Finding your information in a record is unsettling, but the response is straightforward. Work through the steps that apply to you. Start with the accounts that matter most — email, then anything tied to money or identity.
Passwords
- Change the password on any account where an exposed password might be reused.
- Never reuse passwords across sites. A unique password per account limits the blast radius.
- Use a password manager to generate and store long, random passwords — you only remember one.
Add a second factor
- Turn on multi-factor authentication (MFA) everywhere it’s offered.
- Prefer passkeys or an authenticator app over SMS codes where possible.
- Save your recovery codes somewhere safe and offline.
Cut off active access
- Sign out of all sessions / “log out everywhere” in your account security settings.
- Revoke sessions and connected apps you don’t recognize.
- Check email filters and forwarding rules — attackers add these to intercept mail quietly.
If a device may be compromised
If information like session cookies or saved passwords was taken, changing passwords alone may not be enough — malware on the device can capture the new ones too.
- Run a reputable malware scan and remove anything suspicious.
- Review and remove browser extensions you don’t fully trust.
- After cleaning the device, change passwords again from a device you trust.
- If you can’t be confident the device is clean, a full OS reinstall is the safest reset.
Secure the accounts that matter most
- Email: it can reset everything else — lock it down first, with MFA and fresh recovery options.
- Discord: enable MFA, check authorized apps and sessions, and reset your password.
- Google / Microsoft: run their security checkup, review devices and connected apps.
- Financial accounts: enable alerts, review recent activity, and add MFA.
Afterwards
- Review connected apps and remove anything you no longer use.
- Keep an eye on your accounts for unexpected logins or messages over the following weeks.
- Consider a credit or identity monitoring service if financial data was involved.
If a record here is yours and you want it removed, you can request removal — we’ll review it and may follow up privately to verify.