Guide 🚨 Your data just leaked — the 60-minute breach response playbook

The email arrived: "We take your security seriously, but…" — your data was in a breach. Heart racing? Good. Channel it. This is the exact playbook, in order, no fluff. Save it before you need it.

⏱️ Minutes 0–10 → stop the bleeding

1. Change the breached account's password — from a device you trust. Done is better than perfect; make it long and unique.
   
2. Change your EMAIL password next — your inbox is the reset button for every other account you own. If the breach touched the same password you use for email, that inbox is the crown jewels. Secure it first, always.
   
3. Kill all sessions — every major account has "log out of all devices" in security settings. Use it. Attackers holding an active session don't care about your new password.
   

⏱️ Minutes 10–25 → find the blast radius

• Run your email at haveibeenpwned.com — which breaches, what data (passwords? phone? cards?)
  
• Reuse check: anywhere else you used that same password = also compromised. Yes, "same password but with a ! at the end" counts.
  
• Check the breached service's official notice for what leaked: passwords are bad, but card numbers + CVV are a different emergency (jump to the money section below).
  

⏱️ Minutes 25–45 → harden the doors

1. Turn on 2FA everywhere it leaked — authenticator app over SMS where possible
   
2. Revoke app passwords / API tokens / connected apps — the "log in with Google" trail you forgot about
   
3. Screenshot the breach email and note the date — useful if you later need to dispute fraud
   

⏱️ Minutes 45–60 → money defense (only if financial data touched)

• Card leaked → block/replace it via your bank app. Ten minutes of admin beats months of disputes.
  
• Watch UPI/banking SMS alerts like a hawk for the next 30 days
  
• India: report fraud fast at cybercrime.gov.in or helpline 1930 — speed genuinely matters for freezing stolen money
  

🎣 The second wave nobody warns you about
The breach itself is rarely the attack — the phishing that follows is. For weeks after a leak you'll get extremely convincing "security alert" emails referencing the real breach by name. Rules:

• Never act through links in such emails — open the official app yourself
  
• Real services never ask for your current password "to verify"
  
• Urgency = bait, every single time
  

🧱 Next weekend (the permanent fix)
Password manager + unique passwords means the next breach email becomes a 5-minute chore instead of a heart attack. The full setup is in the weekend guide: The cybersecurity starter path.

Your turn: What's the worst breach email you've received — and did you act in time? Stories below help the next person. 👇