What to Do If Your Login Credentials Were Leaked

Login credentials are the information used to identify and authenticate you to an account.

Depending on the service, they can include:

An email address or username generally identifies the account.

The password is intended to prove that the person attempting to log in is authorized.

That difference matters.

An exposed email address alone is not the same as an exposed email-and-password combination.

When both pieces are involved, someone may have enough information to attempt authentication.

It generally means authentication information associated with an account may have become accessible outside the system where it was intended to remain protected.

That can happen through:

The credentials might be current.

They might be old.

They might belong to an account you forgot years ago.

The practical risk depends on whether the exposed information still works.

This gives you the first question to ask:

If yes, replace it.

An email address can help someone identify you or target you.

A working email-and-password combination can potentially help them authenticate.

The FTC explains that scammers and attackers can obtain stolen username-and-password combinations from data breaches and use those credentials in attempts to access accounts.

The risk increases dramatically with password reuse.

A credential exposed through one website may be tested against another.

The second website does not need to have suffered a breach.

Your own password reuse can create the connection.

Credential stuffing is the basic idea of trying credentials obtained from one source against other services.

Imagine that you used:

Email: [you@example.com](mailto:you@example.com) Password: MyPassword123

on an old website.

That website later suffers an exposure.

Someone can potentially try that combination against:

If every account has a unique password, this strategy is much less effective.

If one password is reused everywhere, one exposure can create risk everywhere.

CISA warns that attackers take advantage of passwords reused across systems.

People sometimes hesitate to change a password because they have not seen a successful login.

That reverses the security logic.

The goal is to prevent successful access.

If you know or reasonably believe an active password has been exposed, replacing it removes the opportunity.

You do not need to wait for:

before retiring the credential.

If the exposed password remains active, replace it.

Create a new credential rather than slightly modifying the old one.

Avoid patterns such as:

If someone knows your previous password, predictable transformations may not provide the same protection as an unrelated credential.

For passwords you must still use, NIST currently recommends length as a major factor and highly recommends password managers to generate and store unique passwords.

The simplest approach is to let a password manager create the credential for you.

This is where many breach responses fail.

Changing the password on the breached website does not solve the risk if the same password remains active elsewhere.

Make a list.

Search your password manager or browser-saved credentials if helpful.

Your objective is:

Your primary email may be the highest-priority account in the entire process.

Because email is frequently used for account recovery.

The FTC explains that someone controlling an email account may request password resets for other services, receive the recovery links, change those passwords, and potentially lock the real owner out.

Your email should have:

If the leaked password was reused on your email, fix that immediately.

Changing the password is important.

But someone may already be logged in.

If compromise appears likely, use the service's option to sign out of all other devices.

The FTC recommends signing out all devices after recovering a hacked account so anyone using an existing session is removed.

Someone with account access may change recovery information to make it easier to return later.

The FTC specifically recommends confirming that the recovery email addresses and phone numbers listed on the account are ones you added and still control.

Correct anything unfamiliar.

If an email account may have been compromised, changing the password is not enough.

Someone could have created an automatic rule that forwards messages to another address.

The FTC explicitly recommends looking for unauthorized forwarding rules after email compromise.

This is especially important because forwarded messages may include:

After replacing the password, add another authentication layer.

MFA means possession of the password alone may not be enough for access.

NIST states that MFA can help protect accounts even when a password is compromised.

CISA likewise recommends MFA because it significantly increases the difficulty of account takeover when passwords are stolen through phishing or other methods.

Not all MFA methods provide identical protection.

An authentication method that relies on manually entering a code can still be targeted by sophisticated phishing.

For sensitive accounts, prefer stronger phishing-resistant options when available.

That can include:

The exact options depend on the service.

Do not let perfect authentication become the enemy of better authentication.

If the only available improvement today is standard MFA, enabling it is still generally better than using a password alone.

Passkeys address several weaknesses of passwords.

Passwords can be:

NIST explains that passkeys use unique cryptographic credentials and cannot be stolen through ordinary phishing in the same way as passwords.

This means a future breach involving a password at one service cannot create the same cross-account reuse problem for an account that no longer depends on that reusable password.

You do not need to migrate everything today.

Start with important accounts that already support the technology.

Check the evidence inside your accounts.

The FTC lists unexpected username or password changes, unfamiliar login notifications, and inability to sign in as indicators of possible account compromise.

If you find actual unauthorized access, follow the provider's official recovery process.

Old does not automatically mean harmless.

The correct question is:

Consider three scenarios.

Scenario 1: Old password, completely retired.

The immediate login risk may be low.

The credential no longer works.

Scenario 2: Old password, still used on another account.

You still have a current problem.

Scenario 3: Old email, still used for recovery.

Even if you no longer use the inbox regularly, it may remain important if current accounts depend on it for password recovery.

Update recovery information to addresses you actively control.

Age provides context.

Current usefulness determines risk.

Do not let imperfect memory stop you.

Review saved passwords in:

Then move your current accounts toward unique passwords one at a time.

Even if you never reconstruct every historical account, securing your highest-value accounts removes a large portion of the practical risk.

Usually not simply because they were exposed.

Identifiers are different from authentication secrets.

Changing your email address can create substantial inconvenience while doing little to solve weak authentication.

Focus on making knowledge of the identifier insufficient for access.

A well-protected account can remain secure even when the email address or username is public.

Credential exposure can make phishing more believable.

They can include those real details in a fake security message.

We detected suspicious activity on the account associated with your real username.

The detail is accurate.

The message can still be fraudulent.

CISA advises people to recognize phishing and avoid engaging with alarming messages designed to obtain personal information.

Instead of clicking, type the official website address yourself or use an app you already trust.

Treat the password as compromised even if no exposure checker detects anything.

Go directly to the legitimate service.

The FTC advises people who gave scammers account credentials to create a new password, change it on other accounts where it was reused, and enable two-factor authentication.

Actual phishing exposure is stronger evidence than a negative database result.

That is the best time to act.

You have an opportunity to remove the risk before it turns into account takeover.

Replace the credential.

Remove reuse.

Then move on.

A breach result does not need to become a crisis if the information it exposed no longer works.

No checker can guarantee complete visibility into every security incident.

Credentials can also be stolen through:

Interpret:

as exactly that.

Do not interpret it as:

Your account-security habits should remain strong regardless of the result.

4safer is intended to help answer the question that matters after credential exposure:

A useful result should lead toward action without unnecessarily displaying raw leaked credentials.

If your login credentials may have been leaked: