The short version: what to do first
Finding out your details were caught in a data breach can be worrying. The good news is that being in a breach does not automatically mean someone has accessed your bank account, email or computer. What you need to do depends on which details were exposed.
Start with these steps, then use the sections below for your situation.
- Check that the breach notification is genuine.
- Find out exactly which of your details were exposed.
- Check your email address for other known breaches.
- Change affected or reused passwords, and turn on extra sign-in protection.
- Contact your bank or identity-document provider if relevant.
- Watch for unusual account activity and convincing follow-up scams.
1. Make sure the message is real
A legitimate business may contact you by email, text or letter about a breach. But scammers can copy those messages, sometimes using real details about you to sound convincing.
- Do not rush to click a link. Open the organisation's official website or app yourself, rather than following the message.
- Look for its breach notice, help page or customer support number. If you need to call, use a number you found independently.
- Ask what information was affected, when it happened, whether your account was accessed, and what the organisation recommends.
- Keep the notification and any reference number somewhere safe. Details may be updated as the investigation continues.
The Australian Cyber Security Centre (ACSC) recommends confirming unexpected messages through an organisation's official contact channels before taking action.
2. Check which details were exposed
Not every breach has the same risk. Read the notice carefully for the exact information involved.
If it was your name, email address or phone number
Be more careful with unexpected calls and messages. A scammer who knows your name or which business you use can sound genuine. You do not normally need a new email address or phone number just because those contact details appeared in a breach.
If it included your password or login details
Change the affected account's password through its official website or app. If you used that same password anywhere else, change it on those accounts too. Give your main email account particular attention, because it can be used to reset passwords elsewhere.
If it included bank or payment-card information
Contact your bank or card provider promptly using its official app or phone number. Explain what was exposed and ask whether the card needs replacing or extra account protection is appropriate. Check recent transactions and report anything you do not recognise.
If it included identity documents
A driver licence, Medicare card or passport needs more tailored advice. Do not assume every document must be replaced; check the issuing authority's current guidance and what details were taken. The next section covers common Australian examples.
3. Secure your important accounts
If a password was exposed, or you see unfamiliar activity, start with the affected account and your email. Then check any other accounts that used the same password.
- Choose a different password for each account.A password manager can create and remember strong passwords.
- Turn on multi-factor authentication (MFA).This is an extra sign-in check, such as a code from an authenticator app. A passkey is another secure option where offered.
- Check account activity. Review recent sign-ins, connected devices and recovery phone numbers or email addresses. Sign out unfamiliar sessions.
- Check your email settings. If you suspect your email was accessed, look for forwarding rules or recovery details you did not set up.
If you have lost access to an account, use the provider's official account-recovery process. A data breach alone is not evidence that your own device has malware, so a factory reset is not usually the first step.
4. Protect your identity and money
Australian identity-document rules depend on the document. If any of these details were exposed, use the official guidance rather than a link from an unexpected message.
NSW driver licence
Service NSW explains that you only need to replace your NSW driver licence card after a breach if both the licence number and card numberwere compromised. A replacement card changes the card number, while the licence number remains the same. If unsure what was exposed, confirm with the affected organisation and Service NSW.
Medicare or myGov details
If your Medicare card number was exposed, Services Australia provides advice on replacement cards and securing myGov. Review your myGov sign-in settings and account activity, and contact Services Australia if you notice anything suspicious.
Australian passport
The Australian Passport Office says a passport affected by a data breach can still be valid for travel. It explains the options to keep, replace, renew or cancel it. A leaked passport number does not automatically require immediate cancellation.
Unfamiliar loans, accounts or transactions
Contact the bank or provider immediately. Keep records of unusual activity, and seek free identity-support advice from IDCARE if you think someone may be using your identity. Do not pay someone who contacts you unexpectedly claiming they can recover stolen funds.
5. Be careful of scams that follow a breach
Once someone has your name, phone number or other details, a fake message can look surprisingly believable. They may claim to be from your bank, a government service or the company that was breached.
Be cautious if someone:
- Pressures you to act immediately or threatens to lock an account.
- Asks you to share a password, one-time sign-in code or card details.
- Asks you to install remote-access software to "secure" your device.
- Tells you to move money to a "safe" account or pay a recovery fee.
End the conversation and contact the organisation using its official website, app or a trusted number you already have. Knowing some of your personal details is not proofthat a caller is genuine.
6. Know when and where to get help
- If money or bank details are at risk: contact your bank immediately to ask about stopping transactions or replacing affected cards.
- If you are worried about identity theft: IDCARE offers free Australian identity and cyber support. You can call 1800 595 160.
- If an account was accessed or your identity was misused:follow the ACSC's recovery and reporting advice, including ReportCyber where appropriate.
- If a scammer has contacted you: report the attempt to Scamwatch. Save the relevant messages or transaction records.
The ACSC also offers free guidance on 1300 CYBER1 (1300 292 371). There is no need to purchase a new computer or expensive security software simply because a company holding your details had a breach.
Common questions
Does a data breach mean my computer has been hacked?
No. A breach may have happened at a business that stored your information. It does not, by itself, mean your computer or phone has been infected or accessed.
Should I change all my passwords?
Prioritise passwords that were exposed, reused on other websites, or associated with accounts showing suspicious activity. Use different passwords for different services and turn on extra sign-in protection where available.
Can I check whether my email was in a breach?
Have I Been Pwned can check an email address against breaches in its database. It cannot show every breach, so a result with no matches is not a guarantee. Only enter your email address into its breach-checking form, not your account password.
Official Australian resources
The advice above is based on the following public resources. Because the right response depends on the exact breach, follow any more specific advice from the relevant official organisation.