TL;DR: Breach notifications mean your password hash or plaintext appeared in a leak dataset—not always that criminals logged into your account yet. Rotate the affected password first, then unique passwords anywhere you reused it. Generate replacements on Strong Random Password and store them in a manager before closing the tab.
Decode the email without panic scrolling
Legitimate alerts name the service, approximate incident date, and data types exposed. They link to an official domain, not a shortened mystery URL. Phishing mimics the same template—open the site yourself instead of clicking if tone feels urgent and sloppy.
“Password” in the breach list triggers rotation. “Email only” might mean watch for phishing, not necessarily change banking passwords unless reused.
Priority order that saves time
Change the breached service password immediately—long random string, never reused. Next, hunt reuse: email providers, banking, work SSO, and shopping sites where you lazily copied the same combo. Those rotations matter more than changing a forum account you forgot existed.
Enable multi-factor authentication on email and financial accounts before attackers password-reset through your inbox.
When the site forces logout everywhere
Some platforms invalidate sessions after incidents. Expect to sign in again on phones and TVs. Have the new password in your manager first so you are not locked out mid-flow on a smart speaker.
Generate before you submit forms
Classic lockout: generate a strong password, paste into the change form, submit before saving anywhere, browser crashes. Copy to manager, verify sync, then submit. Password generators in tabs disappear when closed.
Length beats clever symbols for online guessing attacks. Use twenty or more characters when the site allows; passphrases work when length caps are huge but symbol rules are picky.
Check have-i-been-pwned habits responsibly
Monitoring services hash your email for matches—they do not need your password to warn you. Combine alerts with local manager breach scans if your vault vendor offers them. Duplicate warnings mean the same leak, not a second hack.
Work and shared accounts
Shared Netflix-era passwords die hard. Breach emails are the excuse to split credentials. Each human gets a login; shared vault collections hold household streaming if needed.
Employers may force SSO resets separately. Personal breach rotation does not replace IT mandates when corporate IdP keys leaked.
Credit monitoring noise versus credential risk
Free credit freezes help identity theft from SSN leaks—a different playbook than password rotation. Do both when the letter lists SSN and password, but do not substitute credit monitoring for fixing reuse.
Document what you changed
Manager tags like rotated-2026-breach help audits. Note date and incident name so future you knows why that entry looks newer than neighbors.
- Done: primary email, bank, breached retailer.
- Pending: low-value forums you still care about.
- Skip: throwaway accounts with unique passwords already.
Hardware security keys after rotation
After major password changes, re-register FIDO keys if the service prompts. Some platforms treat new passwords as a trust reset and nag for second-factor re-enrollment. Do that before travel so airport Wi‑Fi is not where you discover locked recovery options.
Backup codes printed years ago may be consumed during rotation—generate a fresh set once primary passwords and MFA are stable.
Kids and family accounts
Parent emails anchor child gaming accounts. Rotate parent first, then child unique passwords where platforms allow separate logins. Family managers should review console backup codes after major rotations.
Passkeys and social login caveats
Password reuse lists in breach dumps are sorted by frequency—attackers try top sites first. Rotating banking and email before obscure forums is rational triage, not favoritism.
Sites where you “Sign in with Google” still matter when the breached service stored OAuth tokens or recovery emails. Rotate the email password and review connected apps in provider security dashboards. Passkeys reduce password reuse risk but do not eliminate account recovery email compromise.
Breach mail is a to-do list, not a verdict that funds vanished. Act on reuse first, automate storage second, and treat every new login as a chance to stop recycling secrets. When you need a fresh high-entropy string under time pressure, use Strong Random Password and let the manager remember what humans should not.
Schedule a twenty-minute block on your calendar the day breach mail arrives so rotation happens before fatigue pushes it to “later.”
List every site where that password lived in your manager’s reuse report before you delete the old entry—orphan accounts hide on old phones and forgotten trial subscriptions.
If the breached site offers forced logout of all sessions, use that button after the new password saves so stolen cookies die on the server side too.
Watch for follow-up phishing that cites the same breach with fake reset links—the real work already finished in your manager.