Treat a password that appeared in a leak or breach as exposed immediately. Do not wait for suspicious activity before acting. This guide provides a practical recovery order, but it does not replace the service provider’s instructions or an employer’s incident-response process.
1. Start with the accounts that have the widest impact
This article’s editorial recommendation is to start with email, then your password manager, followed by financial, work, administrator, cloud-storage, and social-media accounts. Email deserves special priority because an attacker may use password-reset links delivered there to try to take over other accounts. The FTC describes the risk of using an email account to recover other accounts.
If the same password, or a similar version of it, was used elsewhere, replace it on those services too. The FTC advises changing an exposed password and reused or similar passwords on other services. Changing one service’s password does not by itself protect the other accounts.
2. Open the service yourself
Do not click an unexpected recovery or support link in an email, text, or message. Open the provider’s official website or app yourself, then use its recovery instructions. This is a protective instruction in this guide to reduce phishing risk, consistent with NIST material discussing passwords, authentication, and phishing. See NIST’s guidance on passwords and phishing-resistant authentication.
Never disclose a verification code to a caller or message sender. Enter it only into the official sign-in page or app that you opened yourself. The FTC warns against sharing verification codes with someone who asks for one unexpectedly.
3. Check the device if takeover is possible
If the account may already have been hijacked, update security software, scan the device, and follow the provider’s official recovery process. The FTC includes updating security software, scanning the device, and using the provider’s recovery process among its recovery steps.
If malware, remote access, or device compromise is suspected, this guide’s design recommendation is to use a trusted, clean device if one is available rather than relying only on a scan of the possibly compromised device. This is a practical precaution to test against the provider’s instructions; it is not presented as a guarantee that the device is clean.
4. Give special attention to your password manager
If the exposed password was your password-manager master password, treat the vault as potentially at risk. Secure the manager through its official recovery process, enable multi-factor authentication, and prioritize changing credentials for email, financial, administrator, and other high-impact accounts. This is a conservative editorial sequence, not proof that the vault was accessed.
A password manager can generate and store long, complex, unique passwords. NIST describes these password-manager functions in its guidance. When a password must be created manually, NIST recommends at least 15 characters. The same NIST source gives the at-least-15-character guidance for that situation.
5. After recovery, look for ways access could continue
Changing a password is important, but it does not necessarily review the account’s other settings. After regaining access, use this sequence:
- Sign out all devices and sessions.
- Check the recovery email addresses and phone numbers.
- Remove email-forwarding rules you do not recognize.
- Review sent and deleted messages for unexpected activity.
- Warn contacts if suspicious messages were sent from the account.
The FTC recommends these checks after recovering a hacked email or social-media account. This article’s editorial recommendation is to complete them before returning to normal use, while preserving information that may be needed for a report or investigation.
6. Add multi-factor authentication
Multi-factor authentication (MFA) adds a second barrier after a password is compromised. NIST describes MFA as a second barrier after password compromise. Enable it on sensitive accounts and wherever the service supports it, starting with email, your password manager, financial accounts, and administrator accounts.
NIST says authenticator apps, passkeys, and security keys are generally stronger choices than SMS-based codes, and recommends phishing-resistant authenticators for sensitive accounts where available. See NIST’s terminology and authentication guidance. If only another MFA option is available, using MFA is still safer than password-only access under NIST’s guidance for sensitive accounts. NIST recommends MFA for sensitive accounts.
7. Work accounts and financial or identity information
For employer, administrator, or shared business accounts, follow the organization’s incident-response process and notify IT or the security administrator before changing shared credentials or deleting evidence, unless immediate account protection is necessary. This is an operational rule proposed by this guide, not a universal policy stated by the supplied sources.
If unauthorized transactions or visible identity misuse already exist, contact the bank, card issuer, or relevant official identity-theft service promptly. Exposure alone does not prove fraud, so monitor accounts, keep records, and follow the appropriate official guidance. This cautious wording reflects the scope of the supplied research and is not a diagnosis of your situation.
Quick recovery checklist
- Start with email, your password manager, and high-impact accounts.
- Change the leaked password and every reused or similar password.
- Use the official website or app that you opened yourself.
- Never share a verification code; enter it only into an official page or app you opened yourself.
- Scan the device, and use a trusted device if malware or remote access is suspected.
- End sessions and review recovery settings, forwarding rules, and messages.
- Enable MFA and choose a phishing-resistant method when available.
- Notify your employer, bank, or relevant official service when there are actual warning signs.
In summary
Safe recovery is an ordered process: replace credentials, check for device compromise, close sessions, review recovery settings and account activity, then add MFA and monitor for follow-on activity. Do not give verification codes to callers or message senders, and do not use an unexpected link to reach account recovery.