What To Do After a Data Breach

Use a unique password you have never used elsewhere. If you no longer need the account, close it properly rather than abandoning it.

This is the step that matters most. Attackers take leaked pairs and try them across hundreds of sites automatically -- credential stuffing. Reuse is what turns one company's failure into your problem. Prioritise email, banking, and anything financial.

Look for "sign out everywhere" in security settings. A password change does not always end sessions that are already open.

A passkey if offered, otherwise an authenticator app or hardware key. This is the moment you are motivated -- use it.

Do not merely watch it. Ask the bank for a new number, and check any subscriptions that will need updating.

Go: open a terminal in a folder you can write to — cd ~/Desktop on macOS or Linux, cd %USERPROFILE%\Desktop on Windows.

Do: save this as exposed.py and run python3 exposed.py.

"""Read the breach notice as a list of capabilities, not a list of fields."""

NOTICE = {
    "email address":        "lets an attacker find your other accounts and target you",
    "password hash":        "may become your password -- depends entirely on the algorithm",
    "full name":            "passes identity checks that ask for it",
    "date of birth":        "passes identity checks; cannot be changed, ever",
    "postal address":       "passes identity checks; changeable but slowly",
    "phone number":         "SMS resets, and SIM-swap targeting",
    "security question answers": "unlocks recovery on OTHER sites that ask the same question",
    "last 4 card digits":   "makes a scam call sound authoritative",
}

CHANGEABLE = {"email address", "password hash", "phone number", "postal address"}

print("%-28s %s" % ("WHAT LEAKED", "WHAT IT LETS SOMEONE DO"))
print("-" * 92)
for field, effect in NOTICE.items():
    print("%-28s %s" % (field, effect))

print()
print("fields you can change  :", len(CHANGEABLE))
print("fields you cannot      :", len(NOTICE) - len(CHANGEABLE))
print("   ", ", ".join(sorted(set(NOTICE) - CHANGEABLE)))
print()
print("The permanent half is why 'just change your password' is incomplete")
print("advice. Your date of birth is now, and will always be, known.")

You should see: half the fields in a column you can do nothing about:

WHAT LEAKED                  WHAT IT LETS SOMEONE DO
--------------------------------------------------------------------------------------------
email address                lets an attacker find your other accounts and target you
password hash                may become your password -- depends entirely on the algorithm
full name                    passes identity checks that ask for it
date of birth                passes identity checks; cannot be changed, ever
postal address               passes identity checks; changeable but slowly
phone number                 SMS resets, and SIM-swap targeting
security question answers    unlocks recovery on OTHER sites that ask the same question
last 4 card digits           makes a scam call sound authoritative

fields you can change  : 4
fields you cannot      : 4
    date of birth, full name, last 4 card digits, security question answers

The permanent half is why 'just change your password' is incomplete
advice. Your date of birth is now, and will always be, known.

The split at the bottom is the part breach notices never state. Four of these you can change this afternoon. The other four are permanent facts about you: your date of birth will be the same next year, your name is unlikely to change, and the answers to your security questions are now known to whoever bought the dump — and those answers unlock recovery on other sites that ask the same questions.

That is why the response has to include something beyond changing a password. The permanent fields cannot be revoked, so the only remedy is to stop relying on them, which is what the last row of step 5 is about.

If not: the counts are derived from the two sets, so editing a field moves them correctly; if the second list is empty, a name in CHANGEABLE was misspelled and no longer matches its key in NOTICE.

Go: the same folder.

Do: save this as salt.py and run python3 salt.py.

"""Why one word in the database design decides how bad the breach is."""
import hashlib, secrets

USERS = ["ana", "ben", "cara", "dan", "eve"]
# Three of the five happened to choose the same very common password.
PASSWORDS = ["hunter2", "hunter2", "T7#qLm2v", "hunter2", "kx91-pw"]

print("WITHOUT A SALT")
unsalted = [(u, hashlib.sha256(p.encode()).hexdigest()) for u, p in zip(USERS, PASSWORDS)]
for user, h in unsalted:
    print("   %-6s %s" % (user, h[:40]))
groups = {}
for user, h in unsalted:
    groups.setdefault(h, []).append(user)
repeated = [users for users in groups.values() if len(users) > 1]
print("   accounts sharing a hash:", repeated)
print("   crack that ONE hash and you have:", len(repeated[0]), "accounts")

print()
print("WITH A PER-USER SALT")
salted = []
for user, p in zip(USERS, PASSWORDS):
    salt = secrets.token_hex(8)
    salted.append((user, hashlib.sha256((salt + p).encode()).hexdigest()))
for user, h in salted:
    print("   %-6s %s" % (user, h[:40]))
print("   accounts sharing a hash:", [])
print("   crack one hash and you have: 1 account")
print()
print("The salt is not secret and does not need to be. It exists so that")
print("identical passwords stop producing identical hashes -- which kills")
print("precomputed tables and stops one crack from unlocking many people.")

