Change your passwords after a data breach: what the UK advice says

If an organisation tells you your data was caught up in a breach, your passwords are one of the things worth looking at. This guide brings together advice from the Information Commissioner's Office (ICO), the UK data protection regulator, and the National Cyber Security Centre (NCSC) on how to protect your accounts afterwards.

A note on scope. The ICO page on breaches recommends using strong passwords and multifactor authentication. It does not give a step-by-step process for changing every password, and it does not say which accounts to change first. The detail below on how to build and manage passwords comes from the NCSC.

What the ICO says about passwords after a breach

The ICO explains that, sometimes, hackers share personal information online after a personal data breach and criminals can use it to scam people. It says you can take some simple steps to protect yourself from harm and disruption. One of them is to use strong passwords, and multifactor authentication if it is available, to protect your accounts.

Other steps on the ICO list are worth doing alongside:

• Report details of lost or stolen documents, such as passports, driving licences, credit cards and cheque books, to the organisation that issued them.
• Check your bank statements and get a copy of your credit report. Look for any transactions, accounts or activity you do not recognise, and contact your bank, building society or credit card company if you spot anything unusual.
• Watch out for suspicious phone calls, emails, text messages and websites. Criminals can use information from data breaches to impersonate trusted organisations, such as your bank or HMRC, with convincing calls or messages.

Why reusing a password is risky

The NCSC explains the problem clearly. If you use the same password across different accounts and one of those accounts is compromised, a hacker can try the same password on your other accounts and potentially gain access to them too.

This is why the NCSC says passwords for online accounts should be strong and should not be reused, especially for important accounts like email, banking, shopping and social media.

Turn on two-step verification first

According to the NCSC, the first and most important step is to turn on two-step verification (2SV). It helps protect you if your password gets phished or otherwise compromised. The NCSC says using different passwords for your accounts then provides even more security.

The ICO's mention of multifactor authentication points in the same direction. The ICO page does not explain how to switch it on for any particular service, so check each service's own help pages.

Build a password from three random words

The NCSC says weak passwords can be cracked in seconds, and that the longer and more unusual your password is, the harder it is for a cyber criminal to crack. A good way to get there is to combine three random words. Its example is applenemobiro.

The NCSC explains why it recommends this. A password made of three random words is strong enough to keep criminals out but easy enough for you to remember. It describes the older advice, to make passwords very complex with random characters, symbols and numbers, as not helpful, because most of us have lots of passwords and memorising lots of complex ones is almost impossible.

What to avoid

The NCSC lists some things not to do:

• Avoid the most common passwords that criminals can easily guess, such as the word "password".
• Avoid passwords built from significant dates, such as your birthday or a loved one's, from your favourite sports team, or from family and pet names. Most of these details can be found within your social media profile.
• Do not rely on swapping characters, for example replacing the letter o with a zero. Cyber criminals know these tricks as well, so the password will not be significantly stronger, but it will be harder for you to remember.

Use a password manager for the rest

Creating different passwords for all your accounts and remembering them is difficult, even impossible, according to the NCSC. A password manager is one tool that can help. These might be built into your browser already, or you can install one from a third party.

The NCSC says a password manager stores passwords safely, so you can have a unique password for each service without having to remember it. It lists features that often come with it:

• automatic password generation, to create a strong and unique password for each account,
• an autofill function, which also helps protect you from phishing attacks because the password will only autofill on the correct website,
• synchronising your passwords across your different devices,
• compromise warnings that a password has been breached or leaked.

Browser or third-party manager

The NCSC says it is safe to let your own devices save passwords, and it is the easiest way to remember them, particularly if you use the same operating systems or browsers across devices. A third-party manager has one main benefit over the browser: it can synchronise passwords across a mix of different browsers and devices.

When choosing, the NCSC suggests thinking about whether it needs to work across devices, whether you want to specify the kind of passwords it generates, whether you will pay or prefer a free version, and any extra features such as being notified if a password is found in a data breach. The best one, it says, is the one that best meets your needs and that you find easiest to use.

Look after the primary password

It is really important to remember your primary password, as it is the key to your password manager. Many managers offer recovery options. The NCSC also says to switch on two-step verification on the password manager account, so that even if a cyber criminal knows the primary password, they still cannot access your account.

Shared devices

On a shared device outside your home, such as a computer at a college or library, the NCSC says you should never save your password in the browser. In a shared household, it says the safest option when unsure is to not allow the browser to save passwords.

Writing passwords down

The NCSC says some people prefer to write passwords in a journal or password book, and that this can be done safely because an attacker would need physical access to where the passwords are stored. Its considerations include making sure passwords are not predictable, using a strong and separate password for your email account, not breaking a service's terms and conditions, and thinking about who has access to the room where they are kept. It also notes you will be at greater risk of phishing, since you must check manually that a website is genuine.

Passkeys

The NCSC notes that many websites and apps now let you sign in with a passkey, which it describes as a safer and easier alternative to passwords. It recommends making passkeys your first choice wherever they are offered. For accounts that do not offer them, it says to continue using a strong, unique password and two-step verification.

Other ICO steps if you are worried

The ICO also says you can complain to the organisation and ask what happened, what information was affected and what steps it plans to take. The organisation has 30 days to acknowledge your complaint. For extra protection, the ICO mentions Cifas protective registration, for which there is a fee, and says that if you are unsure whether a call from your bank is genuine, you can hang up and call the number on the back of your card.

Seeing what a breach may have exposed

Remove Me offers a free analysis with no account needed. You enter your details, and the service searches publicly visible web results, known public data breaches (Have I Been Pwned) and a register of data brokers, then shows a report. The report is unlocked with a 6-digit code sent by e-mail. Remove Me does not yet send erasure requests on your behalf. The analysis only covers known public breaches, so a report that shows nothing does not mean you are unaffected.

What the sources do not say

None of the three pages gives a deadline for changing passwords, an order for which accounts to change first, or a way to tell which password was exposed. The NCSC does list email, banking, shopping and social media as important accounts, which is as far as the sources go.