Company Reset Your Password After a Breach? What to Do Next

When a service emails to say it has reset your password after a security incident, it usually means attackers may have obtained its password database, so the company forced everyone to choose a new one. Treat the email with care. Do not click its links: open the service's website or app yourself and use Forgot password there. Choose a new, unique password, ideally generated by a password manager. Then change the same password on any other site where you reused it, because attackers try leaked passwords everywhere. Turn on two-step verification or a passkey, check whether your email appears in known breaches, and watch for phishing that mentions the incident.

Ethan got an email from a web hosting company he used for a small website: "We have reset your password as a precaution following unauthorized access to one of our systems." He nearly clicked the reset link before remembering Jake's rule about emails that create urgency. Jake checked with him: the company's own website and status page carried the same announcement, so the incident was real. Ethan reset the password through the website, not the email. Then the uncomfortable part: the old password was one he had also used for an online store and his gaming account. Twenty minutes and a password manager later, every one of those accounts had a unique password and two-step verification. This page walks through the same steps, and how to tell a real reset notice from a fake one.

This page focuses on forced password resets. For a broader look at recent breaches and their effects, see our roundup of the biggest data breaches of 2026.

Why services force password resets

Services store passwords in a scrambled form called a hash, not as plain text. When attackers break into a system and copy the password database, they cannot read the passwords directly, but they can try to work them out by guessing billions of common passwords and comparing the results. Weak or common passwords fall quickly; strong, unique ones may never be cracked. Because the company cannot know which passwords will be cracked, the safe response is to invalidate them all and make everyone choose a new one.

A forced reset is therefore a sign of responsible handling, not necessarily of a catastrophic breach. Companies also reset passwords when they find suspicious login activity, after a leak at a partner, or when they upgrade how passwords are stored. The email should say why; the company's website or blog usually explains more.

When the company says passwords were stored with a modern, salted hashing method, the risk to a strong, unique password is low, but changing it is still the right step, both because the company asks and because it removes any doubt.

How criminals use breached data

Leaked data is traded and combined. Email and password pairs from many breaches are merged into huge lists used for automated credential stuffing. Names, email addresses and phone numbers feed targeted phishing that mentions real details to seem convincing. Phone numbers combined with personal details can support SIM swap attempts, where criminals persuade a mobile carrier to move your number to their SIM to receive your text-message codes. Understanding these uses explains each step on this page: unique passwords defeat stuffing, caution defeats phishing, and stronger second steps defeat SIM swaps.

Leaked data does not expire. Lists from breaches years old still circulate, which is why an old reused password remains dangerous long after the news has been forgotten.

Protect your phone number

Because so many accounts rely on text-message codes, your phone number is worth protecting. Most mobile carriers let you add an account PIN or passcode and turn on number transfer or port-out protection, which blocks moving your number to another carrier or SIM without extra verification. Set these up through your carrier's app or website. Then, for important accounts, switch from text-message codes to an authenticator app, security key or passkey where possible, so a stolen number alone cannot unlock them.

If your phone suddenly loses all signal and shows no service while others nearby are fine, contact your carrier immediately from another phone; an unexpected loss of service can be the first sign of a SIM swap in progress.

Ask your carrier whether it offers alerts for SIM changes; some send a text or email whenever a new SIM is activated on your number.

What good breach handling looks like

Companies handle breaches very differently, and the way a notice is written tells you something about the risk. A well-handled notice explains what happened, when, what data was involved, how passwords were stored, what the company has done and what you should do, and points to a page on its official site with updates. Vague notices, long delays between the breach and the announcement, or claims that "no sensitive data" was involved when passwords clearly were, deserve more caution on your side. In many places, laws now require companies to notify affected customers and regulators within set time limits.

Regulators' websites in many countries list reported breaches, which is another way to confirm an incident independently of the company's email.

A company that offers free monitoring or identity protection after a breach is acknowledging the risk; accept it through the official site, not through links in emails.