You should see: three users sharing one hash, then five users sharing none:

WITHOUT A SALT
   ana    f52fbd32b2b3b86ff88ef6c490628285f482af15
   ben    f52fbd32b2b3b86ff88ef6c490628285f482af15
   cara   ce21c9f16dd3f836803087010bb00e4b36e7d09f
   dan    f52fbd32b2b3b86ff88ef6c490628285f482af15
   eve    6f84389aa108a118f93a4ba82d0272d46f82948b
   accounts sharing a hash: [['ana', 'ben', 'dan']]
   crack that ONE hash and you have: 3 accounts

WITH A PER-USER SALT
   ana    cca272d9d8db1e7a7e04f3d95599cf6016d9789e
   ben    e271cca170c54151dc8a1fbc6cc2b5b80b33a595
   cara   f9b5e235c2cddd4f1b65cf3248691b65916673fa
   dan    cfdc7b272589c2256f8d27c25171ff220951d038
   eve    ca17fb15df2ff995962dea5b1da8a8d5a5022606
   accounts sharing a hash: []
   crack one hash and you have: 1 account

The salt is not secret and does not need to be. It exists so that
identical passwords stop producing identical hashes -- which kills
precomputed tables and stops one crack from unlocking many people.

The salted block will be different every time you run it, and that is the demonstration — the salt is random per user, so the same password produces a different hash on every run. The unsalted block is identical on your machine and on this page, which is exactly the property that makes it dangerous.

Without a salt, identical passwords produce identical hashes. An attacker sorts the stolen table, sees which hash appears most often, cracks that one, and immediately owns every account that shared it — and a precomputed table of common passwords works against the whole database at once. The salt is not a secret and does not need to be; it exists solely to make every hash unique so that each one has to be attacked separately.

What this means for you when reading a notice: “hashed” alone tells you nothing. “Salted and hashed with bcrypt / scrypt / Argon2” is genuinely reassuring. “Hashed with MD5” or “hashed with SHA-1” and no mention of a salt means you should treat the password as disclosed.

If not: the first block must be identical to this page — ana, ben and dan share a hash beginning f52fbd32, which is the SHA-256 of the string in PASSWORDS. If yours differs, the password strings were altered.

Go: the same folder.

Do: save this as order.py and run python3 order.py.

"""Doing the right things in the wrong order wastes the only advantage you have."""

ACCOUNTS = {
    "email":            {"resets": [], "reset_by": []},
    "the breached site":{"resets": [], "reset_by": ["email"]},
    "bank":             {"resets": [], "reset_by": ["email"]},
    "shopping":         {"resets": [], "reset_by": ["email"]},
}

def simulate(order):
    """An attacker is working in parallel. Anything not yet secured is exposed."""
    secured, lost = [], []
    for step, account in enumerate(order):
        # While you secure this one, the attacker uses the email you have not fixed.
        if "email" not in secured and account != "email":
            lost.append(account)
        secured.append(account)
    return lost

WRONG = ["the breached site", "bank", "shopping", "email"]
RIGHT = ["email", "the breached site", "bank", "shopping"]

for label, order in (("most people's order", WRONG), ("the right order", RIGHT)):
    lost = simulate(order)
    print("%-20s %s" % (label, " -> ".join(order)))
    print("%-20s accounts still reachable while you worked: %d %s"
          % ("", len(lost), lost if lost else ""))
    print()

print("Email first, always. Every other account has a 'forgot password' link")
print("that ends in your inbox, so securing anything else while the inbox is")
print("open secures nothing.")

You should see: three accounts left open while you worked on them:

most people's order  the breached site -> bank -> shopping -> email
                     accounts still reachable while you worked: 3 ['the breached site', 'bank', 'shopping']

the right order      email -> the breached site -> bank -> shopping
                     accounts still reachable while you worked: 0 

Email first, always. Every other account has a 'forgot password' link
that ends in your inbox, so securing anything else while the inbox is
open secures nothing.

The instinct is to start with the account that was breached, because that is the one in the email you just received. It is the wrong place to start. Every other account has a “forgot password” link that ends in your inbox, so an attacker with access to the inbox can undo each thing you secure, in the time it takes you to secure the next one.

The order, then: email first — new password, and two-factor authentication if it is not already on. Then the breached account. Then anywhere the same password was used. Then everything else, at your leisure.

If not: if both orders report 0, the condition checking whether email is already secured was inverted — the simulation only counts an account as exposed while the inbox is still open.

Go: the same folder.

Do: save this as stuffing.py and run python3 stuffing.py.

"""What happens to the leaked list, mechanically."""

