Which passwords to change first after a breach
2 min read · Updated October 15, 2026
Change your email password first, then financial accounts, then anything that stores payment details, then social media and cloud storage, and finally low-value accounts. Email comes first because attackers use it to reset every other password.
Priority 1: your email accounts
If someone controls your inbox, they can reset passwords everywhere. Secure each email address you use, especially the one tied to banking and recovery.
Priority 2: money
- ✓Banking and credit card apps.
- ✓Payment services and wallets.
- ✓Shopping accounts with saved cards.
- ✓Insurance, tax and investment portals.
First, see what was actually exposed
Before you change anything, find out whether your address shows up in known breach records. The free check takes seconds.
Priority 3: identity and data
- ✓Cloud storage and photo libraries.
- ✓Social media accounts, which scammers use to defraud your contacts.
- ✓Work accounts and single sign-on logins.
- ✓Phone carrier and mobile account portals, which can enable SIM swapping.
Priority 4: the long tail
Forums, newsletters and one-off shopping sites carry less risk. Change them over time or delete the accounts. A password manager makes this far less painful because it generates and stores new passwords as you go.
Frequently asked questions
Can I change them all in one sitting?+
For a handful of key accounts, yes. For the rest, work through them over a few days using a password manager.
Should I log out of everything afterwards?+
Yes. Changing a password does not always end existing sessions, so sign out of all devices after changing it.
What about two-factor codes?+
Turn on two-factor authentication as you go, starting with email and financial accounts.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.