The 2019 Hostinger reset this page first covered

In August 2019, the web hosting company Hostinger reset passwords for its customers after an unauthorized party accessed one of its systems and reached a database containing customer information, including usernames, email addresses and hashed passwords, for about 14 million clients. Hostinger said the passwords were hashed, reset them as a precaution, and published an explanation of the incident. It was a typical example of a forced reset: a real breach, an honest notice, and a clear instruction to set a new password.

Incidents like it happen every year across all kinds of services, which is why knowing how to respond calmly matters more than remembering any single breach.

For customers, the practical response was the same as for any forced reset today: set a new unique password, check where else the old one had been used, and enable stronger sign-in protection on the hosting control panel.

Is the reset email real? How to check

Criminals know that breach notices make people act quickly, so fake "your password was reset" emails are a common phishing trick. Check before you act:

1. Do not click links in the email. Type the service's address yourself, or open its app.
2. Look for the announcement on the service's official website, status page, blog or verified social accounts.
3. Check the sender's address carefully; lookalike domains with an extra letter or different ending are common.
4. Be wary of urgency and threats, such as "your account will be deleted in 24 hours".
5. Never send your password, codes or card details by reply or through a link; real services do not ask for them by email.
6. Search the news for the incident; genuine breaches at known companies are usually reported.

If you cannot confirm the incident, you lose nothing by changing your password through the official site anyway, as long as you never use the email's links.

No single row proves a message genuine; the safe habit of going to the site yourself makes the question irrelevant.

If you use a password manager, it gives one more check for free: it will not offer to fill your password on a fake page, because the address does not match the real site. A missing autofill on a sign-in page is a warning sign.

Reset your password safely

Go to the service's official sign-in page, choose Forgot password or the reset option, and follow the steps, which usually send a one-time link or code to your email or phone. Choose a new password that is long, unique to this service and not a variation of an old one. A password manager can generate and store it, so you never need to remember it. After signing in, review the account: check the email address and phone number on file, recent activity and connected apps, and sign out of other sessions if the option exists.

If a password reset email or code arrives when you did not ask for one, do not use it, and consider whether someone is trying to access your account; changing your password and turning on two-step verification closes that door.

Some services also offer a list of active sessions with a Sign out everywhere button; using it after a reset removes anyone who may already be signed in with your old password or a stolen session.

If it is a work account

If the breached service is one you use for work, or the reused password also protected a work account, tell your employer's IT or security team straight away. Work accounts often connect to many systems through single sign-on, and a compromise can affect colleagues and customers. The IT team may reset sessions, review sign-in logs and require new credentials. Never reuse a work password anywhere personal, and vice versa; keeping the two worlds separate limits the damage either side of a breach can do.

Many organizations also run their own breach monitoring and may contact you first; cooperating quickly limits the impact for everyone.

Report suspicious emails about the breach to IT as well; attackers often target employees of breached services' business customers.

Check your recovery options

While signed in, review how the account can be recovered if you lose access: the recovery email address, phone number and any backup codes. Make sure the email and phone are current and belong to you. Save backup codes, which many services provide when you turn on two-step verification, in your password manager or printed in a safe place. Attackers who gain access sometimes change recovery details to lock out the real owner, so a quick check after a breach can catch that early.

Remove old phone numbers and email addresses you no longer control; an outdated recovery address is a path for someone else to reset your account.

Store backup codes where you could reach them if you lost your phone, such as a printed copy at home, since codes saved only on the phone do not help when the phone is the thing you lost.

Security questions are weak spots

Some services still use security questions such as your mother's maiden name or first pet. The answers are often findable online or guessable, and they may have leaked in the same breach. Treat them like passwords: give random answers, store them in your password manager, and never use true answers that someone could research. If a service lets you remove security questions in favor of two-step verification, do so.

Write the random answers down in your password manager notes for that site; you will need them if the service ever asks, and you will never remember answers that are deliberately nonsense.

