Getting a message that your personal information was exposed in a data breach is unsettling. Your first thought might be, “What can someone do with my details?” Your second might be, “Where do I even start?”

The good news is that you can take practical steps today to reduce the risk. A breach does not automatically mean someone has taken over your accounts, but it does mean you should treat your exposed information seriously—especially if your email address, phone number, password, identity documents or financial details were involved.

The OAIC received 1,205 data breach notifications in 2025—an 8% increase on 2024 and the highest annual total since Australia’s Notifiable Data Breaches scheme began.
Data Breach in Australia

Here are 10 sensible steps to protect your accounts after a breach.

Confirm that the breach message is genuine

Before clicking anything, check that the notification is real. Scammers often take advantage of a widely reported breach by sending fake “your account has been hacked” emails or text messages.

Look at the sender’s address carefully. Do not use the phone number or link in a suspicious message. Instead, type the organisation’s web address into your browser yourself or use its official app. You can also contact the organisation through a phone number listed on its official website.

Be particularly cautious if the message asks you to confirm your password or one-time code, upload identity documents, transfer money to “protect” your account, install remote-access software or click urgently to avoid account closure.

If you have already clicked a suspicious link, read our guide on what to do if you accidentally click a malware link.

Change the exposed password immediately

If the breached organisation says your password may have been exposed, change it now. Do not wait for strange activity to appear.

Use a long, unique passphrase that you have never used anywhere else. A password reused across email, shopping, social media and banking accounts creates a chain reaction. Once criminals obtain it from one service, they may try it on others. The OAIC and ACSC specifically advise against reusing passwords across critical services.

Change the password from the organisation’s official website or app—not from a link in the breach email.

Change reused passwords on other accounts

Think beyond the breached company. Have you used the same password, or a small variation of it, anywhere else?

Start with your email account. Your email is often the reset key for your other accounts, so it deserves priority. Then check banking, government services, cloud storage, social media, online shopping and messaging accounts.

A password manager can create and remember a different password for every service. You only need to remember one strong master passphrase. If you are unsure how to set one up securely, Computer Cures can help with IT support and device setup.

Turn on multi-factor authentication

Multi-factor authentication (MFA) adds another check after your password. This might be an authenticator app, a security key, a fingerprint or a code sent to your phone.

Enable MFA wherever it is available, starting with email, banking, password managers, social media and cloud accounts. An authenticator app or security key is generally preferable to SMS when the service offers that choice, but any MFA is usually better than relying on a password alone.

Never share an MFA code with someone who calls or messages you. Legitimate support staff should not need you to read out a security code to “secure” your account.

Sign out of other sessions and review devices

Changing a password is important, but it may not end every existing session. Look for options such as Sign out of all devices, Log out of other sessions or Where you’re logged in in the account’s security settings.

Remove devices, apps and browser extensions you do not recognise. Check connected services too. A suspicious app with access to your email, contacts or cloud files may continue to access information even after you change your password.

Review recent login activity for unfamiliar locations, devices, password-reset emails or changes to your recovery phone number and email address.

Secure your email account first

Your email account is the control centre for much of your online life. If a criminal gets into it, they may be able to reset other passwords, read private conversations or impersonate you.

After changing the password and enabling MFA, check that your recovery details are correct, no unknown forwarding rules have been added, your signature has not been changed, there are no unfamiliar sent or deleted emails, and connected apps are legitimate.

If you notice suspicious activity across your computer, phone or email, our virus, spyware and malware removal service can help investigate and clean compromised devices. Malware can steal passwords even when you have done everything right online.

Watch your bank accounts and protect your identity

If financial information, identity documents or account details were part of the breach, contact your bank or financial provider using the number on its official website, card or statement.

Keep an eye out for unexpected transactions, new accounts or credit applications you do not recognise, unusual emails from your bank or phone provider, changes to your mobile service, and bills or government messages that do not make sense.

Never ignore a small suspicious charge. Report it promptly and keep notes of who you contacted and when. For identity theft, scams or compromised accounts, IDCARE provides independent guidance to Australian individuals. You can also report scams through Scamwatch.

Update your devices and check for malware

A data breach and a malware infection are not the same thing, but they can overlap. Criminals may use a breach notification as a reason to send a malicious link, while spyware on your own device can steal new passwords as you type them.

Update your operating system, browser, apps and security software. The OAIC’s summary of ACSC advice recommends keeping systems and browsers up to date and using antivirus protection to help guard against malware that steals credentials.

Be alert for sudden pop-ups, unexplained slowness, new browser toolbars, strange login alerts, disabled security software or emails sent without your knowledge. If something feels off, stop entering passwords on that device until it has been checked.

Be extra careful with follow-up scams

After a breach, your details may be used to make a scam sound convincing. You might receive a call claiming to be from the breached company, your bank, a delivery service or a government agency.

Take a pause before responding. Do not give callers remote access to your computer, and do not share passwords, PINs or MFA codes. Hang up and call the organisation back using a trusted number.

A VPN can help protect your connection on public Wi-Fi, but it cannot tell whether a message is a scam or make a stolen password safe. If you need help securing your home or business connection, see our VPN setup service or home networking support.

Make a simple recovery plan

Once the immediate risk is under control, make it easier to respond next time. Keep a private list of your important accounts, recovery options and the steps to contact your bank or provider. Store it securely—not in a plain text file called “passwords”.

Set up automatic updates and reliable backups. A backup will not stop someone accessing an account, but it can make recovery far less painful if a device is infected, files are encrypted or information is accidentally deleted. Computer Cures also provides data backup and recovery services.

If you run a small business, review who has access to customer information, use MFA for important systems, remove old accounts and make sure staff know how to spot phishing. Our small business IT support team can help you work through the practical side.

What if you cannot access your account?

Do not keep guessing the password. Use the provider’s official account-recovery process from a clean device. If your email, social media or computer has been hacked, secure your email first and contact the service provider directly.

If you suspect your computer or phone is infected, disconnect it from the internet if appropriate, avoid logging into banking on it and seek professional help. Computer Cures assists with malware removal, hacked accounts and device security across Melbourne. You can contact Computer Cures to book support or call 13 0055 3166.

Frequently asked questions

No. A breach means information was exposed, accessed or lost. It does not automatically prove that someone has used it. However, act promptly, especially if passwords, identity documents or financial details were involved.

Change the password for the breached service immediately. Also change any other password that was reused or closely based on it. Prioritise your email, banking, government, cloud and social media accounts.

Not always. Also enable MFA, sign out of other sessions, check recovery details and review connected apps. If you suspect malware, have the device checked before entering new passwords.

A VPN can encrypt your connection, which is useful on public Wi-Fi, but it does not repair a breached account or replace MFA and unique passwords. Use it as one part of a broader security setup.

Contact your bank or affected provider immediately. For identity theft, scams and cyber compromise, IDCARE offers independent support. If your device or accounts may also be compromised, Computer Cures can help with malware removal and hacked-account remediation.

Not sure whether your computer or account is compromised?

Get a local technician to check the problem before it becomes a bigger one. We can help with malware, hacked accounts, suspicious device behaviour and practical security setup.

Request a callback

Sources