My Password is Compromised

Now What?

February 11, 2025

So, you’ve found out your password has been compromised. Don’t panic—but act fast. Whether it was leaked in a data breach or you suspect foul play, quick action can protect your personal data, finances, and business accounts from further risk.

Here’s a step-by-step guide to lock things down and prevent future issues.

1. Change Your Password Immediately 🔑

Your first move? Change that password—right now. Here’s how to do it right:

✅ Use a Password Manager – Built into your browser or use Bitwarden or 1Password, generate and store strong passwords.

✅ Make it a Passphrase, Not a Password – A random mix of words is harder to crack than a single word with numbers and symbols.

  • Example: Tr33!Sunset-HappyCoffee (long and unpredictable = stronger security).

✅ Go for 12+ Characters – The longer, the better.

✅ No Lazy Substitutions – "P@ssw0rd" is still weak. Mix words, symbols, and numbers for real strength.

2. Enable Multi-Factor Authentication (MFA) 🔐

If your password was stolen, MFA is your safety net. Hackers who have your login won’t get in without your second factor.

🚀 Use the strongest MFA methods:

  • Best Option: FIDO-based authentication (e.g., Face ID, fingerprint, YubiKey security keys).

  • Next Best: App-based authenticators (Google Authenticator, Authy, or Microsoft Authenticator).

  • Avoid SMS-based MFA if possible—SIM-swapping attacks are a real threat.

Turn on MFA for every account—especially banking, email, and business logins.

3. Check Where Else You Used This Password 🔄

🔎 If you reused the same password elsewhere, change it immediately on those accounts too.

  • Track where you’ve used similar passwords – Business owners check critical platforms (banking, services with customer data, email).

  • Make every password unique – This prevents one stolen password from compromising multiple accounts.

4. Monitor for Breach Alerts & Take Action 🚨

🛠️ Check if your email or passwords have been leaked:

  • Have I Been Pwned – See if your credentials were exposed in known breaches.

  • Mozilla Monitor – Get free alerts if your email is found in a breach.

  • Google Chrome Password Checkup – (Go to https://passwords.google.com) to scan saved passwords for breaches.

👨‍💼 For businesses: Use Have I Been Pwned’s Domain Search to monitor work emails across your company.

5. Watch for Suspicious Activity & Lock Down Accounts

🚔 Stay alert for signs of unauthorized access:

  • Unexpected login alerts

  • Unrecognized transactions

  • Emails about password resets you didn’t request

✅ Take action immediately:

  • Sign out of all devices from your account’s security settings.

  • Review account recovery options – Ensure your backup email and phone number are correct.

  • Enable login alerts – Get notified if someone tries to sign in from a new device.

6. Reduce Password Use: Go Passwordless When Possible 🔓

Passwords are a necessary evil, but you can reduce how many you need to remember:

💡 Use "Sign in with Google, Apple, or Microsoft" instead of creating new passwords.
💡 Consider passwordless logins with biometrics or passkeys for services that support them.

Fewer passwords = less risk of compromise.

Bonus: For Canadian Small Businesses 🇨🇦

📢 Protect your business from cascading breaches:

  • Domain Breach Monitoring – Use Have I Been Pwned’s Domain Search to check if employees' emails have been exposed.

  • Employee Security Training – Educate staff on phishing, password security, and recognizing cyber threats.

  • Cybersecurity Grants – The Canadian Digital Adoption Program (CDAP) offers funding to improve cybersecurity for small businesses.

  • Enforce MFA in the Workplace – Implement Okta, Duo, or Microsoft Entra ID to strengthen team login security.

Final Thoughts 💭

A compromised password doesn’t have to lead to disaster—but only if you act fast. Following these steps can contain the damage and prevent future breaches.

🔹 Take five minutes to check your accounts, enable MFA, and update any reused passwords.
🔹 Want more security tips? Subscribe to The Click Code to stay ahead of cyber threats!