Some banks still ask security questions on the phone; keep those random answers in your password manager so you can read them out when needed.

The real danger: reused passwords

The biggest risk from a breach is not the breached service itself, which has reset your password, but every other site where you used the same password. Attackers take leaked email and password pairs and try them automatically on email providers, banks, shopping sites and social networks, an attack called credential stuffing. If the password was reused, those accounts are open to them.

Make a list of every account where you used the same or a similar password, and change each one, starting with email, because whoever controls your email can reset every other account. Then banking, shopping, social media and anything with stored payment details. This is exactly what Ethan had to do for his store and gaming accounts.

Shared and family accounts

Shared accounts, such as streaming services or a family shopping account, are often protected by one old password known to several people and reused elsewhere. After a breach, change shared passwords and share them through a password manager's family sharing feature rather than by text or on paper. Remove people who no longer need access, and check the account's list of signed-in devices, signing out any you do not recognize.

For streaming services, the account's profile and device management pages show where it is signed in; signing out of all devices and signing back in on your own is a quick way to remove anyone using an old shared password.

After changing a shared password, tell everyone who uses the account through a trusted channel, so nobody falls for a fake "new password" message.

Why your email account comes first

Your email account is the master key to almost everything else: nearly every service sends password reset links there. An attacker who controls your email can reset your bank, shopping, social media and cloud accounts one by one, and read the confirmation emails before you see them. That is why, after any breach involving a reused password, email gets changed first, with a long unique password and the strongest second step available, ideally a passkey or security key. Check the email account's own security settings too: recovery options, forwarding rules that might send copies of your mail elsewhere, and connected apps.

If your email provider supports passkeys, set one up; it is the single most valuable passkey you can create.

Signs an account was taken over

• Emails about password changes, new sign-ins or new devices you did not make.
• Messages sent from your account that you did not write.
• Changed recovery email, phone number or profile details.
• Purchases, transfers or posts you did not make.
• Being signed out unexpectedly and unable to sign back in.

If any appear, use the service's account recovery process straight away, which is designed for exactly this, and contact its support. Then work through the reused-password steps on this page, since the attacker may try your other accounts next.

Keep notes of what you see and when; support teams resolve takeovers faster with dates, times and screenshots of the alerts.

Check your email's sent folder and filters as well: attackers who reach an email account often set up forwarding or rules to hide their activity.

Use a password manager

Unique, strong passwords for dozens of accounts are impossible to memorize, which is why password managers exist. They generate random passwords, store them encrypted, fill them in on the right sites and refuse to fill them on lookalike phishing pages. Browsers include built-in managers: Microsoft Edge, Google Chrome and Apple's Passwords app all save and generate passwords and warn about ones found in breaches. Dedicated password managers add features such as sharing with family and support across every browser. Our guide to making Edge save passwords covers the built-in option.

Protect the password manager itself with a strong master password or your device's biometric sign-in, and turn on two-step verification for the account behind it.

Moving to a password manager does not have to happen in one sitting: let it save passwords as you sign in to each site over a few weeks, then use its report to fix the weak and reused ones it finds.

Length beats complexity

Current guidance from security standards bodies such as the U.S. National Institute of Standards and Technology favors long passwords over complicated rules. A passphrase of four or five random words is easier to remember and harder to crack than a short jumble of symbols. Services should check new passwords against lists of known breached ones, and should not force routine password changes unless there is evidence of compromise, which is exactly the situation a breach reset represents. For passwords you never need to type, let the password manager generate long random ones; for the few you must remember, such as your device and password manager, use a long passphrase.

A good passphrase is random, not a quote or song lyric, since attackers' guessing tools include famous phrases. Picking words at random from a list, or letting the password manager generate a passphrase, avoids that trap.

