How To Help a Relative After a Data Breach
What to do in the days and weeks after a relative's personal data has been exposed in a breach.
Last reviewed: 1 June 2026
When a company suffers a data breach, the personal information of customers — email addresses, passwords, sometimes payment details or ID numbers — can end up in criminal hands. Receiving a breach notification is alarming, but acting quickly and calmly with your relative can significantly reduce the risk of harm.
Assess what was exposed
The type of data that was leaked determines how urgent each response step is. Read the breach notification carefully together.
- Passwords: change them on the breached service and any other account using the same password
- Email address: expect an increase in phishing emails to that address
- Payment card details: contact the card issuer immediately
- National ID or passport numbers: consider a fraud alert or credit freeze
Secure affected accounts immediately
Work through the most sensitive accounts first — banking, email, and shopping — before moving to others.
- Change the password on the breached account first
- Enable two-factor authentication if it was not already on
- Check for any unfamiliar sign-ins or recent activity
- Report any suspicious transactions to the bank straight away
Stay alert over the following months
Stolen data is often sold and misused weeks or months after a breach — vigilance does not end in week one.
- Watch for phishing emails that reference the breached company
- Monitor bank statements and credit reports for unusual activity
- Be sceptical of any contact claiming to be from the breached company asking for more information
- Consider placing a credit freeze if sensitive ID data was exposed
Conversation script
“I saw that [the company] had a data breach — I wanted to help you work through the steps so we can make sure everything stays safe.”
“The most important thing first is to change the password on that account, and then check if you used the same password anywhere else.”
“We should also keep an eye on your bank statements over the next few months, just in case.”
Frequently asked questions
How do we know if a relative's data is being sold on the dark web?
Free tools such as Have I Been Pwned let you enter an email address and see whether it has appeared in known breaches. This will not cover all exposures, but it is a useful starting check.
Should we contact the company that was breached?
You can, though companies rarely offer more than their public statement. Focus energy on protecting accounts rather than waiting for the company to act.