The interactive checklist
Check off each step as you complete it. The hardest part is starting, so start with step 1 right now.
Use DataLeakz or HaveIBeenPwned to search your email address. If it appears in any breach that includes passwords, change that password immediately especially if you reused it anywhere.
Your email controls every other account through password resets. If it shares a password with anything else, change it now to a unique, strong password (16+ characters or a random passphrase). Store it in a password manager.
Log into your email provider's security settings. If 2FA isn't enabled, enable it now. Use an authenticator app if available, not SMS. This single step stops the majority of email account takeovers.
Most email providers and major services show recent sign-in locations and devices. Look for anything unfamiliar an unknown location, device, or time. If something's off, revoke the session and change your password.
Pick your most important reused password (bank, Apple/Google account, work) and replace it with a unique one. You don't have to fix everything just one. If you install a password manager, it will generate and remember new ones automatically.
If you're in the US and suspect your SSN was in a breach (like National Public Data), freeze your credit at Equifax, Experian, and TransUnion. It's free and takes about 5 minutes per bureau online. See our NPD breach guide for details.
Check that your backup email and recovery phone number are current for your important accounts. Outdated recovery info is a common account lockout cause and attackers can exploit old recovery contacts to gain access.
Install a password manager, upgrade 2FA on your bank, or check your credit report. One concrete next action is worth more than a vague intention to "improve security." Write it down or set a calendar reminder.
Free, instant, no account required. See if your email is in known breach data right now.
Why this order matters
Security advice often treats all accounts as equal. They're not. Your email account is the master key — everything else recovers through it. If an attacker gets into your email, they can reset every other password. That's why it comes first, before your bank, before your work account, before anything else.
After your email, the priority is: financial accounts, identity documents (SSN/credit), your main Apple/Google/Microsoft account, then everything else. A breach at a gaming site matters less than a breach at your email provider.
Breaches are discovered on a delay. Data that's newly appeared in breach databases may have been stolen months earlier. A regular check means you catch exposure before attackers act on it.
Sources
- FTC Consumer Advice: Credit freezes and fraud alerts
- IdentityTheft.gov — data-breach recovery guidance
- CISA MFA guidance
- CISA Mobile Communications Best Practice Guidance — SMS as second factor