Should You Change Your Password After a Data Breach?

The short answer: yes, but context matters

When a service you use announces a data breach, your instinct to change your password is correct — but the urgency and scope depend on what was actually breached. A breach of email addresses with no passwords is different from a breach of hashed passwords, which is different from a breach of plaintext credentials. Understanding the difference helps you prioritise correctly when multiple accounts are at risk simultaneously.

Classifying the breach: what was actually exposed

Email addresses only: your address is now in spam and phishing lists. Change nothing immediately, but increase vigilance about phishing emails. Hashed passwords (SHA-1, MD5): change your password immediately. Weak hashing algorithms are crackable, and your password may be recovered within hours if it was weak or common. Modern hashing (bcrypt, Argon2): still change your password, but the urgency is lower — a well-hashed password with a strong original is not crackable in any reasonable timeframe. Salted hash with unknown algorithm: treat as moderate urgency and change within the week. Plaintext passwords: change immediately and also change any accounts where you reused that password. This is the most severe category.

If you used the same password elsewhere: act immediately

A breach at one service becomes a threat to multiple accounts if you reused the password. The attacker's next step after obtaining credentials is credential stuffing — testing the stolen email/password pair against many other popular services. This is automated and can begin quickly once credentials circulate. Your priority: identify every service where you used the same or similar password and change all of them. If you do not know which accounts share the password (a sign that a password manager is needed), change your email password first (email is the recovery mechanism for everything else), then banking, then everything else.

What to change beyond the password

Changing the password is necessary but sometimes insufficient. If the breach included security question answers: change security questions or switch to random-string answers. If personal information was exposed (phone number, address, partial payment information): be alert for social engineering using that information. Review the account for any changes made since the breach — email forwarding rules added, recovery email changed, connected apps added. Enable MFA if you have not already. Consider whether the compromised account is used as a "sign in with" option for other services — those services inherit the compromise.

The right order of operations

1. Change the breached password first. 2. Identify accounts with the same or similar password and change them in order of importance: email, banking, work accounts, other financial, everything else. 3. Enable MFA on the breached account and on any account you just changed. 4. Check for Have I Been Pwned breach data to see if this breach has appeared there yet (it may take time to appear, and not every breach is added). 5. Register for breach notifications so future breaches notify you immediately. 6. Review account activity logs where available. 7. For severe breaches (plaintext passwords, personal data): consider whether identity protection monitoring is warranted.

Proactive preparation: why breach response is easier with a password manager

Without a password manager, a breach response requires remembering which services share the breached password — often impossible to do accurately. With a password manager, you can search for any accounts using the same domain or that share the breached password, change them systematically, and generate strong unique replacements. Many password managers (Bitwarden Premium, 1Password, Dashlane) include breach monitoring that flags when any stored credential appears in a known breach, removing the need to manually check each service. Set this up before the next breach — not after.

Beware of scams that follow a breach

Breach news is a favourite lure for phishing. Criminals send emails or texts that look like official notices from the affected service and urge you to click a link to reset your password. Do not use links in unexpected messages: open the service by typing its address or using a saved bookmark, and change the password there. If a message quotes one of your old passwords and claims to have recorded you or hacked your devices, it is almost always a bluff built from old breach data — but treat it as a prompt to change that password anywhere you still use it, and never pay or reply.