What to Do if Your Password Was Leaked in a Breach

In short: If your password turned up in a breach, change it on the breached account first, then everywhere else you used it, because NCSC's hacked accounts guidance says criminals try known passwords across multiple sites. Even a password that was only stored as a scrambled "hash" should be changed, since Have I Been Pwned's Pwned Passwords tool treats any password seen in a breach as compromised and tells users to "change it immediately" if they've ever used it.

A breach notice or a warning from a password checker can feel vague — what does it actually require you to do? The answer is a short, ordered list of actions. Do them in order, because each one closes a different door an attacker could walk through, and the first couple of steps are the ones that matter most in the first hour.

Which account do I change first after a password leak?

Change the password on the account that was actually breached, immediately. NCSC's recovery guidance for hacked accounts is direct: "You should immediately change the password for the hacked account. It's also important to change the password for any accounts where you use the same password," according to NCSC's hacked accounts page. If your email account is the one involved, treat it as the top priority of all your accounts, because it's usually the account used to reset every other password you own — an attacker who controls your inbox can reset your bank, shopping and social logins too.

If you reused your email password anywhere else, NCSC's separate guidance on email passwords is blunt about it: "If you have re-used your email password across other accounts, change your email password as soon as possible. It should be strong and different to all your other accounts," per NCSC's advice on email passwords.

Why do I need to change the password everywhere I reused it?

Because one leaked password becomes a master key to every account that shares it. NCSC explains the mechanics plainly: "if you use the same password across different accounts and one of your accounts is compromised, a hacker can try the same password on your other accounts and potentially gain access to them too," says NCSC's password manager guidance.

This is called credential stuffing, and Have I Been Pwned names it directly: "Attackers automate login attempts using leaked credentials from other sites, exploiting password reuse habits," according to HIBP's Pwned Passwords documentation. In practice, this is automated — software feeds your leaked email-and-password pair into hundreds of login forms in minutes, from streaming services to banking apps, checking which ones still accept it. You won't see it happening. You'll just find out later that an account you forgot about has been logged into, or used to buy something.

Should I worry if the password was hashed instead of plain text?

Yes — change it anyway. Companies are supposed to store passwords as a "hash," a one-way scrambled version rather than the original text, so a stolen database doesn't directly hand over your actual password. But a hash isn't the password staying safe forever: attackers can run huge lists of common passwords through the same hashing method offline, at their own pace, and check for matches. If your password was short or commonly reused, it can be cracked out of a hash even if it was never directly leaked in readable form.

HIBP's own tool makes the point for you: if a password shows up in its breach corpus at all, the advice is unconditional — "This password has previously appeared in a data breach and should never be used. If you've ever used it anywhere before, change it immediately!" according to HIBP's Pwned Passwords page. The tool itself never sees your full password while checking this — it hashes it on your device and sends only the first five characters of that hash to the service, a privacy method HIBP calls k-anonymity, per the same Pwned Passwords documentation. So "hashed" is a reasonable thing for a company to have done with your password in storage, but it is not a reason to skip changing it.

How do I know if attackers already accessed my account?

Check activity and sign out everything, don't just assume the password change was enough. After changing a password, NCSC says to force out anyone still logged in: "When you have changed your passwords, make sure that you log out of the account on any devices and apps," according to NCSC's hacked accounts guidance. Most email, social media and banking apps have a security or "devices" settings page that lists active sessions and lets you end them all remotely.

Also check your email's forwarding rules. NCSC warns that this is a favorite trick: "Cyber criminals are known to set up a forwarding rule to automatically receive a copy of all emails sent to your account, which could allow them to reset your passwords," per NCSC's guidance. A forwarding rule you didn't create is a strong sign someone else has been inside your inbox.

Finally, look for financial fallout. NCSC recommends you "look out for unauthorised purchases, and check your bank accounts for unusual transactions," according to the same NCSC page.

What should I turn on to stop this happening again?

Two-step verification, or a passkey where one's offered. NCSC calls this "the first – and most important – step" for protecting an account whose password might later be phished or leaked: "The first – and most important – step is to turn on two-step verification (2SV) to help protect you if your password gets phished or otherwise compromised," according to NCSC's password manager guidance. The logic is simple: "even if a criminal knows your password, they won't be able to access your account" without the second factor, per NCSC's hacked accounts page.

NIST's own digital identity guidelines back this up at a technical level, requiring "proof of possession and control of two distinct authentication factors through the use of secure authentication protocols" for this stronger tier of sign-in, according to NIST Special Publication 800-63B. NIST requires that services offering this stronger sign-in tier make available "at least one phishing-resistant authentication option," per the same NIST guidelines; passkeys are the option most consumer services now offer to meet that bar. NCSC now recommends treating passkeys as the default: "making passkeys your first choice of login and using them wherever they are offered," falling back to "a strong and unique password and two-step verification (2SV)" elsewhere, according to NCSC's guidance. If you're not sure how passkeys work, the mechanics are covered in our explainer on what a passkey is and how it works.

Should I switch to a password manager?

It's the most practical way to stop reusing passwords, which is the root problem credential stuffing exploits. NCSC describes the core feature as "automatic password generation to quickly create a strong and unique password for each account – rather than using the same password across multiple accounts, which you should never do," according to NCSC's password manager guidance. Many managers will also flag when a stored password has turned up in a known breach, which lines up with what NIST's guidelines call for: "NIST guidelines specifically recommend checking user passwords against previously breached datasets," according to HIBP's documentation. You don't need to memorize anything stronger than the manager's own master password once this is set up.

What phishing messages should I expect after a breach?

Expect emails and texts that reference details from the breach itself to look convincing — a leaked order number, address or partial account detail can be dropped into a fake "security alert" to make it seem legitimate. A full breakdown of these tactics and how to spot them is in our guide on how to spot phishing after a data breach. Don't click links in unexpected security emails — go to the service directly instead.

Do I need to freeze my credit too?

Not urgently, for a password leak alone. Credit monitoring and identity freezes are worth considering if your financial details were exposed alongside the password, but they're a lower priority than the account steps above, which address the immediate risk of someone logging in as you right now — the kind of unauthorized transaction NCSC says to watch bank accounts for in its hacked accounts guidance.

The checklist, in order

1. Change the password on the breached account immediately, per NCSC's hacked accounts guidance.
2. Change that same password on every other account where you reused it — email first, since it resets everything else.
3. Sign out of all devices and apps after changing it, so any existing stolen session gets cut off, as NCSC recommends.
4. Check your email for forwarding rules you didn't set up, and check bank and store accounts for unusual transactions, both flagged by NCSC.
5. Turn on two-step verification, or switch to a passkey where it's offered, following NCSC's recommendation and NIST's authentication standard.
6. Move to a password manager so you're never reusing passwords again, per NCSC's guidance.
7. Watch for follow-up phishing messages referencing details from the breach — see how to spot phishing after a data breach.
8. Consider credit monitoring or a freeze only if financial information was exposed too, and only after the steps above.

For the fuller response plan beyond passwords — what to check, what to tell other people, what to document — see our complete data breach response checklist.