A breach rarely arrives as one dramatic moment. It shows up as a notification email, a login you don't recognise, or a friend asking why you sent them a strange link. What you do in the next hour decides how much of it sticks. Most of the lasting damage comes not from the breach itself but from the recovery around it: passwords changed in the wrong order, sessions left open, devices never checked.

Below are the errors that cost people the most, plus the sequence that keeps you ahead of them.

Start With the Order of Operations

Sequence matters, because each step protects the next one. Change a password on a device that is still compromised and you have simply handed over the new one.

1. Move to a device you trust. Your phone with current updates, or a computer that has not been near the affected account.
2. Secure your email first. Almost every other account resets through it.
3. Change passwords one at a time, all unique. Email first, then banking and payments, then anything holding money, identity documents or work data.
4. Sign out of all sessions and revoke app access. A new password does not evict a device that is already signed in.
5. Check your two-factor setup. Confirm the phone number and backup codes are yours, and remove authenticator entries you don't recognise.
6. Review recovery details. Backup email, phone number, security questions, trusted contacts — attackers often change these before anything else.
7. Hunt for forwarding rules, filters and connected apps in your mail settings, plus API keys for services you use.
8. Clean your devices. Update, scan, and remove software or browser extensions you did not install.
9. Write it down. What changed, when, and where you reported it.

Work through it in one sitting where you can. Momentum matters more than doing everything perfectly.

Mistake 1: Waiting for Proof

Breach notifications are often vague, and it is tempting to assume the company got it wrong. Assume it didn't. Stolen credentials get tested quickly and automatically against email, banking, retail and social accounts, so the useful window is short.

One related trap is the notification itself. Phishing campaigns copy breach notices almost immediately, complete with a "confirm your identity" button. Reach the company by typing its address yourself or opening its app, never through the link in the message.

Mistakes 2 and 3: Resetting From the Wrong Device, and Trading One Reused Password for Another

Changing passwords on a machine you don't trust

If the account was accessed from your laptop, that laptop is not a safe place to type a new password. Malware and malicious browser extensions can capture what you type, and stolen session cookies can keep an attacker logged in even after the software is gone. Use a different device, or clean the original one first.

Replacing a reused password with a variation of it

Adding a number or an exclamation mark to the old password does not help. Neither does swapping one reused password for another reused one. Use a password manager to generate long, random passwords, and protect the manager with a strong passphrase you have never used anywhere else. Then change every account that shared the compromised password, not just the one named in the notice.

Mistakes 4 and 5: Leaving Sessions Alive and Treating Email as an Ordinary Account

Forgetting sessions, tokens and third-party access

This is the mistake that quietly undoes everything else. Look for a "sign out of all devices" option and use it, then sign back in yourself. Check which apps have permission to read your mail, files or contacts, and remove anything you don't recognise. For developer and cloud accounts, rotate API keys and revoke old tokens. In email settings, delete forwarding rules, filters and delegated access you did not create — these are favourite hiding places.

Changing email last

Email is the master key. Password reset links, security codes and account notices all land there. Change that password first, then check the recovery options attached to it. Make sure your two-factor method still works before you remove anything; locking yourself out mid-cleanup is its own kind of bad day.

Mistakes 6 and 7: Skipping Devices, and Going Quiet

Assuming the account was the only thing touched

Check every device that ever signed in: phones, tablets, laptops, the old desktop in the spare room, the browser you never close. Update the operating system and apps, run a full scan, and review installed extensions and profiles. If you keep backups, confirm the most recent one predates the incident before you rely on it — restoring from a clean backup is often faster than trying to pick out what was tampered with. And test that the backup actually restores. A backup you have never tested is a hope, not a plan.

Handling it alone and telling nobody

Quiet feels safer,

Photo: vdnhieu / Pixabay