Key Takeaways
- Unexpected login alerts and unfamiliar account activity are the clearest signs of a compromised password.
- Data breach notification services can tell you if your credentials have appeared in a known leak.
- Changing your password immediately and enabling two-factor authentication limits the damage quickly.
- Reusing passwords across accounts turns one breach into many — each account needs a unique credential.
- A password manager makes creating and storing strong, unique passwords straightforward.
What you will need
Why Compromised Passwords Are So Consequential
A stolen password is rarely an isolated problem. Because many people reuse credentials across multiple services, one breach can cascade into unauthorized access across banking, email, and social accounts simultaneously. Email accounts are especially high-value targets — whoever controls your email can trigger password resets on almost everything else you own.
Understanding how attackers actually steal passwords — through phishing, data breaches, and credential stuffing — makes the response steps below easier to understand and motivating to follow. If you also notice unusual behavior on your device itself, it's worth checking signs your device may have been compromised, since device-level compromise and account compromise sometimes occur together.
What you will need
Step-by-Step: What to Do When You Suspect a Breach
The steps below walk you through identifying, containing, and recovering from a compromised password. Work through them in order — the first actions you take will have the greatest impact on limiting damage.
Recognize the warning signs
Several indicators suggest a password may no longer be yours alone:
- Login notifications you didn't trigger — emails or SMS alerts about sign-ins from unfamiliar devices or locations.
- Password reset emails you didn't request — someone may be attempting to lock you out.
- Unfamiliar activity inside an account — sent messages you didn't write, purchases you didn't make, or profile changes you didn't authorize.
- Sudden inability to log in — your credentials have been changed by someone else.
- A data breach notification — from a service you use, alerting you that account data was exposed.
For a broader look at account-level red flags, see warning signs your account has been targeted by phishing.
Check whether your credentials appear in a breach
Visit Have I Been Pwned (haveibeenpwned.com) and enter your email address. The service cross-references your address against a database of publicly disclosed breaches and tells you which ones — if any — included your data.
If a breach is listed, note which service was involved and what data was exposed (passwords, phone numbers, etc.). This helps you prioritize which accounts to address first.
[tool_cards]Change the compromised password immediately
Log in to the affected account and navigate to its security or password settings. Create a new password that is:
- At least 14 characters long
- A random mix of uppercase and lowercase letters, numbers, and symbols
- Completely unique — not used on any other account
If you cannot log in because your credentials were already changed, use the platform's account recovery option (typically triggered by your registered email address).
Update any accounts that shared the same password
If you reused the compromised password elsewhere — even with minor variations — change those passwords too. Attackers routinely run credential stuffing attacks, automatically trying stolen username-and-password pairs across hundreds of other sites.
To understand exactly how these attacks work, see how attackers actually steal passwords. Prioritize accounts with the most sensitive data: email, banking, healthcare, and anywhere you shop or store payment details.
Enable two-factor authentication (2FA)
Two-factor authentication (2FA) requires a second proof of identity — typically a code sent by SMS or generated by an authenticator app — in addition to your password. Even if your password is stolen again, 2FA prevents an attacker from completing a login without that second factor.
Enable 2FA on every account that supports it, starting with email and financial accounts. Authenticator apps (which generate codes locally on your device) are generally more secure than SMS-based codes.
[important_callout]Review account activity and revoke unfamiliar sessions
Most platforms provide a list of active sessions or recent login history under security settings. Review this list and sign out any sessions you don't recognize. Also check for:
- Unfamiliar third-party apps connected to your account
- Changes to recovery email addresses or phone numbers
- Forwarding rules in email that could be redirecting your messages
Revoking access cuts off anyone currently inside your account, even if they already knew your password.
[warning_callout]Set Up Login Alerts on All Key Accounts
Most major platforms let you enable notifications for new sign-ins via email or SMS. Turning these on means you'll be alerted the moment someone accesses your account from an unrecognized device or location — giving you an early-warning system at no extra cost.
Once you've secured your immediate situation, consider running a full password health audit across all your accounts. It's the most reliable way to find weak or reused passwords before an attacker does.
Building Habits That Prevent the Next Compromise
Responding well after a breach matters — but reducing the chances of it happening again matters more. A few durable habits cover most of the risk:
- Use a password manager to generate and store a unique password for every account. You only need to remember one strong master password.
- Never reuse passwords, even across accounts you consider low-importance. Attackers don't discriminate.
- Check for breaches periodically using a service like Have I Been Pwned, especially after news of large-scale data leaks.
- Keep recovery information current — an outdated recovery email or phone number can lock you out of your own account during a crisis.
For readers who want to go further, the Scams and Phishing hub covers the social engineering tactics attackers use to trick users into handing over credentials directly — knowledge that makes you significantly harder to deceive.