How to take back control after your data was breached

So, your data was leaked by hackers. Well, you’re not the only one. We live in an era in which data breaches are a daily occurrence. And that’s both bad and good news. It’s bad for obvious reasons—no one wants to have their personal information exposed.

But here’s why it could be good news—it means the digital landscape is saturated with terabytes of data, leaving each individual data point nearly worthless. The rise of data brokers—companies that legally aggregate hundreds or thousands of data points to create a profile on you—is a result of this phenomenon. This means that, while data breaches are indeed bad news, taking down a majority of your exposed data is simple if you know where to look, or which provider to use that can legally remove aggregated profiling information from large databases.

Once your data finds its way into one of these datadumps (that is, files containing breached information), there are some things you can do yourself to safeguard your data and some services that can be done for you to remove that data from the largest profiling databases out there.

Let’s dive in!

How to take back control after a data leak

Here’s a quick overview of the steps you should take to protect your data after it’s breached. It’s best to follow them in the order presented.

1. Change passwords: Immediately change the password for the affected account and any others using the same credentials.
2. Freeze your credit: If the breach involves more sensitive data like your SSN, full name, or address, freeze your credit with one of the main credit bureaus.
3. Set up MFA: Enable multi-factor authentication for your important accounts and, ideally, all online accounts.
4. Remove your personal information from data brokers: Having your data breached is one issue, but it being shared is another. Sign up for a data removal service to prevent your information from spreading online.
5. Monitor your accounts for signs of identity theft: The consequences of a data breach aren’t always immediate; identity theft can occur months later. To prevent this, regularly monitor your banking, credit, and Social Security accounts.

Now, let’s get into more detail.

Change your passwords

Statistics indicate that two-thirds of Americans use the same password across multiple accounts. Nearly half prefer easy-to-remember passwords over hard-to-crack passwords. The consequence?

If you’re among either of those groups, once your password gets leaked, it exposes your other accounts as well.

That’s especially true if you reuse your passwords, but people who use similarly structured passwords aren’t safe either.

For your own safety, update your passwords:

• On the platform where the breach happened
• On all other accounts that use the same or similar passwords.

Come up with unique combinations, preferably 14 characters long.

And yeah, we get you—Remembering unique, 14-character-long passwords for each account becomes a titanic act, probably not within reach of us mere mortals. Only, you don’t have to do it yourself. There are tons of password managers you can use to boost your security and organize your passwords.

See our top password managers for 2025.

Freeze your credit

People whose personal information was used by fraudsters to open new accounts suffered over $3K in losses on average.

When you combine it with the instances where fraudsters took out loans or breached credit card information, that number grows even further.

And it’s easier than you might think.

Take credit cards, for example. Some banks ask for only the following information to submit a request for a new credit card:

• Full name
• Birth date
• Social Security number
• Address
• Annual income
• Current employer

The Real Estate Wealth Network data breach from 2023 exposed five out of six data points listed above—in just a single incident. Fraudsters could take out lines of credit in your name, without you even knowing.

To prevent anyone from taking out lines of credit in your name, freeze your credit reports at all three bureaus.

You can do it for free online:

Enable multi-factor authentication

Passwords aren’t enough. Especially if you don’t have an appetite for unique, 14-character-long ones.

The good news is that you can improve your accounts’ security by a wide margin with multi-factor authentication (MFA) methods.

The Cybersecurity & Infrastructure Security Agency (CISA) states that the “use of MFA on your accounts makes you 99% less likely to be hacked.”

The idea behind MFA is simple and you’ve likely come across it before.

Here’s how it works: After entering your password, you’re asked to confirm your identity by a different measure—typing in a code received via email, for example. It’s the second factor in the authentication process.

It usually stops here, making it two-factor authentication (2FA), but it could go further, adding a third and even fourth layer—making it a truly multi-factor.

Learn more about MFA and how to use it.

Remove your personal information from data brokers

Here’s the thing about data breaches—a data breach is a singular incident, a one-time thing. Hackers get access to databases and expose them.

Our attention revolves mostly around that incident. We change our passwords, freeze our credit, and, after a while, forget about the whole affair.

But the leaked data is still circulating the web.

From one dark web forum to another, it passes through many, often shady, hands, potentially landing among the records of data brokers.

Data brokers are companies that buy and sell personal information to make a profit. It’s similar to stock brokers. Only, instead of buying and selling corporate shares, data brokers buy and sell your:

• Names
• Birth date
• Phone numbers
• Email addresses
• Current and past addresses
• Owned properties
• Current and past employers
• Pulic records
• Relatives
• …and more

With each data breach, your profile builds up.

As a result, you may be targeted by identity thieves long after the initial data breach took place.

Here’s the good news, though—you can sign up for a data removal service, like Incogni, and have your personal information removed from hundreds of data brokers.

There are a few good removal services available for US citizens, like Kanary and Optery, but what really sets Incogni apart is that they target both private and public data brokers, while most others only focus on the public ones. Incogni is also the only data-removal service to undergo third-party review by Deloitte to verify its claims.

The private databases, which are traded behind closed doors, are the ones that really impact your privacy. And Incogni is one of the few services that actually tackles those. But the good news doesn’t stop there.

Incogni makes protecting your personal info a walk in a park. Incogni covers 420+ data brokers with its automatic removals within the standard plan.

Incogni has also introduced the Unlimited version with unlimited custom removals available right away upon purchasing the plan. It allows users to submit websites not yet covered by Incogni and get their data removed from there, too.

Incogni has now processed custom removals from over 1,000 unique sites not covered in the standard database. These are handled by Incogni’s security agents, and users can submit as many custom removal requests as they want.

After that you can sit back and focus on what really matters. Incogni will keep reaching out to all the data brokers in their network on a regular basis to make sure your personal info doesn’t end up back in their databases.

Monitor your accounts for signs of identity theft

“Identity theft is no joke, Jim!”—teaches us Dwight from The Office.

And with nearly a third of Americans already affected by some form of it, it indeed is not a joke.

10% of identity theft victims realize something is wrong only when their money is gone. That’s far too late.

Instead, monitor your key accounts—like banking, credit, and Social Security—regularly.

Keep a close eye on your:

• Bank statements for any anomalies.
• Credit reports for unsolicited activity.
• Social Security account for unrecognized actions.
• Mail for suspicious letters, even if not addressed to you.
• Email for any unintended updates to your accounts, especially new accounts.