What to Do If Your Password Has Been Leaked

Published 2026-11-03

What to do first if your password may have been leaked

If you suspect a password got leaked, change it right away on that account. If you reused it anywhere else, update those too. The FTC’s guidance on strong, unique passwords and CISA’s advice to respond quickly after a suspected compromise both point to the same boring truth: one leaked password should not get to ruin the whole neighborhood.

Secure the account from being used again

Turn on multi-factor authentication if the service offers it. CISA and the FTC both recommend MFA because it adds a second layer, which makes reused credentials much less useful.

Then sign out of other sessions, remove remembered devices, and review recovery options. CISA and NCSC guidance both stress cleanup after account compromise, because a leaked password is only half the problem if an attacker is still logged in somewhere or can quietly use recovery settings to get back in.

Check whether the breach reached business email or connected services

If the leaked password belongs to a business email account, check for signs that the account was altered. Look for new forwarding addresses, changed email rules, and recovery settings you do not recognize. CISA and NCSC guidance on account compromise checks both point to this kind of cleanup, since attackers often use email control to stay inside the account and watch for resets on other services.

If that email address is tied to payroll, bookkeeping, or any other connected service, assume the blast radius may be wider than the one inbox. Email is often the master key. Annoying design choice, but here we are.

Worked example: a small business owner finds one employee reused a leaked password on email and a bookkeeping login

Say a small business owner learns that one employee reused a leaked password for both email and a bookkeeping login.

First, reset the email password. Then turn on MFA for the email account, if it is available. After that, check for unauthorized forwarding rules, strange inbox filters, recovery email changes, and unfamiliar sessions or devices.

Next, reset the bookkeeping password. If that same password was reused on any other accounts, reset those too. Email comes first because it can be used to reset other services, so leaving email open is basically handing the attacker a reset button with a smiley face on it.

This matters a lot for small businesses without IT staff. One exposed password can turn into a wider account takeover if the email account stays open, because email is often where resets, alerts, and account recovery all go.

What to do if there are signs of unauthorized activity

If you see suspicious logins, unexpected messages, payment changes, or new users, document what you found. Save the dates, account names, and anything that looks off. Then follow the service’s incident steps and contact the affected provider or bank support if money or customer data may be involved. FTC and CISA incident-response advice both support this kind of fast, documented response.

Prevent a repeat leak

Replace reused passwords with unique ones. The FTC’s basics for password hygiene are simple for a reason, and they still work.

If the business can manage it, use a password manager so unique passwords are less painful to keep track of. Keep a simple list of critical accounts too, so future resets are not a scavenger hunt. That fits with CISA and NIST-style account security practices, which favor practical controls over heroic memory.

For a stronger second layer after cleanup, see What are phishing-resistant MFA methods?. It helps you choose MFA that is harder for attackers to reuse.

For the broader basics to put back in place after the mess, see What cybersecurity basics does the FTC recommend for small businesses?. It covers the core protections that make this kind of cleanup less dramatic next time.