Exposure Report

First steps, for your own accounts

What to do after a data breach

This page is for when a company you already have an account with tells you that your data was in a breach, or when you see your own email in a breach notice. It is not a notification about any named incident, and it is not legal advice.

On the account that was named

  1. Change the password, from a device and a network you trust, to a new password you do not use anywhere else.
  2. If the service offers two-factor authentication, turn it on.
  3. Review sessions, app passwords and recovery addresses, and sign out anything you do not recognise.
  4. Read what the company says was taken. A password and an email is a different problem from a payment card or a government ID.

On every other account that shared that password

If the same password was reused, change it on those accounts too, and stop reusing it. A password manager helps you keep a different password for each service; this page does not name a product.

Money and identity

If a card or a bank account was involved, follow the bank’s own process for a possible compromise, and watch statements. If a government ID number was involved, use the official identity-theft or data-protection route for your country — for example, IdentityTheft.gov in the United States, the ICO in the United Kingdom, or the Office of the Data Protection Commissioner in Kenya. Those are public government resources; this site does not run them.

A written picture of your footprint

The free self-check stays in your browser. If you want a written report about your own addresses and usernames, the Exposure Report is $19 (KSh 2,450), or Deluxe $29 (KSh 3,750). Payment is by card via Gumroad, on the pricing page. It is about you only, and it is not a credit report.