My password showed up in a data breach

What it means

When a website is breached, its list of email addresses and passwords is often sold or published. Criminals then try those combinations on other sites, such as email, banking and Microsoft 365, betting that people reused them. This is called credential stuffing, and it is automated.

The breached site may have nothing to do with work. If the same password is used anywhere else, every one of those accounts is at risk.

What to do today

1. Change the password on the breached site, if you still use it.
2. Change it everywhere else you used the same or a similar password. Start with email, because email can reset everything else.
3. Turn on multi-factor authentication wherever it is offered.
4. For work accounts, tell your IT provider, even if you think you never used the password at work. They can check sign-ins and require a reset.
5. Watch for phishing. Breached data often includes names and other details that make scam emails more convincing.

Stop it happening again

Use a password manager, give each account its own password, and the next breach will only affect one account.