How to Respond to a Data Breach and Secure Your Accounts
Prioritize the affected account, recover access if needed, remove unfamiliar access, and protect other accounts that reused its password.
1. Identify what may be exposed
Read the breach notice and note which organization and information it names. A notice that your information was exposed does not, by itself, establish that someone has signed in to your account. If you see unfamiliar activity in a Google Account, Gmail, or another Google product, use the account-security steps below.
Before you begin
Use a device and connection you trust, if available.
Have access to the account’s recovery options if you can still sign in.
Do not erase or reset a device as a first response. The supplied guidance does not establish that a reset is necessary for every breach.
2. Recover access if you cannot sign in
Go to Google Account recovery and answer the questions as best you can. Use recovery if someone changed your account details, such as your password or recovery phone number, deleted the account, or you otherwise cannot sign in. If you are unsure which account is affected, Google’s help page also advises trying to recover the username.
Expected result: You can try to regain access and continue reviewing the account. If recovery does not work, use the same official help page for Google’s recovery guidance; do not rely on an unfamiliar person or service promising to restore the account.
3. Review Google account activity and devices
If you can sign in, open your Google Account and follow the menu paths in Google’s help article:
Open Security & sign-in.
In Recent security events, select Review security events.
Check each event. If one was not yours, select No, it wasn’t me and follow the on-screen steps. If it was yours, select Yes.
Open Your devices, then Manage devices. Check for devices you do not recognize. For an unfamiliar device, select Don’t recognize a device? and follow the prompts.
Expected result: You have reviewed recent events and devices, and Google’s prompts guide you through responding to activity or devices you identify as unfamiliar. The menu names above come from Google’s supplied help material; it does not specify different paths for particular device versions.
4. Change exposed or reused passwords
If you believe someone else is signed in, Google advises changing your Google Account password immediately if you have not already. Also change the password on other apps and sites where you reused it, where you sign in using that email address, where you saved that password, and services that contact you through that account’s email.
Use a different password for each account. For help choosing a password-management approach, see our guide to password managers. If you cannot sign in to another service, use that service’s official account-recovery process; Google’s recovery process cannot recover a separate service’s account.
5. Add a second sign-in factor and check account settings
Turn on Google’s 2-Step Verification. Google describes it as requiring your password plus something you have, such as a phone, security key, or printed code. For a general walkthrough, see how to enable two-factor authentication.
Review critical security settings and check for changes you did not make. In Gmail, Google specifically recommends checking for unfamiliar labels, filters, or forwarding rules. Also review other Google products you use for unusual activity, such as Drive file activity or sharing and Photos album sharing.
Expected result: You have checked the account’s sign-in protection and looked for changes that could preserve someone else’s access. Follow Google’s on-screen instructions for any setting you find unfamiliar.
6. Respond to possible financial or device risks
If banking information was saved in the account, or you think someone is using your identity or impersonating you, Google advises contacting your bank or local authorities. Review any payment activity you do not recognize and use Google’s official help page to find the relevant reporting steps.
If you suspect harmful software, Google recommends installing and running trusted antivirus software. Its help article also discusses resetting a computer and reinstalling the operating system, but says to back up files you need first. A reset can erase data, so do not attempt it without a verified backup and a clear reason to do so.
Troubleshooting
I cannot tell whether an event or device is mine
Review the event details and device list. If you still believe someone else is using the account, follow the account-security guidance linked above. Do not treat a device as yours solely because its name looks familiar.
I recognize all listed devices but still suspect access
Google’s guidance says to use its further account-security instructions if you still believe someone else is using the account. Recheck recent security activity and critical settings, and change the account password if you have not already.
I received a breach message asking me to sign in
Do not assume a message is genuine just because it mentions a breach. Use the organization’s official site or account-recovery route rather than a sign-in link in an unexpected message. For warning signs and reporting steps, see how to spot and report phishing.
Verify completion
You have completed the immediate Google-account checks when you have reviewed recent security events and devices, responded to anything unfamiliar, changed the affected and reused passwords, and enabled 2-Step Verification. If the breach notice names other services or types of information, follow the affected organization’s official instructions too. Keep monitoring the affected accounts for unfamiliar activity; the supplied Google guidance does not define a single check that proves a breach has been fully resolved.