Turn on two-step verification or passkeys

Two-step verification, also called two-factor or multi-factor authentication, means a stolen password alone is not enough to sign in: the attacker also needs a code from your phone, an authenticator app, a security key or a device prompt. Turn it on for every important account, especially email, banking, cloud storage and social media. Authenticator apps and security keys are stronger than text-message codes, which can be intercepted through SIM swapping, but any second step is far better than none.

Passkeys go further. They replace the password with a cryptographic key stored on your device and unlocked with your fingerprint, face or PIN. There is nothing to leak in a breach and nothing to type into a phishing page, because a passkey only works on the genuine site. Many major services now support passkeys; when a site offers one, it is usually the best choice.

Push approvals deserve one warning: attackers who have your password may send repeated prompts hoping you tap Approve to make them stop. Deny any prompt you did not trigger, and change your password, since the prompts mean someone has it.

Turn on two-step verification on the breached service itself first, since it has just shown attackers are interested in it, then on the rest of your important accounts.

Setting up a passkey

1. Sign in to the account on your phone or computer.
2. Open its security or sign-in settings and look for Passkeys.
3. Choose to create a passkey; your device asks for your fingerprint, face or PIN.
4. Name the passkey after the device so you can recognize it later.
5. Next time, choose to sign in with a passkey instead of typing a password.

Passkeys sync through your password manager or device ecosystem, such as Apple's iCloud Keychain or Google Password Manager, so they work on your other devices too. Keep your password and recovery options in place until you are comfortable that the passkey works everywhere you need it.

If a site offers both a passkey and a password, keeping a strong password as a fallback is fine; the passkey simply becomes the everyday way in, and phishing pages cannot use it.

Check whether your email was in known breaches

Free services let you check whether your email address appears in known data breaches. The best known, Have I Been Pwned, run by security researcher Troy Hunt, lists breaches that included your address and what kind of data was exposed, and can alert you to future ones. Browser password managers in Edge, Chrome and Safari also check saved passwords against known breach lists and flag ones that should be changed.

Finding your email in breaches is common and not a reason to panic; most people who have been online for years appear in several. It is a reason to make sure the passwords from those services are not reused anywhere and that two-step verification is on.

Signing up for breach notifications with your main email addresses means you hear about future breaches quickly, often before the company's own notice arrives.

Treat any site asking you to type your password to check whether it was breached with suspicion; reputable checkers either ask only for your email address or check passwords in a way that never sends the full password.

Do breach monitoring services help?

Many security suites, banks and identity protection services offer "dark web monitoring" that alerts you when your email, phone number or other details appear in leaked data. The alerts can be useful prompts to change passwords, but they cannot remove data from criminal markets or prevent its misuse. Free options, including browser password checks and breach notification services, cover the most important part: knowing when a password needs changing. Paid identity protection is more relevant if highly sensitive data, such as a Social Security number, has been exposed, and even then a credit freeze is the stronger free step.

Credit card issuers and banks also run their own fraud monitoring for free, so check what your existing providers already offer before paying for an extra service.

What "hashed passwords" really means

Breach notices often say passwords were "hashed" or "encrypted", which sounds reassuring. How reassuring depends on the method. Modern, slow hashing methods such as bcrypt, scrypt and Argon2, with a unique random value called a salt for each password, make cracking slow and expensive, so strong passwords stay safe. Older, fast methods such as plain MD5 or SHA-1 can be cracked much faster with modern hardware, especially for weak passwords. In either case, assume a weak or common password from a breached service is known to attackers, and that a long, unique one is likely safe but should still be changed.

You cannot tell from outside how a company stores passwords, which is the strongest argument for unique passwords everywhere: a breach at a careless company then exposes only the password used there, and nothing else.

