You were in a data breach. Here's the calm, correct response

If you use the internet, your data has been in a breach — probably several. A notification is not an emergency by itself; what matters is a calm, ordered response proportional to what was exposed.

Do these first

1. Change the password on the breached account, and on any other account where you reused it.
2. Turn on two-factor authentication there, preferably with an app or hardware key rather than SMS.
3. If payment details were exposed, ask your bank for a new card number and watch statements.
4. If identity details were exposed, check your credit file — the ICO says a statutory copy is free from Equifax, Experian or TransUnion — and consider Cifas Protective Registration, which flags your name so lenders run extra checks (£30 for two years, according to Cifas).

Then slow down

Breach emails often arrive alongside an upsell for monitoring. Monitoring can help, but decide on it deliberately, not under the pressure of the notification. A free look at your credit file shows whether anyone has already applied for credit in your name — and if they have, the ICO's advice is to contact the lender's fraud team and report it to Report Fraud (Police Scotland on 101 in Scotland).

The goal after a breach is not zero risk, which is unattainable. It is to close the specific door that was opened, quickly and without panic.