What to do after a breach
A calm, practical checklist: change passwords, turn on two-step verification, check for malware and watch your credit.
Being in a breach is common and fixable. Work through these in order; most take a few minutes.
1. Change the password
Change it on the site that was breached, and anywhere you reused it. Use a password manager so every password is unique. To check whether a password has leaked, use the Password check in the Toolkit.
2. Turn on two-step verification
Use a passkey or an authenticator app. Use text messages only if nothing else is offered. The Account lockdown checklists walk you through popular services.
3. Check your recovery details
Make sure the recovery email and phone on the account are still yours, sign out devices you don’t recognize, and remove forwarding rules or apps you didn’t add.
4. If it was an infostealer log
Run a full malware scan on every device you sign in from, update your system, then change passwords from a clean device. Sign out of all sessions on important accounts.
5. If financial or ID details leaked
- In Canada, you can ask Equifax Canada for a fraud alert and report fraud to the Canadian Anti-Fraud Centre.
- In the US, freeze your credit with Equifax, Experian and TransUnion, check your reports at AnnualCreditReport.com, and report identity theft at IdentityTheft.gov.
6. Watch for phishing
Breached emails attract scam messages that mention the breach. Frame will never ask for your password, codes or ID by email.
Was this guide helpful?
Your answer isn’t stored or sent anywhere.
Still stuck? Contact us or check system status.