You were in a data breach. Here's the calm, correct response

If you use the internet, your data has been in a breach — probably several. A notification is not an emergency by itself; what matters is a calm, ordered response proportional to what was exposed.

Do these first

1. Change the password on the breached account, and on any other account where you reused it.
2. Turn on two-factor authentication there, preferably with an app or hardware key rather than SMS.
3. If payment details were exposed, ask your bank for a new card number and watch statements.
4. If identity details were exposed, ask the credit reporting bodies — Equifax, Experian and illion — to put a ban on your credit report. The OAIC says it's free, lasts 21 days, can be extended, and one body can pass your request on to the other two. IDCARE, the national identity and cyber support service, can help you work out what else to do.

Then slow down

Breach emails often arrive alongside an upsell for monitoring. Monitoring can help, but decide on it deliberately, not under the pressure of the notification. While a credit ban is in place, the OAIC says a lender who asks for your report is told about the ban — which alerts it to possible fraud — and the ban costs nothing.

The goal after a breach is not zero risk, which is unattainable. It is to close the specific door that was opened, quickly and without panic.