Your information appeared in a data breach: what to do for each type of exposed data

Direct answer: do not apply one generic “change your password” checklist to every breach. First confirm the notice through an official channel and identify the data types actually reported as exposed. Then match each exposure to its likely risk, immediate action, monitoring and escalation route.

Act urgently if money is moving, an account is being used, your phone number suddenly stops working, or an attacker may have an active session or authentication token. An exposure notice by itself does not prove that a particular criminal has used your data. Equally, an organisation saying it has found no misuse is not a guarantee that misuse cannot occur later.

This guide is for individuals. It provides global security actions plus separate Australia, United States and United Kingdom routes. It is not legal, financial or identity-replacement advice. Official procedures differ by jurisdiction and can change.

First understand three different states

• Exposure: information was made available to an unauthorised party or may have been included in breached data.
• Account compromise: someone has obtained or exercised access to an account, session or connected application.
• Misuse: the information has been used for fraud, impersonation, account opening, unauthorised transactions or another harmful act.

These states require different responses. A leaked email address creates phishing risk but does not by itself prove that the email account was accessed. A stolen session token, by contrast, may allow access without entering the password again.

The five-step triage

1. Check for an active incident

Treat any of these as urgent:

• transactions or account changes you did not authorise;
• password-reset or multifactor prompts you did not initiate;
• loss of access to an important account;
• your mobile service unexpectedly showing no signal or SOS only;
• a new SIM, port or device notice you did not request;
• messages sent from your account;
• a credible threat involving health information, location, stalking or physical safety.

Contact the relevant bank, account provider, telco, issuing authority or emergency service through a channel you know is genuine. Do not use a phone number or link in a suspicious breach message.

2. Confirm the breach independently

Open the organisation’s official app or type its known website address yourself. Find its breach notice or support page. Ask:

• Was my record affected?
• Which exact fields were involved?
• Were passwords plaintext, encrypted, hashed or not included?
• Were payment details complete or masked?
• Were active session tokens, API keys or authentication secrets involved?
• What dates and systems were affected?
• What has the organisation invalidated or replaced?

Australia’s Cyber.gov.au and the UK NCSC both advise checking through the organisation’s official channels rather than using contact details in an unexpected message.

3. Make an exposure inventory

Write down only what the official notice confirms, plus a separate list of unknowns. Preserve the notice, relevant headers or screenshots, reference numbers and your contact history. Do not publicly post unredacted breach letters, identity documents, tokens or account numbers.

4. Secure the highest-leverage access first

If credentials or active access may be involved, start with the email account that receives password resets, then financial and identity accounts, then other affected or password-reused accounts. Use a device you reasonably believe is free from malware. Cyber.gov.au advises using a clean device when malware may have caused account compromise.

5. Follow the row for every exposed data type

A breach can involve several rows. Complete all that apply; combined data can make impersonation more convincing.

Exposure-to-action matrix

The matrix states plausible risks, not a prediction that they will occur.

What each action actually means

Passwords and account sessions

The US IdentityTheft.gov breach tool advises changing an exposed login, changing reused passwords and using two-factor authentication. The UK NCSC and Australia’s Cyber.gov.au give the same core reused-password response.

Changing a password may not terminate every existing session or connected-app grant. Check the provider’s security page for “sign out everywhere”, session, device and connected-app controls. For email compromise, inspect forwarding rules and recovery details; the NCSC specifically warns that attackers may add mail-forwarding rules.

Tokens, connected apps and API keys

An access token is a credential an application uses to access a service within granted permissions. A refresh token can obtain new access tokens. IETF OAuth security guidance explains that stolen access or refresh tokens can be replayed and that authorisation servers may revoke refresh tokens after security events. The OAuth revocation standard defines a way for clients to request token revocation.

For a consumer, the practical response is provider-specific: revoke unknown sessions and connected applications, rotate exposed API keys, and verify that old credentials no longer work. Do not invent a generic menu path. If the provider offers no revocation control for a consequential token, escalate to its security or support team.

Email addresses and phone numbers

An email address or phone number can make scams more believable because the attacker can reference a real breach. That does not mean the underlying email or phone account was accessed. Verify unexpected contact independently.

Phone-number exposure becomes more urgent if service suddenly stops or you receive an unrequested SIM/port notice. Australia’s ACMA identifies unexpected account changes, verification codes, login attempts and sudden loss of service as warning signs of mobile-number fraud; it advises contacting the telco and bank immediately when fraud is suspected.

Cards and bank accounts

Use a phone number, app or website you already trust. IdentityTheft.gov directs affected people to contact the card issuer, request replacement where appropriate and monitor transactions. Cyber.gov.au similarly says to contact the bank or financial institution immediately when finances may be at risk.

Never move money because an unexpected caller says a “safe account” will protect it, and never disclose a verification code. The US FTC explicitly warns that these are scam behaviours.

Identity documents and identifiers

The correct action depends on the document and country. Replacement is not automatically useful for every identifier, and a new physical document may not invalidate all information already exposed. Use the official issuing authority and country-specific identity service.

