What Happens When Your Password Is Stolen?

A breach notification email is alarming precisely because most people don't know what happens next. Understanding the actual mechanics makes it much easier to respond correctly — and quickly.

Step one: your credentials end up in a dump

When a service is breached, attackers typically walk away with a database containing usernames, email addresses, and passwords — ideally hashed and salted if the company did things right, but sometimes in plain text if they didn't. That data is usually sold, traded or published on forums and marketplaces, often within days.

Step two: the password gets cracked, if it needs to be

If the password was hashed with a strong, slow algorithm (like bcrypt or Argon2), attackers have to crack each password individually, which is expensive and slow for anything reasonably long and random. If it was hashed with a weak or fast algorithm, or stored in plain text, this step is skipped entirely. Either way, weak and common passwords are cracked first and fastest — see our piece on the most common passwords for why.

Step three: automated reuse attempts, everywhere

This is the step that actually causes most of the damage. Attackers take the breached email-and-password pairs and automatically try them against banks, email providers, social media and shopping sites — a technique called credential stuffing. If you reused that password anywhere else, those accounts are now exposed too, even though they were never breached themselves.

What to actually do, in order

1. Change the password on the breached site immediately, using a newly generated, unique password.
2. Check where else you used that same password and change it there too — this is the step people skip, and it's the one that matters most.
3. Enable two-factor authentication everywhere it's offered, especially email, since email is usually the recovery path into everything else.
4. Check for further exposure using a breach-checking service like Have I Been Pwned to see what else that email address has appeared in.
5. Watch for follow-up phishing. Breach data is often used to craft convincing scam emails referencing real account details.

The long-term fix

None of this is dangerous if every account already had a unique, generated password stored in a manager — the blast radius of a breach shrinks to exactly one account. That's the entire argument for never reusing a password in the first place.