A site you used got breached
What a leaked password is actually worth to somebody, and the order to fix things in when you cannot fix everything today.
- Who this is for
- You have been told — by a notification, a news story, or a friend — that a service you had an account with has leaked its users' details, and you are not sure what that means for the rest of your accounts.
- What it protects against
- Somebody taking the password from that breach and trying it everywhere else, which is the most common way an ordinary person loses an account and needs no skill at all.
- What it does not protect against
- This does not help if somebody is already inside an account — if you can see logins you did not make, or mail you did not send, stop and go through that service's own account-recovery process first. It also does not address targeted attacks on you specifically, or anyone who can intercept a code sent to your phone number.
- One Password, Every DoorWhy one leaked password is rarely one account.3 min
- A Second Lock on the DoorThe thing that makes a stolen password not enough on its own.4 min
- The Account You ForgotThe one you cannot remember signing up for is usually the one that leaked.3 min
Do this first
Change the password on your email account first, before anything else, and turn on two-factor there. Email is the account that can reset all the others, which makes it the one worth an evening.
Not yet reviewed