LEAKED = [("sarah@example.com", "hunter2"), ("ben@example.com", "T7#qLm2v")]

TARGET_SITES = ["bank", "shopping", "streaming", "social", "webmail", "delivery"]

def stuff(pairs, sites):
    attempts = 0
    for email, password in pairs:
        for site in sites:
            attempts += 1
    return attempts

attempts = stuff(LEAKED, TARGET_SITES)
print("credentials in the dump :", len(LEAKED))
print("sites to try them on    :", len(TARGET_SITES))
print("login attempts           :", attempts)
print()
print("Now scale it. A dump of 5 million credentials against the same 6 sites:")
big = 5_000_000 * len(TARGET_SITES)
print("   attempts             :", format(big, ","))
print("   at 500 per second    :", format(int(big / 500 / 3600), ","), "hours")
print()
print("No password is guessed at any point. The attempts are simply replays")
print("of credentials people already chose, on sites that never leaked.")
print()
print("Which is why the only defence is that the password is not reused --")
print("and why the response to any breach notice includes every OTHER site")
print("where you used the same one.")

You should see: thirty million login attempts against sites that were never breached:

credentials in the dump : 2
sites to try them on    : 6
login attempts           : 12

Now scale it. A dump of 5 million credentials against the same 6 sites:
   attempts             : 30,000,000
   at 500 per second    : 16 hours

No password is guessed at any point. The attempts are simply replays
of credentials people already chose, on sites that never leaked.

Which is why the only defence is that the password is not reused --
and why the response to any breach notice includes every OTHER site
where you used the same one.

This is called credential stuffing, and the arithmetic is the whole of it. Nothing is cracked, guessed or broken: leaked email-and-password pairs are simply typed into other sites, automatically, and a small percentage work because people reuse passwords. The sites where those logins succeed never had a breach of their own and have nothing to apologise for.

Which is why the breach notice you received is about more than the site that sent it. The question it should prompt is not “what did they lose” but “where else did I use that password” — and if the honest answer is “I am not sure”, that uncertainty is the finding.

If not: the figures are plain multiplication over the two lists; if the total is 0, one of the lists is empty. The 500-per-second rate is an illustrative figure chosen to make the scale legible, not a measurement.

Go: the same folder.

Do: save this as monitoring.py and run python3 monitoring.py.

"""What 'credit monitoring' does, and the thing that actually works."""

#                                          prevents?  what it does
MEASURES = [
    ("credit monitoring / alerts",         False, "tells you AFTER something happened"),
    ("a credit freeze",                    True,  "stops new accounts opening in your name"),
    ("changing the breached password",     False, "closes that one account, nothing else"),
    ("changing it everywhere it was reused", True, "closes the credential-stuffing route"),
    ("adding 2FA to your email",           True,  "protects the account that resets the rest"),
    ("randomising security answers",       True,  "the only fix for unchangeable data"),
]

print("%-38s %-11s %s" % ("MEASURE", "PREVENTS?", "WHAT IT DOES"))
print("-" * 92)
for name, prevents, what in MEASURES:
    print("%-38s %-11s %s" % (name, "yes" if prevents else "no", what))

print()
print("measures that PREVENT :", sum(1 for _, p, _ in MEASURES if p))
print("measures that NOTIFY  :", sum(1 for _, p, _ in MEASURES if not p))
print()
print("Monitoring is what a breached company offers, because it is what they")
print("can buy on your behalf. The freeze is what stops the fraud, it is")
print("usually free, and you have to arrange it yourself.")

You should see: four preventive measures and two that only notify:

MEASURE                                PREVENTS?   WHAT IT DOES
--------------------------------------------------------------------------------------------
credit monitoring / alerts             no          tells you AFTER something happened
a credit freeze                        yes         stops new accounts opening in your name
changing the breached password         no          closes that one account, nothing else
changing it everywhere it was reused   yes         closes the credential-stuffing route
adding 2FA to your email               yes         protects the account that resets the rest
randomising security answers           yes         the only fix for unchangeable data

measures that PREVENT : 4
measures that NOTIFY  : 2

Monitoring is what a breached company offers, because it is what they
can buy on your behalf. The freeze is what stops the fraud, it is
usually free, and you have to arrange it yourself.

The first row is what the breached company will offer you, usually free for twelve months, and it is worth accepting — but understand what it is. Monitoring watches for your details being used and tells you afterwards. It does not stop anything.

The freeze is the preventive twin and almost nobody takes it up. In most countries you can restrict new credit being opened in your name — it is called a credit freeze or security freeze in some places, and a protective registration or notice of correction in others — it is usually free, and it can be lifted when you genuinely need credit. Search for the term your country's credit reference agencies use.

And the last row closes the permanent-fields problem from step 1: replace the answers to security questions with random strings stored in your password manager. “Mother's maiden name” is not a secret and never was; a random string in that box is.

If not: the counts come from the boolean in each row rather than from the text, which is deliberate — the first version of this script matched on the word “preventive” and counted the row that said not preventive.