It is not a question of whether your data has leaked. It is a question of how many times, and whether you have noticed. Between the mega-breaches, one 2024 leak alone exposed billions of records including Social Security numbers, and the endless smaller ones, your email, your passwords, your phone number, and often much more are almost certainly already circulating somewhere. So the genuinely useful skill is not preventing every breach, which is impossible and mostly not your fault anyway. It is knowing exactly what to do in the first 48 hours when you learn your data is out. Here is that playbook, in order.

First, know when you’re in one

You cannot respond to what you do not know about. Check your email address and phone number against Have I Been Pwned, a free service that tracks known breaches, and turn on its notifications so you hear about future ones automatically. Take breach-notification emails seriously, but be careful: scammers send fake “you’ve been breached” emails to exploit exactly this moment. Never click the link in one. Go directly to the company’s site and check there.

The first 48 hours, in priority order

Change the breached password, and everywhere you reused it. This is first for a reason. The real damage from a breach is rarely the one account; it is that attackers take the leaked password and try it on all your other accounts, a technique called credential stuffing, and it works because people reuse passwords. Change the exposed password, then change it anywhere else you used the same one. Going forward, a password manager with a unique password per site turns this whole attack off.

Turn on strong two-factor on the affected account and your critical ones. A leaked password is far less dangerous if it is not enough to get in. Add two-factor authentication, and make it a good kind, an authenticator app or a hardware key, not SMS, which is the weak version we have written about. Do your email first.

Lock down your email specifically. Your inbox is the master key to everything, because it is the reset channel for all your other accounts. Give it a fresh, unique password and your strongest two-factor, and while you are in there, check the settings for any forwarding rules or filters you did not create, a classic move by an attacker who briefly had access is to quietly forward copies of your mail to themselves.

If financial data or your Social Security number was exposed, freeze your credit. This is the single most effective move against identity theft, and it is free. A credit freeze at all three major bureaus stops anyone, including you until you lift it, from opening new credit in your name, which is what a leaked SSN is actually used for. It takes about fifteen minutes and it is the thing most people skip and later regret.

Assume targeted phishing is coming, and get skeptical. Breached data makes scams frighteningly convincing, because now the scammer knows your name, which bank you use, a recent order, your address. Treat any urgent message that references the breach, or your accounts, or a “problem,” as hostile until proven otherwise. Do not click, do not call the number in the message. Go to the source directly.

Lock your phone number against a SIM swap. Your number was very likely in the leak, and it is the key to SMS codes and account resets. Set a PIN or port-freeze with your carrier so no one can move your number to their SIM, for the reasons we covered in why your number is a liability you don’t control.

Rotate anything else that was exposed. Security question answers, which you should never answer honestly anyway, API keys, saved payment details if a card was involved. If it leaked and it is still valid, replace it.

After the fire is out: make the data worthless

Here is the mindset shift that matters most. You cannot un-leak data. Once your information is out, it is out, and old breaches get recombined and reused by scammers for years. So the long game is not keeping the data secret, that battle is already lost. It is making the leaked data useless.

That is what the steps above actually accomplish. Unique passwords mean a leaked password opens exactly one door, which you have already closed. Strong two-factor means a password alone is worthless. A credit freeze means a leaked Social Security number cannot open an account. Skepticism means the phishing built on your leaked details fails. Do those things and a breach goes from a potential catastrophe to a minor annoyance, because there is nothing useful left to do with your data.

And going forward, shrink how much of you ends up in the next one. Opt out of the data brokers reselling your profile, and be stingy about what you hand over in the first place, since the data that was never collected cannot be breached.

The honest reframe

Breaches are not your failure. They are the failure of companies that collected more of your data than they could protect, and there is very little you can do to stop them from happening. What you can control is how much a breach costs you, and that is almost entirely decided in advance, by unique passwords, strong two-factor, a credit freeze, and a healthy suspicion of anyone who contacts you knowing too much. Set those up once and the next breach, and there will be a next one, is something that happens to a company, not something that happens to you.

A big part of staying out of the blast radius is simply generating and handing over less data to begin with, which is much of what we build toward. If you want a phone and a setup designed to keep you out of as many of these piles as possible, email hello@spicycorp.com, or book a call. And if this is a sensitive topic because you are worried about a specific person rather than a faceless breach, please talk to someone who can help you plan safely.