You were in a data breach. Here's the calm, correct response

If you use the internet, your data has been in a breach — probably several. A notification is not an emergency by itself; what matters is a calm, ordered response proportional to what was exposed.

Do these first

1. Change the password on the breached account, and on any other account where you reused it.
2. Turn on two-factor authentication there, preferably with an app or hardware key rather than SMS.
3. If payment details were exposed, ask your bank for a new card number and watch statements.
4. If identity details were exposed, watch for credit taken out in your name. Bank Negara Malaysia says eCCRIS gives you your CCRIS report for free — your financing and repayment history over the past 12 months — and lets you ask lenders to correct mistakes. If your MyKad was stolen, the National Registration Department replaces it at any JPN office and asks for a police report.

Then slow down

Breach emails often arrive alongside an upsell for monitoring. Monitoring can help, but decide on it deliberately, not under the pressure of the notification. Scammers also use breach news as a pretext: the NSRC never calls or messages anyone, and if you find a bank account opened in your name without your consent, a Bank Negara Malaysia officer quoted by Bernama advises complaining to that bank.

The goal after a breach is not zero risk, which is unattainable. It is to close the specific door that was opened, quickly and without panic.