My email address is in a data breach

What it actually means, and the three accounts to secure first.

20 minutes7 steps in total

Tick as you go, it stays on your device, even if you close the tab.

FIRST10 min

Check what leaked: the password, or just the address?An address alone gives access to nothing: it is worth spam. A password is another matter.Change that password on the service, then everywhere else.Attackers automatically try the address + password pair on hundreds of sites. That is the only thing that makes a breach dangerous.Handle three accounts first: mailbox, bank, main social network.The rest can wait for the weekend. These three command everything else.

THEN20 min

Turn on two-factor authentication on those three accounts.Even stolen, the password no longer gets anyone in. This is what makes future breaches harmless.Ignore emails demanding money while quoting that password.Sextortion recycles public breaches to fake a hack. They have nothing but the stolen database row.

SO YOU NEVER COME BACK HERE30 min

Set up a password manager and let it invent everything.A different password per site: a breach then touches one account, never your whole life.Use email aliases for throwaway sign-ups.One address per service. When one leaks you know who sold you out, and you switch it off.

In the book : ch. 02 · p. 48

So it does not happen again

The roadmap actions that treat the cause, not the symptom.

Set up a password managerYour brain cannot remember 80 unique passwords, so it cheats: it reuses. A password manager generates and stores strong, unique passwords in an encrypted vault, protected by a single master password.20 min

Something else worrying you?

Related areas : Passwords & 2FA · Email

My child has a phone and I do not know where to startOne evening, one list, without falling out with them.this evening All situations

You have done everything. It is out.

So it does not happen again

Something else worrying you?