Home / Academy / Your data was in a data breach. What now?

Your data was in a data breach. What now?

Updated 10 November 2026

Change the password of the breached account first, and of every other account where you used the same password. Then turn on two-step login, watch for phishing that uses the leaked details, and use your GDPR rights to find out exactly what leaked. Here is the order that matters.

We do this for you. You don't have to do anything.

  • Autopilot sends the request to every company we find, plus dozens of other data brokers that likely hold your data.
  • We send the reminders, handle the replies and keep track of the one-month deadline.
  • We rescan you every week. If your data comes back, we send a new request.
  • All you do is enter your name, confirm your email and give us permission. Free during the beta.

In the first hour

  1. Change the password of the breached account. If you used it anywhere else, change it there too, starting with your email and bank.
  2. Turn on two-step login (2FA). Microsoft found it blocks over 99.9% of automated account attacks.
  3. Check your email account for forwarding rules or recovery addresses you didn't add. Attackers set these up to keep access.
  4. Leaked card details? Call your bank and block the card.

In the first week

Leaked names, emails and phone numbers are used for phishing that looks real, because it mentions the company that leaked them. Expect emails and texts "from" that company asking you to verify your account or claim compensation. Don't click: go to the company's site or app yourself. Use our free scam check if you're unsure about a message.

What the company has to tell you

Under GDPR, a company must report a serious breach to the data protection authority within 72 hours (Article 33). If the breach is likely to put you at high risk, it must also tell you directly, in plain language, what happened and what you can do (Article 34).

You can ask for more. Send an access request (Article 15) asking which of your data they hold, which data leaked, and who they shared it with. If you suffered damage, Article 82 gives you a right to compensation.

Was it a stealer log?

Some leaks aren't company breaches at all. Malware on your own device can steal saved passwords straight from your browser and sell them in "stealer logs". If your email shows up there, scan your computer, then change every password saved in that browser. Our free scan checks stealer logs too.

Make the next leak less harmful

The less data companies hold on you, the less can leak. Data brokers keep copies of your email, phone and address that you never gave them directly. Autopilot asks them to delete it, follows up, and rescans you every week, so the next breach exposes less.

Questions

How do I know if my data was in a breach?

Companies must tell you if a breach puts you at high risk. You can also check your email yourself: our free scan checks it against known breaches and stealer logs.

Can I get compensation for a data breach?

Under Article 82 GDPR you can claim compensation for material or non-material damage caused by a breach. In practice this often runs through collective claims.

Should I change my email address after a breach?

Usually not. Change your passwords, turn on two-step login and be extra careful with messages. A new email address helps only if the old one gets flooded with spam.

More numbers on data brokers, breaches and scams: privacy statistics 2026.

Sources

Read next

All Academy articles