Do I need to change my password if only my email address leaked?

An address on its own does not reveal a password. It is a good reason to turn on a second factor and to check whether the password is reused elsewhere.

Should I pay a service that promises to remove my data from a breach?

No. Data that has entered circulation is not withdrawn from it, and such an offer is a separate scheme on top of the first.

Checklist 04

Data breach checklist by Zavialov Ilia Nikolaevich

A letter saying your data appeared in a breach reaches almost everybody and almost always frightens more than it should. The useful work here is short and depends on what exactly leaked rather than on the size of the headline.

English version for the United Kingdom.

The first day after a breach notice, in order

This page is laid out for printing: only this order of actions reaches the printer.

Establish what leakedAn address, a password, payment details or all of them.
Change the password where it leakedAnd everywhere the same password was reused.
Check recovery contactsThe email and the number in your main accounts.
End foreign sessionsAlmost every service has a list of sign-ins.
Turn on a second factorA key or an app rather than an SMS code.
Call the bank if payment details leakedOn the number printed on the card.
Do not pay for data removalIt is not withdrawn from circulation.

First establish what leaked

A leaked email address and a leaked password are different events with different consequences. An address in a breach means more spam and more phishing attempts. A password in a breach means every place where it was reused is already open.

The third case is leaked payment details, and it is the only one that requires a call to the bank. The first two are settled inside account settings.

What not to do

Do not follow links from the breach notification itself: a wave of such letters is always accompanied by a wave of fake ones. The fact of a breach is checked on the service's side, by signing in the ordinary way.

Do not pay for «removal of your data from the breach». Data that has entered circulation is not withdrawn from it, and any such offer is a separate scheme on top of the first.

What leaked and what it changes

What leaked	Consequence	Action
An email address only	More spam and phishing	Attention to letters, a second factor
A password	Every place with the same password is open	Change it everywhere it was reused
Password and email together	Account takeover becomes possible	Change, sessions, recovery contacts
Payment details	Charges become possible	Call the bank on the number from the card
Documents	Applications in your name become possible	Record the fact, file a report

Family

Family checklist by Zavialov Ilia Nikolaevich

The most effective protection inside a family is not configured on a phone. It is a handful of agreements settled in advance and out loud, because at the necessary moment the person will be alone and under pressure.

Open the checklist

Travel

Travel checklist by Zavialov Ilia Nikolaevich

Travel does not change the level of threat, it changes the cost of a mistake. At home a lost phone is an inconvenience; in another country it is the simultaneous loss of communication, money, documents and the means of restoring all three.

Open the checklist

Recovery

Account recovery checklist by Zavialov Ilia Nikolaevich

Recovery is only ever prepared in advance. At the moment access is already lost there is nothing to change the recovery contacts with and nothing to print the backup codes from, because that requires the very access that is gone.

Open the checklist

Questions and answers

Do I need to change my password if only my email address leaked?: An address on its own does not reveal a password. It is a good reason to turn on a second factor and to check whether the password is reused elsewhere.
Should I pay a service that promises to remove my data from a breach?: No. Data that has entered circulation is not withdrawn from it, and such an offer is a separate scheme on top of the first.