What to Do If Your Data Has Been Leaked

A step-by-step personal recovery checklist for after a data breach. Work through it in order — your first move depends on what was exposed. Everything you enter stays in your browser; nothing is sent to us. Print it at any stage for your own records.

Last updated: July 2026 For: individuals (EU-primary, with US steps noted) See also: Has my data been leaked?

Which breach or service

When you found out

What was exposed

Your reference (optional)

0 of 19 steps completed 0%

Step 1 Confirm what was leaked

Check your email and phone at Have I Been Pwned — haveibeenpwned.com shows which known breaches include you.

Treat a clean result with caution — a “no results” is not an all-clear. Have I Been Pwned indexes stealer-log data only from 2025 and cannot see every breach or paste. If a service or your device warned you, believe it.

Identify exactly what was exposed — password, email, phone number, financial details, ID documents, home address. Your first move depends on the data type, so note it above.

Step 2 Lock down your accounts

Change the leaked password — and change it everywhere you reused it — password reuse is the real blast radius, turning one leak into many compromised accounts.

Secure your email first — it is the recovery key to every other account. Reset it, and check for forwarding rules or filters an attacker may have quietly added.

Turn on multi-factor authentication — prefer an authenticator app or a passkey over SMS, which can be intercepted.

Revoke active sessions and connected apps — log out other devices and review third-party (OAuth) access on your key accounts, so an attacker holding the old password is cut off.

Move to unique passwords with a password manager — so a single future leak can never cascade across your accounts again.

Step 3 If specific data was exposed

Phone number — set a carrier port-out or SIM PIN to blunt SIM-swap fraud, and treat calls or texts that quote your details as suspect.

Bank or card details — contact your bank, reissue the card, and watch statements. US: freeze your credit free at all three bureaus (Equifax, Experian, TransUnion) and report at identitytheft.gov. EU/UK: ask your bank about protective measures such as Cifas protective registration in the UK.

Passport, ID card, or driving licence — you cannot reset these. Report to the issuing authority where possible and stay alert to accounts being opened in your name.

Social Security or national ID number on the dark web — it is immutable and cannot be removed from the dark web; anyone promising to “delete” it is selling theatre. Mitigate instead: freeze credit, set an IRS Identity Protection PIN (US), and monitor.

Home address or other unchangeable data — you cannot change it, so reduce the standing exposure that keeps it circulating (Step 4) and stay alert to targeted contact.

Step 4 Cut your standing exposure & stay alert

Remove yourself from people-search and data-broker sites — leaked data is continually re-aggregated from these sources. Work through the EU/UK opt-out list or the US opt-out list.

Expect tailored phishing and vishing — leaked details make scams convincing. A real detail in a message is not proof it is genuine; verify through a channel you already trust.

Watch for the follow-on — a credential leak is often the first step, not the last. Be alert to account-recovery attempts and unfamiliar login alerts in the weeks after.

Step 5 Document & know when to escalate

Keep a short record — what was exposed, what you changed, and when. A simple log helps if fraud surfaces later.

Set up ongoing monitoring — for the accounts and identifiers involved, so re-use of the leaked data reaches you early.

Know the line — if you are being actively targeted (persistent contact, impersonation, threats), that is past a checklist. A human-led investigation maps what an attacker can see and reduces it.

Your Notes

Where to go next

Check if you are affected — Have I Been Pwned (email and phone breach lookup)
US — report identity theft and get a recovery plan — identitytheft.gov (FTC)
US — freeze your credit (free) — Equifax, Experian and TransUnion, plus an IRS Identity Protection PIN at irs.gov
Cut the standing exposure — remove yourself from broker and people-search sites: EU/UK opt-out list · US opt-out list
Read more — Has my data been leaked? and What to do after a data breach

Data breach recovery — FAQ

How do I know if my data has been leaked?

Start with Have I Been Pwned, which lets you check an email or phone number against known breaches. Treat a clean result with care: it indexes stealer-log data only from 2025 and cannot see every breach or paste, so “no results” is not an all-clear. If a service or your device warns you that your password appeared in a data leak, believe it and act.

My password was in a data leak — what should I do first?

Change that password immediately, then change it anywhere you reused it — reuse is what turns one leak into many compromised accounts. Turn on multi-factor authentication, ideally an authenticator app or passkey rather than SMS, and revoke active sessions on the account so anyone holding the old password is logged out.

Can I remove my data from the dark web?

No. Data that has leaked — especially unchangeable data like a Social Security or national ID number, date of birth, or home address — cannot be deleted from the dark web, and any service promising to do so is selling reassurance, not a result. What you can do is reduce the risk it creates: freeze credit, monitor, and cut the standing exposure on people-search and data-broker sites that keeps re-circulating your details.

Should I freeze my credit after a leak?

In the US, yes if financial data or your Social Security number was exposed — a credit freeze is free at all three bureaus (Equifax, Experian, TransUnion) and stops new accounts being opened in your name; report the theft at identitytheft.gov. In the EU and UK there is no direct equivalent, but your bank can advise on protective measures such as Cifas protective registration in the UK.

The breach only exposed my name and email — is that harmless?

No. A name and email are enough to build a convincing phishing or pretext attack, and they become more dangerous combined with data from other breaches. Exposed contact details are the raw material attackers use to reach you with a message that already knows who you are. Treat unexpected contact that quotes real details as a prompt to verify, not to trust.

This checklist is for general information and does not constitute legal or financial advice. For your specific situation, consult a qualified professional. What you type here — the service, date, what was exposed, your reference, notes, and checklist progress — is stored locally in your browser and is never transmitted to our servers.

Being targeted, not just exposed? See how a Lockdown investigation runs →

What to Do If Your Data Has Been Leaked

Step 1: Confirm what was leaked

Step 2: Lock down your accounts

Step 3: If specific data was exposed

Step 4: Cut your standing exposure and stay alert

Step 5: Document and know when to escalate

Where to go next

Where to go next

Data breach recovery — FAQ