You were in a data breach. Here's the calm, correct response

If you use the internet, your data has been in a breach — probably several. A notification is not an emergency by itself; what matters is a calm, ordered response proportional to what was exposed.

Do these first

1. Change the password on the breached account, and on any other account where you reused it.
2. Turn on two-factor authentication there, preferably with an app or hardware key rather than SMS.
3. If payment details were exposed, ask your bank for a new card number and watch statements.
4. If identity details were exposed, ask Canada's two credit bureaus, Equifax and TransUnion, to place a fraud alert on your credit report, so lenders must confirm it's you before approving credit. In Ontario and Quebec you can also place a security freeze — Ontario says it's free, and you must contact each bureau separately.

Then slow down

Breach emails often arrive alongside an upsell for monitoring. Monitoring can help, but decide on it deliberately, not under the pressure of the notification. A fraud alert or freeze costs little or nothing, and if someone has already used your details, the FCAC's advice is to report it to your bank, the credit bureaus, your local police and the Canadian Anti-Fraud Centre.

The goal after a breach is not zero risk, which is unattainable. It is to close the specific door that was opened, quickly and without panic.