DATA BREACHACT FAST.

A company you use emails to say your personal information has been exposed. Or you notice an unfamiliar sign-in, a password-reset notice you did not request, or messages being sent from your account. Your first hour matters—not because there is a legal 60-minute deadline, but because prompt action can limit account takeover, payment fraud and further misuse of your identity.

AI can make the situation more confusing. Criminals may use leaked names, addresses and other details to produce remarkably convincing follow-up scams, including polished phishing emails or impersonation calls. The UK's Information Commissioner's Office (ICO) warns that criminals can exploit information exposed in breaches to contact people while pretending to represent trusted organisations.

This guide gives you an organised first-60-minutes response plan for an individual or household. It distinguishes three very different situations: a company announces that your data was exposed, you believe someone has accessed an account, or you know you handed details to a scammer. The right response depends on what actually happened.

First, identify which type of incident you are dealing with

The phrase data breach can describe information lost or disclosed by an organisation. It does not automatically mean your personal device has been infected or that someone is actively logged into your accounts. An account takeover is different, and an attempted phishing message may involve no compromise at all.

Do not assume a warning message is genuine merely because it mentions an actual recent breach. Criminals commonly exploit public news and stolen details to impersonate the affected company. Open the company's known official app or website directly instead of following a recovery link in an unexpected email.

Minutes 0–10: stop the immediate harm

Start with the highest-stakes issue. If money is moving, contact the bank. If someone else controls your main email account, protecting that account may take priority over less important logins. If you are unsure whether a company notification is authentic, verify the notice without entering credentials into a supplied link.

1. Check for active financial harm. If you have noticed payments, transfers or use of a card you did not authorise, contact your bank immediately using its official app, card number or independently verified contact details.
2. Stop engaging with a suspicious caller or message. Do not share additional passwords, one-time codes or remote-control access.
3. Use a trusted device if necessary. If your computer may be compromised, use a separate device you believe is secure to begin protecting important accounts.
4. Confirm the incident type. Note whether you have an actual breached-account alert, a provider notification or merely an unverified social-media claim.
5. Keep basic evidence. Save the date, message and essential details without redistributing exposed personal information.

The UK National Cyber Security Centre's response guidance advises immediate bank contact for exposed financial details, account recovery for suspicious logins, and antivirus scanning where malicious software may have been installed.

Minutes 10–20: secure your main email account

Your email inbox is often the reset route for banking-adjacent services, shopping accounts, social networks and professional tools. An attacker who controls your inbox may intercept recovery links or reset other accounts. That makes your primary email particularly important.

Open the genuine email provider through a trusted app or a saved website address. Check recent sign-ins and security alerts. If you suspect unauthorised access, change the password or recover the account using the provider's official process, sign out unfamiliar sessions where supported, review recovery numbers and addresses, and enable strong authentication.

Do not overlook mailbox rules and forwarding settings. An attacker may set mail to forward elsewhere or hide messages in a folder. If an account has been taken over, removing a suspicious rule can be as important as replacing a password.

In April 2026 the NCSC recommended passkeys or other FIDO2 credentials as more phishing-resistant alternatives to traditional password-plus-code authentication when available. Passkeys are useful, but you still need secure devices and account recovery options.

Minutes 20–30: follow the exposed information

A breach notice should identify, where possible, what categories of information were affected. The appropriate response differs if only a public email address was exposed compared with a password, payment card number, passport scan or sensitive medical record.

It is not always possible to know everything in the first hour. If the organisation is investigating, record what has been confirmed and what remains unknown. Ask the organisation for updates through its official channel rather than guessing.

Minutes 30–40: protect connected accounts

Many people reuse passwords, and a compromised account may have access to linked apps, saved payment methods or cloud files. After your main email is secure, identify the accounts with the greatest consequences: banking, password manager, primary cloud storage, shopping services with saved cards and accounts controlling other devices.