What else may have leaked

Password databases often sit alongside other personal data: names, email addresses, phone numbers, postal addresses, dates of birth, and sometimes partial payment details. Read the breach notice to see what was involved. Exposed email addresses and phone numbers lead to more phishing and scam calls, so be extra cautious with messages that mention the service. Exposed addresses and birth dates help identity thieves. If payment card details were exposed, watch statements and ask your bank about a replacement card. In the United States, if a breach exposed your Social Security number, consider a free credit freeze with the three major credit bureaus, which stops new accounts being opened in your name.

When children's data is involved

Breaches at schools, game platforms and children's apps can expose children's names, birth dates and other details. Children rarely check their credit, which makes their identities attractive to fraudsters who may not be noticed for years. In the United States, parents can request a credit freeze for a child with each of the major credit bureaus, which blocks new accounts in the child's name. Change the child's passwords, turn on parental controls and two-step verification where available, and talk to older children about phishing that mentions their school or games.

Schools usually send their own guidance after a breach; follow it, and ask what data was involved if the notice is vague.

Payment cards and bank accounts

If a breach exposed card details, call your bank or card issuer, or use its app, to report it; most will cancel and replace the card at no cost. Turn on transaction alerts so every purchase triggers a notification, which catches fraud within minutes. Review statements for small test charges, which criminals use to check that a stolen card works before larger purchases. Remove saved cards from services you rarely use, and prefer payment methods such as digital wallets that share a token rather than your real card number with merchants.

For bank accounts, as opposed to cards, ask your bank about extra verification for transfers and set up alerts for every outgoing payment.

Virtual card numbers, offered by some banks and payment services, let you use a different number for each merchant, so a breach at one shop exposes a number you can simply cancel.

When the leak came from your own device

Not every leaked password comes from a company's breach. Infostealer malware, often hidden in pirated software, game cheats and fake downloads, copies saved passwords, cookies and session tokens straight from a person's browser and sends them to criminals. If several accounts are compromised at once, or a service says your account was accessed with the correct password and no breach was announced, scan your PC: run a full Microsoft Defender scan and a Microsoft Defender Offline scan, as our guide to scanning with Defender explains. Then change passwords from a clean device and sign out of all sessions, since stolen session cookies can bypass passwords.

Signs of an infostealer include browser extensions you did not install, antivirus alerts you dismissed, and accounts compromised even after changing passwords; in those cases, cleaning or resetting the PC must come before any password changes will stick.

Phishing that follows a breach

After a breach becomes public, scammers send messages pretending to be the company, offering compensation, account verification or security checks. Some use the stolen data to make messages convincing, quoting your name, order numbers or the last digits of your card. The rule stays the same: do not act on links, attachments or phone numbers in unexpected messages. Contact the company through its official website or app. If a message asks you to call a number, look up the company's number yourself.

Report convincing fakes to the company and, for email, use your mail app's report phishing button; that helps protect other customers who received the same message.

Calls claiming to be from the company's security team are a related trick; hang up and call back using the number on the official website.

If you run a website or small business

Ethan's hosting account controlled a website, which raised another question: could the attacker have changed the site? After resetting the password, he checked the site for unexpected changes, reviewed which users had access to the hosting control panel, rotated passwords and keys stored there, such as database and email passwords and any API keys, and turned on two-step verification for the panel. For businesses, the same thinking applies on a larger scale; our guide to the first 30 minutes after a leaked access key shows the incident-response mindset for cloud credentials.

For a website, also check for new administrator users, unexpected plugins or files, and changed redirects, which are common signs of tampering after a hosting account compromise.

Gaming and social accounts

Gaming accounts are valuable to criminals because of the items, skins and payment methods attached to them, and they are often protected by reused passwords. Turn on each platform's account protection, such as authenticator-based two-step verification, and check for trades, purchases or new devices you did not authorize. Social media accounts are targeted for scams sent to your friends; if yours sends strange messages, recover it quickly and warn friends not to click anything that came from it.

Never share verification codes with friends or anyone offering free items; account theft through "verify your account for a reward" messages is common on gaming platforms.

Linking a gaming account to an email with its own strong protection matters most, since email recovery is how stolen gaming accounts are usually taken permanently.