Country-specific action modules

Australia

• Use Cyber.gov.au’s data-breach recovery guidance and “Have you been hacked?” pathway to match exposed information to actions.
• Contact the bank immediately if financial details or money may be at risk.
• For compromised identity information, Cyber.gov.au points individuals to IDCARE and the relevant document issuer; driver-licence replacement rules differ by state and territory.
• Report cybercrime through ReportCyber when applicable and scams through Scamwatch. Contact police for immediate danger or active crime.
• If mobile-number fraud is suspected, contact the telco immediately; ACMA explains the SIM-swap and unauthorised-port response.

United States

• Use IdentityTheft.gov’s data-breach pathway for the exposed data type and its recovery plan if misuse occurred.
• For identity information capable of opening credit, consider a free credit freeze with all three nationwide credit bureaus. A freeze helps prevent new-credit checks; it does not stop misuse of an existing account, so continue monitoring those accounts.
• Contact the card issuer or bank through a known channel for card or account exposure and unauthorised activity.

The FTC separately confirms that even with a credit freeze, an identity thief may still make charges on existing accounts.

United Kingdom

• Use the NCSC’s individual data-breach guidance; change exposed or reused passwords, monitor account activity and recover hacked accounts through provider guidance.
• If money has been lost, contact the bank immediately and report it to Report Fraud; in Scotland, follow Police Scotland’s route.
• The ICO handles data-protection concerns about an organisation’s treatment of personal information. It is not a replacement for contacting the bank, account provider or police during active fraud or danger.

Do not transplant a US credit-freeze instruction or an Australian document-replacement route into another country.

A follow-up plan that does not create false certainty

Now

• Confirm the breach and exposed fields.
• Stop active financial, account, mobile-number or safety incidents.
• Secure root accounts and revoke exposed access.
• Record actions and reference numbers.

Over the following days

• Check whether the organisation’s findings changed.
• Review account, banking, telco and identity alerts.
• Complete country-specific protective steps.
• Confirm replacement cards, documents, passwords and tokens work—and that superseded ones do not.

Ongoing

• Keep the breach notice and action log.
• Treat highly specific unsolicited contact with suspicion.
• Continue the monitoring recommended by the official organisation, issuer or recovery service.
• Reassess if the organisation later identifies additional exposed fields.

No fixed monitoring period eliminates risk. The useful duration depends on the data type, whether it can be changed and what the official investigation establishes.

Stop and escalate

Stop self-service and obtain direct help when:

• money has moved or a bank/account provider reports fraud;
• you are locked out of email, telco, finance or another root account;
• a session or token cannot be revoked;
• identity information is actively being used;
• the affected person is a child or a person needing additional support;
• health, intimate, location or biometric data creates a safety risk;
• a message threatens harm, extortion or stalking;
• you suspect the device used for recovery is infected.

Use emergency services for immediate danger. Use the official institution, regulator or recovery route for your jurisdiction; do not pay a “recovery agent” who contacts you unexpectedly.

The one-page exposure record

For each breach, record:

This record is the article’s original working asset. Store it securely; it may itself contain sensitive information.

Sources

• SEC-S01 — Report and recover from a data breach — Cyber.gov.au / ASD ACSC; retrieved 2026-08-07; market AU.
• SEC-S02 — Data breach guidance for individuals — UK National Cyber Security Centre; retrieved 2026-08-07; market GB.
• SEC-S03 — Report and recover from account compromise — Cyber.gov.au / ASD ACSC; retrieved 2026-08-07; market AU.
• SEC-S04 — What to do if your information was lost or stolen or part of a data breach — IdentityTheft.gov / US FTC; retrieved 2026-08-07; market US.
• SEC-S05 — Hacked accounts — UK National Cyber Security Centre; retrieved 2026-08-07; market GB.
• SEC-S06 — RFC 9700 — Best Current Practice for OAuth 2.0 Security — IETF; retrieved 2026-08-07; market GLOBAL.
• SEC-S07 — RFC 7009 — OAuth 2.0 Token Revocation — IETF; retrieved 2026-08-07; market GLOBAL.
• SEC-S08 — Scam alert — protect yourself from mobile number fraud — Australian Communications and Media Authority; retrieved 2026-08-07; market AU.
• SEC-S09 — What to do if your mobile number has been stolen — Australian Communications and Media Authority; retrieved 2026-08-07; market AU.
• SEC-S10 — Never move your money to protect it — that is a scam — US Federal Trade Commission; retrieved 2026-08-07; market US.
• SEC-S11 — Freezing? Maybe freeze your credit too — US Federal Trade Commission; retrieved 2026-08-07; market US.
• SEC-S12 — Personal data breach reporting — UK Information Commissioner's Office; retrieved 2026-08-07; market GB.
• SEC-S13 — Understanding your credit — US Federal Trade Commission; retrieved 2026-08-07; market US.