Whether it leaked in a data breach, you entered it on a fake website, or someone you trusted shared it with someone you didn't — your password is compromised. That's the situation, not a hypothetical. Here's what to do in the next 15 minutes.
Step 1 — Change the compromised password now
Go directly to the service — type the address yourself, don't follow a link from an email or text — and change the password immediately. Make the new one unique: don't reuse it on any other account, and don't reuse an old password you've used before either. Reused passwords are exactly how one leak turns into five compromised accounts.
Step 2 — Sign out every other session
Changing the password isn't enough on its own if the attacker is already logged in somewhere — most services keep existing sessions alive until you explicitly end them. Look for "Sign out of all devices" or "Manage sessions": on Gmail it's under Security → "Your devices," on Microsoft accounts under "Sign-in activity," on Apple under "Devices" in your Apple ID settings, and Facebook and Instagram both have a "Where you're logged in" screen under security settings. Signing out everywhere kicks the attacker out even mid-session.
Step 3 — Turn on two-factor authentication
This is the single most important step after a password compromise. With MFA on, a stolen password alone isn't enough to get back in — the attacker also needs your phone or authenticator app. Set it up before you do anything else on this list.
Not sure what else the attacker touched?
Nerva IR checks the details that are easy to miss — forwarding rules, recovery info changes, connected apps — and builds a recovery plan around your specific accounts.
Step 4 — Check for forwarding rules and recovery changes
Attackers who've had access for a while often set up email forwarding rules or change the recovery email/phone number on the account — a way to keep reading your mail or regain access even after you've changed the password and turned on MFA. Check both settings on every account this password touched, not just the one you know was breached.
Step 5 — Check if you used this password anywhere else
If you did, change it everywhere, starting with email and banking. This is exactly why password reuse is dangerous: one leaked password becomes a master key the moment it's tried against your other accounts, which is one of the first things attackers automate. A password manager makes using a unique password everywhere painless — you don't need to memorize them, it does. Any reputable one works; the important thing is using one at all.
Step 6 — Check if you're in a data breach
Passwords rarely get stolen one at a time — they usually leak in bulk, in a breach at some company that had nothing to do with you clicking anything. If you don't know how this password ended up compromised, it's worth checking whether it — or the email address tied to it — shows up in a known breach. Nerva IR's monitoring flags this automatically for accounts you register, so you find out the moment a new breach includes you instead of months later.
How do passwords actually get stolen?
- Data breaches at a company you have an account with.
- Phishing — you typed it into a page pretending to be the real thing.
- Malware or keyloggers running on a device you used to log in.
- Shared with someone who shared it further than you intended.
- Written down somewhere that was later found or photographed.
The NIST Digital Identity Guidelines are the closest thing to an industry standard here, and their core recommendation hasn't changed in years: long, unique passwords plus a second factor beat any password-complexity rule you were taught to follow.
If the password leaked because you entered it on a fake site rather than a breach, see What to Do If You Clicked a Phishing Link for the containment steps specific to that path.