Your Password Was in a Data Leak. Do These 5 Things in the Next 10 Minutes

The email says your details appeared in a breach. It has happened to billions of accounts, and the people who act in the first ten minutes are the ones who keep their money and their accounts. Here is the calm, correct order of operations.

1. Change that password first, then everywhere it was reused

Start with the leaked account, then email, banking and social accounts - in that order. The real danger is rarely the leaked site itself; it is attackers trying the same email and password combination on hundreds of other sites within hours.

2. Make every new password long, random and unique

Length beats cleverness. A random 16 character password generated on your device cannot be guessed, reused or cracked with your pet's name and birthday. Human invented passwords follow patterns that cracking tools try first.

3. Turn on two factor authentication and use a password manager

2FA means a stolen password alone is not enough to get in. A password manager remembers your unique passwords so you do not have to - you only remember one strong master password.