Breaches & Recovery
Data breaches happen. Learn how to recognise exposure, protect compromised accounts and prepare for recovery before something goes wrong.
What is a data breach?
A data breach occurs when information is accessed, disclosed or exposed without authorisation.
Breaches can affect businesses, public organisations and online services. The exposed information varies between incidents.
A company reporting a breach doesn't automatically mean criminals have accessed your particular account. Check what information was affected.
Has your email appeared in a breach?
Have I Been Pwned is a service that allows people to check whether an email address appears in its database of known breaches.
Visit the official website:
Enter an email address you own and review any reported incidents.
Not appearing in its results doesn't guarantee that your information has never been exposed. Not every breach is discovered or included.
Never enter your account password into an unfamiliar website claiming to check for breaches.
What if your password was exposed?
If you discover that a password may have been compromised, act promptly.
Someone controlling your email may be able to reset passwords for other services you use.
What if someone accesses your account?
Warning signs can include unfamiliar sign-in notifications, unexpected password-reset emails or messages you didn't send.
If you can still access the account, change its password, review recovery details and revoke unfamiliar sessions.
Use the service's official account recovery process. Avoid people advertising paid account recovery through unsolicited messages.
Check whether attackers added forwarding rules, unfamiliar recovery addresses or other ways to regain access.
What if your payment details are exposed?
Contact your bank or card provider promptly using its official app, website or the number on your card.
Never transfer money to a supposed safe account because someone claiming to represent your bank tells you to.
When personal information is exposed.
Names, addresses, dates of birth and other personal details can help criminals create convincing scams.
Be particularly cautious about unexpected calls, emails and messages that refer to genuine personal details.
Someone knowing your name, address or account provider doesn't prove they're legitimate.
Where can you get help in the UK?
Use official reporting channels appropriate to the incident.
Make recovery easier.
Good preparation can turn a serious incident into a manageable inconvenience.
Your account recovery checklist.
Spend ten minutes checking your most important online account.
You cannot prevent every company from suffering a breach. You can, however, reduce the damage by securing your accounts and preparing for recovery.
You've completed Protect Yourself!
You've explored passwords, phishing, device security, online privacy, public Wi-Fi, VPNs and data breaches.
Put what you've learned into practice and revisit these guides whenever you need a refresher.