Start with the information that was exposed
Before changing everything, identify the service involved and the data types listed in the finding. An exposed email address creates a different risk from an exposed password, phone number, home address or payment record.
Keep a short private note of the source, date and affected account. Do not circulate screenshots containing raw personal details. If the information came from a company notification, keep the original message and verify it through the company’s official website rather than clicking unexpected links.
The priority order
- Secure your email account. Change a reused or weak password, review recovery details and enable two-step verification.
- Secure the affected service. Sign in through its official app or website, change the password and sign out unfamiliar devices.
- Find reused passwords. Update every account that shared the same or similar credentials.
- Protect high-value accounts. Check banking, shopping, cloud storage and social media even if they were not named in the breach.
- Watch for follow-on scams. Treat urgent calls or messages using your personal details with caution.
If money has moved, an account has been taken over or identity documents are being misused, contact the relevant provider immediately and use the official UK reporting route appropriate to the incident.
Check the account, not just the password
A password change is important, but it is not the whole review. Look for unfamiliar sign-in locations, new recovery addresses, email forwarding rules, trusted devices, connected apps and recent security alerts.
- Remove devices or sessions you do not recognise.
- Replace recovery details that are no longer yours.
- Review mailbox forwarding and filtering rules.
- Revoke unfamiliar third-party app access.
- Store a new, unique password in a trusted password manager.
Handle exposed phone numbers and addresses
A phone number can be used to make a scam feel personal. Never share a verification code with a caller, even if they know your name, account provider or part of your address. If a mobile service unexpectedly stops working, contact the network using a trusted number.
For a public address or profile, identify the organisation controlling the page. Use its privacy contact or opt-out route and keep a written copy of your request. In the UK, the right to erasure can apply in some circumstances, but it is not absolute and organisations may have a lawful reason to retain information.
Recheck after taking action
Removal and account changes are not always reflected immediately. Keep the date of each request, the response deadline and any reply. Revisit the source later to confirm whether the information has changed, and retain evidence if you need to complain.