My data was in a breach — what now?
Move in this order: contain the damage, verify what leaked, then use your rights — including compensation. Most harm from breaches happens in the first days, through scams that use the leaked data.
- Change the password — everywhere it was reusedStart with the breached account, then every account sharing that password. Turn on two-factor authentication as you go. A password manager makes non-reuse the default.
- Check what actually leakedThe breach notice must say (Art. 34). Passwords and payment data = act now; email-only = expect phishing. haveibeenpwned.com shows which known breaches include your address.
- Expect tailored scams — this is the real dangerLeaked order data makes fake “your parcel/refund/bank” messages look real. Treat every message referencing the breached service as hostile; verify links with our scam checker before clicking.
- Watch money and identityCard data leaked? Tell your bank, watch statements, consider a new card. ID document leaked? National fraud-alert registers and ID-reissue are your friends; your bank’s IBAN name-check now flags mismatched recipients too.
- Demand answers from the companyArt. 15 request: exactly which of my data, when, to whom leaked, what are you doing? They must answer within a month. Screenshot the breach notice and keep everything.
- Complain — and consider compensationNotice came late or never? Complain free to your DPA (directory below). Art. 82 gives damages for material AND non-material harm — collective actions after big breaches are increasingly common; joining one costs you little.
One calibration point: a breach notice is not proof you will be defrauded — it is proof criminals might hold a specific set of your data. The six steps above close the doors in the order attackers actually try them: reused passwords first, then socially-engineered scams dressed in the leaked details, then slower identity misuse. The legal spine: the company owed you security (Art. 32), owes you notice on high risk (Art. 34), owes you answers (Art. 15) and owes you compensation for harm including distress (Art. 82, confirmed by the CJEU in the Austrian Post line of cases). Free complaint, real damages — use both.
Verified against the sources above on 18 July 2026. Information, not legal advice.