Another Data Breach? Here’s How to Lock Down Your Online Accounts

Data breaches have become so common that they hardly cause incidents anymore.

You usually receive a carefully worded email with a subject line stating “Data Breach Notice”, followed by a few paragraphs assuring you that the incident is contained and that there is no evidence of misuse.

If nothing seems obvious, it’s easy to skim the message and move on with your day. But cybersecurity is not background noise, nor are the violations behind these notices.

In late 2025, South Korea’s largest e-commerce platform admitted to a hack that exposed the names, email addresses and phone numbers of around 33.7 million customers, forcing the government to open an investigation into the depth of access and sharing of personal data.

Meanwhile, Check Point researchers tracking credential theft reported a year-over-year increase of around 160% in 2025 as of August 8, with attackers increasingly using stolen logins to slip into accounts unnoticed. Even if attackers don’t attack immediately, an exposed email address or password may be enough for them to start probing other services you use weeks or months later.

If your information was exposed in a breach, you don’t need to panic. But you must act, starting with your accounts on which everything else depends.

Here’s how to lock your accounts and reduce the risk of further damage.

Start with your email account

Your email is pretty much the master key to everything you use online. If someone gains access to your personal or work email, they could potentially reset passwords for banking apps, social media, healthcare, cloud storage, and more, without ever knowing your original credentials. Just “reset password” and they can get in.

If you think your email password is somewhere, change it to a long, unique password that you haven’t used anywhere else. This is a major theme of this story: please don’t reuse passwords.

If your email provider supports it (most do), enable two-factor authentication, ideally using an authenticator app, push notifications, or even a hardware security key. SMS is the most popular option, but it’s also the least secure of the group. SMS messages can be intercepted and attackers can sometimes take control of a phone number through a technique known as SIM swapping. Since authenticator apps generate codes directly on your device, you avoid these risks.

Also review recent login activity and security settings. Many email services show where and when your account was last accessed. If something doesn’t seem familiar, log out of all sessions and revoke access to connected apps that you no longer recognize.

Change exposed passwords, as well as reused ones

Next, update the password for all your accounts directly affected by the breach, aside from your email account. If you have reused passwords exposed elsewhere, those accounts should also be changed. This is one of the most common methods attackers use to turn a breach into something bigger.

Attackers take leaked email and password combinations and automatically test them on hundreds of popular services because many people reuse passwords.

Each of your accounts should have its own unique password. Ideally a long random string like v8$Qm!2ZrP9@kLwXwith at least 14 characters. You can also use an Apple-style password, like ajwQ7-alxup-haytzi.e. 20 characters (16 lowercase letters, one uppercase letter, one number and two hyphens).

Yes, they can be difficult to manage, but long, randomly generated passwords are much harder to crack and prevent a single leak from unlocking multiple services. If you don’t want to remember every password, opt for a password manager that can generate and store them for you so you don’t have to remember any of them (minus your master password). Your phone also comes with a free built-in password manager: iCloud Keychain for iOS and Google Password Manager for Android.

If an account offers passwords, consider enabling them. Access keys replace traditional passwords with device-based authentication and cannot be phished or reused in the event of a service breach.

Enable two-factor authentication wherever possible

Two-factor authentication, or 2FA, adds a second layer of protection by requiring something like a temporary passcode or biometric scan, in addition to your password.

Enable 2FA on any account that supports it, especially those that contain a fair amount of your personal data, beyond your name and date of birth. App-based authenticators and hardware keys are more secure than text messages, but any form of 2FA is better than none.

Once activated, save your recovery codes in a secure location. This is often the only way to regain access if you lose your phone or security key.

Check for suspicious activity

After securing your credentials, look for signs that someone may have already accessed your accounts. View recent logins and transaction history.

Watch for unexpected password reset emails, new forwarding rules in your email account, or changes to your profile details that you didn’t make. For financial accounts, review recent purchases and enable transaction alerts if available.

If you find evidence of unauthorized access, contact the service immediately and follow its account recovery process.

Remove access you no longer need

Over time, many accounts accumulate logins to third-party apps, browser extensions, and old devices that still have access to them. These can become weak points after a breach.

Review apps and connected devices and delete anything you no longer use or recognize. Disconnecting all active sessions can also force an attacker to log out if they are still logged in.

Keep an eye on your accounts in the future

Even after you’ve locked everything down, it’s worth remaining vigilant. Some attackers rely on stolen data and attempt it months later, hoping users have relaxed.

Consider signing up for breach alerts through a password manager or identity monitoring service. Enable security notifications when possible so you can be alerted to new connections or changes as they occur.

A data breach is frustrating, but it doesn’t have to turn into identity theft or financial loss. A few targeted steps—starting with your email, strengthening passwords, and adding additional security—can go a long way toward ensuring your accounts are safe the next time you’re breached… because it almost certainly will.