Password Security After a Breach: What to Do Next

Password security after a breach starts with checking what happened and using the affected service’s own recovery process. A leaked password, an unfamiliar login and a convincing warning email can look similar at first. They do not all mean that your computer is infected or that every account has been taken over.

Open the genuine app or type the provider’s address yourself. Do not use a number or reset link supplied by an unexpected caller or message. If you suspect the computer itself is compromised, use another trusted, updated device for account recovery. If you cannot sign in, follow the provider’s recovery steps before changing settings on unrelated accounts.

Use the account provider’s recovery process

Find the security notice or account activity inside the real service. Note which account is affected, whether the notice says a password was exposed and whether someone actually signed in. An old password appearing in a warning is a reason to check reuse; it does not prove that the sender controls your current account.

If your email account may be compromised, prioritise recovering it. Access to your inbox can allow someone to intercept password resets for other services. If it is a work or school account, contact the organisation’s administrator promptly: they may need to manage sessions and recovery centrally.

If you are locked out

Use the provider’s account recovery form or documented support route. Have access to the recovery methods you previously registered, and answer the provider’s questions accurately. Keep any support reference so you can continue the same case. Do not give account recovery answers to a third party promising a guaranteed unlock.

For a Google account, use Google’s compromised account instructions to review security events and devices. Follow your own provider’s steps if the account belongs to a different service.

The NCSC’s hacked account guidance explains the main checks. A repair shop cannot override an online provider’s ownership checks, and reinstalling Windows does not by itself return control of a cloud account.

Replace compromised and reused passwords

Once you can use the genuine account settings, replace the exposed password with a new, unique credential. Change it on any other account where it was reused. Prioritise email, recovery accounts and services containing important personal information, then work through the rest of the list.

Do not keep the same password with a different year or a small spelling change. Let a protected password manager generate an unrelated replacement. Our guide to creating secure passwords for everyday accounts covers that routine in detail.

Keep a clear record of what you checked

Make a short list of the affected services and whether you have changed the password, checked recovery access and reviewed sessions. The list should contain account names and completed actions, not passwords or recovery codes. This helps avoid resetting the same account repeatedly while forgetting another reused login.

Where the provider offers additional authentication, set it up after checking that the registered methods belong to you. Remove a method you do not recognise through the provider’s documented process. If you cannot tell which method is yours, use official support rather than deleting everything and risking another lockout.

Review account access and recovery details

Password security after a breach includes checking the routes that can preserve someone else’s access. A changed password is useful, but the provider may have separate controls for active sessions, linked applications and recovery methods.

For example, Microsoft’s sign out everywhere guidance explains that ending sessions can take time and has exceptions. Check the provider’s confirmation rather than assuming every device lost access immediately.

• Devices and sessions: review recent activity and use the provider’s option to end access you do not recognise.
• Recovery details: check the email addresses, phone numbers and other recovery methods attached to the account.
• Connected applications: review third party access and remove unfamiliar authorisations using the service’s instructions.
• Mailbox settings: inspect forwarding, filters and rules for changes that could copy, hide or delete messages.

Location labels in a login history are clues rather than exact proof. Mobile networks, travel and privacy services can affect them. Compare the device, time and activity with what you were doing, and follow the provider’s security workflow when an entry remains unexplained.

Check messages sent from the account

Look for messages, posts or requests you did not send. If contacts may have received a scam, warn them through a channel you still control. Explain that they should not open the recent link, send money or share a code. Keep relevant evidence before removing fraudulent content.

After recovery, test the intended login on a trusted device and confirm that the correct recovery details remain in place. If suspicious activity returns, reopen the provider’s security process. Do not assume a second password reset is the only step required.

Get help through official channels

Check affected shopping and payment accounts for unfamiliar activity. If money has been taken or a payment is in question, contact your bank through its official app, card or published website. Follow the current reporting route in the NCSC guidance. Do not rely on contact details inside a suspicious transaction alert.

For a business account, tell the person responsible for IT and preserve the relevant notices and activity records. They can assess which systems and people are affected. Avoid forwarding a sensitive mailbox or customer records to a personal account as an improvised backup.

Account recovery and device checks are different jobs

Keep your operating system, browser and applications updated. If you installed an unexpected program, granted remote access or see other signs of compromise, a separate device assessment may be appropriate. A provider breach alone does not establish that malware is present on your laptop.

Kingfisher can discuss a suspected computer problem through our virus and spyware removal service. The online account provider still controls its recovery process. Do not send us passwords, login codes or recovery codes when asking for advice.

Once access is stable, review the account’s current sign in and recovery options. Google’s account authentication overview explains the roles of passkeys and recovery methods. Use the instructions for your own provider rather than assuming every service has the same settings.