A site you use was breached. What now?

Guide5 min readUpdated 15 NOV 2026

Change the password on the breached site first, then on every other site where you used the same password. Turn on two-factor authentication where you can, and watch for phishing emails that mention the breach.

Breach news is alarming, but the response is short and the order matters. Work through this list once and you are done.

The first hour

  1. Change the password on the breached site. Use a new, generated password; a password generator takes seconds.
  2. Find everywhere you reused it. Attackers try leaked passwords on other sites within hours. A password manager's health check lists reused passwords for you.
  3. Turn on two-factor authentication on that site and on your email account. Email is the key to every password reset.

The following weeks

  • Expect phishing emails that mention the breach and ask you to "verify" your account. Go to the site directly instead of clicking.
  • If card details were involved, watch your statements and ask your bank about a replacement card.

Stopping the next one

Breaches will keep happening. What you control is how far one spreads. Unique passwords everywhere mean a leak stays on the site where it happened. Zen Passwords' password health shows weak, reused and old logins, and Premium breach checks flag passwords that have appeared in known leaks. Only a partial hash of a password is ever checked; the password itself never leaves your device.