Delete accounts you no longer use

Every old account you forgot is a breach waiting to happen, with a password from years ago that may match ones you still use. After dealing with the current breach, list services you no longer use, especially old shopping sites, forums and apps, and delete those accounts through their settings or help pages. Your password manager's list of saved logins is the best starting point. Fewer accounts means fewer breach notices in future, and less personal data spread around the internet.

Where a service offers no deletion option, change the password to a random one, remove saved payment details and personal information, and unsubscribe from its emails.

Unsubscribing from marketing emails of services you have left also shrinks the flood that makes phishing harder to spot.

Helping family members respond

Older relatives and children are often the most exposed after a breach: reused passwords, no two-step verification and a tendency to trust official-looking emails. Sit with them, check which of their accounts used the same password, and set up a password manager on their phone and computer, with a family sharing feature if you want to help manage it. Turn on two-step verification for their email first. Explain the rule about never clicking links in unexpected messages. One session like this protects them from most of the harm a future breach could do.

For relatives who struggle with password managers, a written password book kept securely at home is far safer than reusing one password online; the risk of a burglar reading it is much smaller than the risk of credential stuffing.

A one-hour plan after a breach notice

1. Confirm the incident on the official website or app.
2. Reset the password there, with a new unique one from a password manager.
3. Turn on two-step verification or a passkey for that account.
4. Change the password everywhere you reused it, email first.
5. Check your email address on a breach-checking service.
6. Review the account's recent activity, recovery details and connected apps.
7. Read what other data was exposed and act on it, such as replacing a card.
8. Be alert for phishing mentioning the incident for the next few months.

Most people finish the whole plan within an hour, and the password manager and two-step setup make every future breach notice much quicker to handle.

Steps one to four matter most; the rest can wait a day if you are short of time.

Keep it in proportion

Breach notices can feel alarming, but for most people with unique passwords and two-step verification, a breach at one service is a minor event: a password to change and a few weeks of extra caution with emails. The serious harm comes from reused passwords, ignored notices and phishing that follows. Working through the plan on this page once turns each future notice into routine maintenance. There is no need to abandon a service just because it was breached, if it handled the incident responsibly and you have secured your account.

It also helps to remember that companies that announce breaches openly and force resets are often the safer choice than ones that never say anything.

A clear plan replaces worry with a short list of tasks.

Make it a habit

The best time to prepare for the next breach is now, while nothing is wrong. Move important accounts into a password manager, replace reused passwords a few at a time, turn on two-step verification as you go, and switch to passkeys where offered. Review your password manager's security report every few months; most flag reused, weak and breached passwords automatically. Ethan spends ten minutes a month on this, and his last three breach notices each took less time than reading them.

Pick one category per month, such as shopping sites, then social media, then old forums, and the whole list is clean within a season.

Small, regular effort beats a single overwhelming cleanup.

What this page said in 2019

The original version of this page, from August 2019, reported Hostinger's password reset as part of a technology news roundup. The specific incident is long past, but forced password resets keep arriving in inboxes, and the questions people ask are always the same: is this real, and what else should I do? This rewrite answers those questions.

The advice has also improved since then: passkeys and built-in breach checks in browsers make the response easier today than it was in 2019.

Breaches will keep happening; responding well is now a routine skill, like locking the door.

Password reset after a breach: frequently asked questions

Ethan's accounts now each have their own password, none of which he knows by heart, and the important ones ask for a code or a fingerprint. The next breach notice he got, months later, took him two minutes: reset the one account, done, because nothing else shared that password. That is the real lesson of forced resets. You cannot stop companies being breached, but you can make sure a breach at one never becomes a breach at all of them.

Revision note. Written October 2, 2026, rewriting our 2019 news roundup item on Hostinger's password reset into a complete guide to responding when a service resets your password after a breach. May every breach notice you receive be a two-minute fix.