What to Do After a Data Breach — A 24-Hour Action Plan
When your data is breached, the first 24 hours matter most. Follow this step-by-step action plan to secure your accounts and minimize damage.
When you receive a data breach notification — or discover your information was exposed in a breach — the first 24 hours are critical. Attackers move fast: stolen credentials are tested against popular websites within hours of a breach.
Follow this action plan in order. Speed matters more than completeness in the first hour.
Immediate Steps (Within 1 Hour)
1. Change your password on the breached site immediately — even if you think the breach is old.
2. Search your password manager or memory for any other accounts using the same password. Change all of them.
3. Enable two-factor authentication on the breached account if it was not already active.
4. Log out of all active sessions on the breached platform.
Short-Term Steps (Within 24 Hours)
5. Run a dark web scan to understand the full scope of what was exposed — use CypherAvoid's free scan to check if your email appears in related breach databases.
6. Enable 2FA on your email account if you have not already — your email is the master key to all other accounts.
7. Check your bank and credit card statements for any unauthorized transactions.
8. If your Social Security number or financial account details were exposed, place a credit freeze with all three bureaus (Equifax, Experian, TransUnion) — it is free.
Long-Term Protection
9. Activate continuous dark web monitoring so you are alerted to future breach exposures before they are used against you.
10. Review your data broker exposure — breaches often expose information that, combined with your public data broker profile, creates a complete identity fraud package.
CypherAvoid covers both layers: dark web monitoring for credential exposures and data broker removal to reduce your reconnaissance footprint.
Run Exposure Scan
Check your current data broker and dark web exposure — free scan, no account required.