Prioritise accounts that reused an exposed password or share a compromised recovery address. Use unique strong passwords where passkeys are unavailable. Review connected third-party applications, authorised devices, sign-in histories and recovery methods. Revoke unknown connections where supported.

If an attacker may still have device or browser control, changing passwords on the compromised device alone may not protect you. Follow a reputable incident-recovery procedure and get qualified assistance if needed. An NCSC response guide distinguishes exposed banking details, stolen passwords, suspicious devices and work-device incidents.

Minutes 40–50: document and contact the right people

Record only what is needed for a clear incident history: when you became aware, the affected service, what data or money may be involved, actions you took and any report reference. Screenshots of alerts and transaction details can help a provider investigate. Store them securely.

If the incident involves a workplace account or company equipment, contact your employer's IT or security team promptly rather than independently experimenting with its systems. An organisation may need to preserve logs and meet separate reporting obligations. The UK ICO's business breach guidance discusses a 72-hour reporting framework for organisations where required. That is not a personal 72-hour or 60-minute reporting deadline for ordinary individuals.

For financial fraud in England, Wales and Northern Ireland, contact your bank and report through Report Fraud, which replaced Action Fraud in December 2025. Scotland uses Police Scotland. In the United States, the FTC's data-breach guidance directs people to IdentityTheft.gov for personalised US recovery steps.

Minutes 50–60: plan the next day

A first-hour response is not the end. Accounts and providers may take time to investigate; unusual transactions might appear later, and exposed information can be used in future scams. Use the final part of the first hour to decide what you will monitor and when you will follow up.

• Financial accounts: review transactions and set suitable alerts; speak to your provider about protective options if card or account details were exposed.
• Credit and identity: consider checking credit reports and relevant protective services where identity documents or personal identifiers were leaked. The process differs by country.
• Digital accounts: monitor new sign-ins, recovery changes and unusual messages. Check whether other accounts used the same credentials.
• Provider communications: bookmark the genuine incident-update page and note the next expected update.
• Family and contacts: warn people through a trusted channel if your account may have sent fraudulent messages to them.
• Follow-up list: record one or two actions you could not complete, who can help and when you will revisit them.

Do not sign up to an unknown “breach recovery” service advertised in a direct message. A real incident creates opportunities for secondary scams that use leaked information to appear credible.

What does the UK ICO advise individuals?

The UK's Information Commissioner's Office says affected individuals can ask the organisation what happened, what information was involved and what protective steps it plans to take. Its guidance also recommends monitoring bank and credit activity, looking out for scam contact and reporting stolen documents to their issuing organisations.

If you raise a formal data protection complaint with a UK organisation, newer rules in force from June 2026 require the organisation to acknowledge the complaint within 30 days and investigate appropriately. That is the response process for a complaint, not an indication that you should wait 30 days before securing a compromised account.

Where sensitive data has been exposed, consider the personal consequences as well as financial ones. A leaked address or care record may create safety risks requiring specific advice from the provider, police or an appropriate support organisation.

Why AI can make the days after a breach more dangerous

An attacker with leaked personal details can create messages that seem to prove knowledge of your life. A caller might cite the exact company involved, an old address and part of an account number while claiming to be from its security team. A synthetic voice or professional-sounding email adds credibility. The data may be real; the caller's identity may be false.

Never read out one-time authentication codes, passwords or bank PINs because a caller knows your information. Independently open the affected company's official site, contact your bank using your card number or use another known channel. If you receive a convincing call from a loved one during a wider scam campaign, apply the procedure in AI Voice Scam: How to Verify an Emergency Call.

For document, invoice and email impersonation specifically, read AI Phishing: How to Check an Email or Message.

Case study: a breach notification followed by a fake security call

This is a fictional scenario illustrating a common risk pathway.

An online retailer emails customers about a data incident. The company confirms names, email addresses and order details may have been exposed; it does not say passwords were affected. Two days later, a customer receives a polished phone call from a supposed “fraud prevention officer” who knows an actual order number and asks for a one-time banking code to protect their funds.

