7 Common Mistakes People Make After a Data Breach

Most people learn they've been caught up in a data breach the same way: an email they didn't ask for, arriving at a moment when they're busy with something else. The subject line mentions a "security incident." The body is vague. The fine print runs three paragraphs. So the message gets skimmed, filed, and forgotten.

That's mistake number one, and it's a mild one on its own. The real trouble starts with what people do — and don't do — in the following days. These are the seven errors that come up again and again, and what to do instead.

1. Reading the notification once and filing it away

Breach notices are written by lawyers as much as by security teams, which is why they tend to bury the useful part. Read it twice and pull out three things: what categories of data were involved, the rough date range of the exposure, and what the company is offering (usually identity monitoring, sometimes nothing).

Keep the email. If you later need to prove when you were notified — for a credit dispute, an insurance claim, or a fraud investigation — that message is your timestamp. And check whether it landed in an inbox you stopped using years ago; companies often send notices to whatever address was on file, which is frequently dormant.

2. Changing the leaked password but leaving the copy everywhere else

This is the big one. A password that appears in a breach dump gets tried against hundreds of other services within hours, by automated tools that never sleep. If the password you just changed for one site is still securing your email, your bank, and your favorite shopping account, you've accomplished almost nothing.

Work through it in this order:

1. Change the password on the breached account.
2. Change it on every account that used the same or a similar password. Start with your primary email, because that's the reset route for everything else.
3. Turn on two-factor authentication. An authenticator app or a hardware key beats a text message, which can be intercepted through SIM swapping.
4. Log out of all active sessions if the service offers that option. A changed password doesn't always kick out a device that's already signed in.
5. Save the new credentials in a password manager, so the next password is random and you're not tempted to recycle an old one.

If you're still typing the same password into a dozen sites, the breach isn't your problem. The reuse is.

3. Assuming it doesn't matter because no card number leaked

Payment card data is the loudest item in a breach notice and often the least dangerous, because card issuers are good at catching fraud and you're not liable for charges you report. A name, address, phone number, and email address is a quieter and more useful combination for an attacker. That set is enough to open accounts, impersonate you to a support agent, or build a convincing phishing message that references details only "your bank" would know.

Breached data also gets combined with data from other breaches. A leak from five years ago fills in the blanks for one from last month. Watch for password reset emails you didn't request, sign-in alerts from unfamiliar locations, mail addressed to accounts you never opened, and changes on your credit report.

4. Postponing the credit freeze

A credit freeze is the single most effective step most people skip, usually because they assume it's complicated or costs money. In the United States, freezes are free by federal law, they don't affect your credit score, and you can lift them temporarily when you actually need to apply for credit. It takes a few minutes per bureau, online or by phone.

Don't confuse the three options:

• Freeze — blocks new creditors from seeing your file. Strongest protection, requires you to unfreeze before applying for credit.
• Fraud alert — a note on your file asking lenders to verify identity. Free, temporary, weaker.
• Credit lock — a product offered by bureaus, sometimes paid. Similar effect to a freeze, different legal footing.

If a government ID number was exposed, ask your tax authority what extra step they offer. In the US, that's an Identity Protection PIN from the IRS, which stops someone filing a return in your name. Rules vary by country, so check your national consumer protection body for the local version of a freeze. For anything with money or identity documents attached, it's worth a conversation with a financial or legal professional who knows your situation.

5. Trusting the follow-up email

The predictable sequel to any large breach is a wave of phishing that impersonates the breached company. The message looks official, uses the real logo, and asks you to "confirm your identity," "reset your password to stay protected," or "claim your free monitoring" by entering your card details.

If a message wants you to click, log in, or pay, close it and type the company's address into your browser yourself.

No legitimate breach notification requires your password by email. Ever.

6. Fixing the account and ignoring the recovery path

People change the password and stop there, leaving the attacker a back door. Open your account settings and check the recovery email and phone number — if either was altered, you'll lose access at the worst possible moment. Then look at forwarding rules and filters in your email. Attackers add a rule that quietly copies password reset messages to an address they control while hiding them from your inbox.

While you're in there: review connected third-party apps, revoke access for anything you don't recognize, and remove old devices still listed as signed in. If someone in your household shares your accounts, tell them the password changed rather than letting them lock the account with failed attempts.

7. Leaving the clean-up vague

"I'll deal with it this weekend" is how breaches turn into identity theft. Specific tasks get done; intentions don't. Write down which accounts you've secured, which still need attention, and the date you froze or unfroze your credit. A note on your phone is enough.

Your first hour, in order

1. Find the notification and note what data was involved.
2. Change the password on that account and on every account that shared it.
3. Turn on two-factor authentication for your email and your bank.
4. Freeze your credit at all applicable bureaus.
5. Check recovery email, phone number, and forwarding rules in your inbox.
6. Tell the people who share your accounts, and write down what you did.

None of this is glamorous, and most of it takes less time than the average lunch break. The point isn't to undo the breach — that already happened. It's to make sure the leaked data is the last thing an attacker can use.

Photo: Anna Tarazevich / Pexels