All incidents
My password may have been stolen
You typed a password into a page that turned out to be fake, or you were notified that a service you use had a data breach. Either way, that password should now be treated as compromised.
Do this now
- Change the password on the affected account right away, using a strong, unique password.
- If you use that same password anywhere else, change it there too — reused passwords are one of the most common ways accounts get taken over.
- Turn on multi-factor authentication (MFA) if it isn't already enabled.
Then do this
- Check the account's active sessions or login history for anything unfamiliar.
- Use our Password Generator to create strong, unique passwords going forward.
Check these things
- Is this password reused on other accounts, especially email or banking?
- Does the account show any unfamiliar recent activity?
Don't do this
- Don't reuse the same compromised password with small changes like adding a number.
- Don't ignore breach notification emails from services you use.
When should I get help?
- Contact the service directly if you can't regain access to the account.
- Contact your bank if the password was for online banking.