feel unsafe, or believe identity fraud is underway, contact the relevant provider(s) promptly.

Additional Resources
Support us