The customer recognises that knowing a real order does not prove the caller works for the bank. They end the call and open the bank's official app. The bank confirms the call was not authorised. No code is shared and the account remains protected.

The lesson is that accurate information can make a fraudulent request seem trustworthy. Verification must be independent even when the caller's details check out.

What if the breach affects a password manager or your main email?

These are high-impact accounts because they are linked to many other services. Do not assume all saved passwords have been exposed simply because a provider announces a breach; the affected information and technical protections matter. Seek the provider's incident-specific explanation.

If unauthorised access is confirmed or strongly suspected, use official recovery steps from a trusted device, verify secure account recovery and review connected sessions. If a password manager is involved, follow its provider's guidance before performing mass changes; prioritise compromised credentials and linked services instead of making uncontrolled changes that could lock you out.

A reliable printed or otherwise securely stored recovery plan can prevent an account issue becoming a household crisis. Our family impersonation defence plan is a complementary safeguard against attackers abusing exposed names and contact details.

What not to do during the first hour

• Don't rush through links in a breach notification. Verify the notice using the provider's independent website or app.
• Don't pay a “recovery specialist” who cold-contacts you. They may be exploiting a public incident to commit another fraud.
• Don't change every password on a device you suspect is compromised. First secure an appropriate trusted route to account recovery.
• Don't delete useful evidence. Keep relevant alerts and transaction references securely for support or reporting.
• Don't assume no money is gone because you cannot see a transaction yet. Monitor accounts over the following days as advised by your provider.
• Don't upload sensitive records to random breach-checking sites. Use reputable tools and official provider support.

A five-minute readiness exercise before the next breach

You can reduce damage long before any warning arrives. Check whether your main email uses a passkey or strong two-step verification, whether your recovery details are current, and whether you have the genuine contact route for your bank. Identify which accounts contain saved card details, identity documents or sensitive family information.

Then answer this question: If I lost access to my usual phone tonight, could I securely recover my email without using a suspicious link? If not, improve your recovery arrangements while you still have full access.

That small exercise can be more valuable than reading ten alarming headlines about cybercrime.

The bottom line

Data breaches and account takeovers are different events, but both can expose people to follow-up phishing, impersonation and financial fraud. AI can make those approaches more convincing by helping criminals turn leaked details into personalised messages.

Your first hour should be spent reducing real exposure: verify the notification, protect money and critical accounts, use trusted recovery routes, document what happened and plan follow-up. You do not need to diagnose every technical detail before taking sensible action.

Frequently asked questions

What should I do immediately after a data breach?

Confirm whether the notification is genuine, establish what information was affected and protect any compromised accounts or financial details through official channels. The right order depends on the incident.

Do I need to change every password after a company breach?

Not automatically. Prioritise accounts whose credentials were exposed or reused. Use the provider's incident-specific advice, enable strong authentication and check important account recovery routes.

What does the first 60 minutes deadline mean?

It is a practical response framework, not a legal deadline for individuals. UK organisational reporting and complaint obligations have separate rules.

Can criminals use leaked data for AI scams?

Yes. Names, order details and other leaked information can be used in convincing phishing or impersonation attempts. Personal knowledge is not proof that a contact is genuine.

Who do I tell if money was stolen after a breach?

Contact your financial provider urgently. In England, Wales and Northern Ireland, report fraud through Report Fraud; in Scotland contact Police Scotland. Elsewhere use the relevant national service.

Sources and further reading

• UK ICO — What Steps Can I Take After a Personal Data Breach?.
• UK NCSC — Responding to Phishing.
• UK NCSC — FIDO2 and Passkey Security for Individuals (2026).
• UK ICO — New Data Protection Complaints Law (June 2026).
• Report Fraud — Reporting Cybercrime and Fraud.
• US FTC — What To Do After a Data Breach.

Research reviewed 6 November 2026. The first-60-minute timeline is an educational response framework, not a legal obligation or guarantee of recovery. Case study fictional.