What to do after a data breach

When a company holding your information is breached, you’ll usually get an email or letter saying what was taken. These notices are alarming and vague in equal measure. Here’s how to translate one into a calm action list.

Step 1: Work out exactly what leaked

Not all breaches are equal. Risk climbs sharply depending on the details involved:

Step 2: Change exposed passwords — and their twins

If your password was exposed, change it on the breached service and on every other account where you used the same or a similar one. This is the moment a password manager starts paying for itself. Check haveibeenpwned.com (run by a respected security researcher) to see if your email appears in known breaches.

Step 3: If identity documents leaked, call IDCARE

IDCARE is Australia and New Zealand’s national identity and cyber support service — free, expert, and funded to help exactly you, right now: 1800 595 160. They’ll tell you whether to replace your licence or passport, how to get a Medicare card reissued, and how to protect your credit file. You can also ask for a free credit ban from Equifax, Experian and illion, which stops anyone (including you) opening credit in your name until you lift it.

Step 4: Expect the follow-up phishing

Breaches are followed by waves of scam calls, texts and emails that use your real details to sound legitimate: “Following the recent breach, we need to verify…”. For months after a breach, treat any contact that references it as suspicious. Verify independently, every time.

Step 5: Know your rights

Under the Notifiable Data Breaches scheme, Australian organisations covered by the Privacy Act must notify you and the OAIC when a breach is likely to cause serious harm. You can complain to the organisation first, then to the OAIC (1300 363 992) if their response is inadequate. Serious mishandling can attract significant penalties — your complaint matters.