An email arrives with a subject line like “Important update regarding your account security” and your stomach drops a little. It names a company you’ve definitely used, maybe a retailer, maybe your super fund’s portal, maybe a smaller outfit you forgot you’d ever signed up to. Somewhere in the second paragraph it says your details were involved in a data breach notification sent out under Australia’s Notifiable Data Breaches scheme. Then what?
We get asked this a lot, usually by someone standing in their kitchen holding a phone, slightly panicked, wondering if they need to cancel every card they own right now. Mostly, no. But the first sixty minutes do matter, and the order you do things in matters more than people expect. Our take, after watching readers go through this dozens of times over the years: the instinct to panic-change everything at once is actually the wrong instinct. Slow down for about five minutes before you touch anything.
Read the notice properly first
Before changing a single password, work out exactly what was taken. Under the Office of the Australian Information Commissioner’s Notifiable Data Breaches scheme, organisations are required to tell you what categories of information were exposed, not just that “a breach occurred”. That distinction changes everything about what you do next.
A breach involving just email addresses and names is annoying, mostly because it feeds spam and phishing lists. A breach involving passwords, even hashed ones, means you need to change that password and anywhere you reused it. A breach involving government ID numbers, Medicare details, or financial account numbers is a different category of problem entirely, and needs the identity-theft steps further down. Read the notice twice. Companies sometimes bury the actual scope in the third paragraph after a lot of reassuring corporate language about how seriously they take your privacy, which, fair enough, is standard legal boilerplate, but it’s not the bit you need.
If the notice is vague, that’s worth noting rather than ignoring. The OAIC’s Notifiable Data Breaches scheme guidance sets out what organisations are supposed to disclose, and a notice that dodges specifics is a reasonable reason to ring the company and ask directly what was in the exposed dataset. We’ve seen old breach notices from smaller Australian retailers that ran to barely four sentences. That’s not good enough, and you’re entitled to ask for more.
Change the one password that matters, not all of them
Here’s the mildly unpopular opinion: we don’t think you need to rush around changing every password you own in the first hour. We know that’s the standard advice, and it sounds responsible, but it’s also exhausting, and exhausted people make mistakes, reuse passwords under pressure, or give up halfway through and leave half their accounts worse off than before.
What actually matters is changing the password for the breached account itself, immediately, and then checking whether you’ve used that same password anywhere else. If you have, and plenty of us have at some point, change it on those accounts too, starting with email and banking. This is exactly why we’ve been banging on about password managers for a while now. If you’re not using one, our comparison of password managers for Australians is a reasonable place to start this afternoon rather than mid-panic.
A password manager also solves the reuse problem permanently, because it generates a different long password for every single site and remembers them for you. The reasoning here is simple: a breach only cascades into other accounts if you’ve used the same key on multiple doors. One stolen key, one door. That’s the whole point of the exercise.
Turn on two-factor while you’re in there
While you’re already logged in to change the password, switch on two-factor authentication if it isn’t already running. That’s the second code, usually a six-digit number from an app or a text message, that you need alongside your password to log in. It means a stolen password alone isn’t enough for anyone to get in.
We’d nudge you towards an authenticator app over SMS codes where the account supports it, since SMS can theoretically be intercepted through a SIM swap, where a scammer convinces your telco to move your number onto a device they control. It’s not common, but Australian telcos have tightened identity checks around porting numbers precisely because of incidents like this. Either way, two-factor of some kind beats none, and arguing over which type is the best use of your remaining minutes in the first hour is a trap. Just turn something on.
Check if your email shows up elsewhere
This is the bit people skip. A single breach notification is often just the one you happened to get told about. There’s a reasonable chance your email address has appeared in other breaches you were never formally notified of, particularly from smaller or overseas services that don’t fall under Australian notification rules at all.
Free breach-checking tools let you type in an email address and see which known breaches it’s appeared in. We’d treat the exercise as a health check, not a one-off. Running it again every six months or so, especially after you sign up to new services, is a cheap habit that costs about ninety seconds and tells you far more than any single notification email ever will. We’ve had readers discover, via one of these tools, that an account they’d completely forgotten existed, something like an old forum sign-up from a decade ago, was sitting in three separate breach datasets.
Watch for the follow-up scam, because it’s coming
Here’s the part that genuinely deserves some urgency, more than the password-changing does. Breach data gets used for follow-up phishing, often within days. Scammers know the company name from the leaked database, so they send an email or text that looks exactly like it’s from that retailer or bank, references the breach you just heard about, and asks you to “verify your account” or “confirm your payment details” by clicking a link.
It works because it sounds plausible. You just got told there was a breach, so an email asking you to secure your account doesn’t feel odd, it feels expected. That’s the trick, and it’s a good one, frankly.
Don’t click links in any email or text about the breach, even if it looks like it’s from the actual company. Go to the organisation’s website directly by typing the address in yourself, or use the app you already have installed. If someone calls claiming to be from the company’s fraud team, hang up and ring the number on your card or an old statement, not a number they give you over the phone.
If you do get caught out, or even just see something suspicious, report it through Scamwatch, which is run by the ACCC and tracks these campaigns nationally. It genuinely helps other people, because patterns reported early get publicised faster, sometimes before the second or third wave of the same scam hits.
When ID documents are involved, go further
If the breach notice mentions a driver’s licence number, passport number, Medicare number or similar, the first hour needs one more step: call the issuing agency, not just the breached company. Services Australia, your state’s licensing authority, and the Australian Passport Office all have processes for flagging a document as potentially compromised.
This matters because ID numbers don’t expire the way passwords do. You can’t easily reset your driver’s licence number the way you’d reset a login. For anything involving a serious volume of ID data, it’s worth contacting the Australian Cyber Security Centre, which runs ReportCyber for exactly this kind of incident and can point you to the right follow-up steps depending on which document was exposed.
Securing the rest of your digital life while you’re at it
Once the urgent bits are done, and this genuinely can wait until the next day if you’re busy, it’s worth checking a couple of adjacent things that often get neglected. Review which apps have access to your location and accounts, since a breach is a reasonable prompt to do a clean-up you’ve probably been putting off; our guide on checking which apps can see your location walks through it in a few minutes. It’s also worth confirming your home network is locked down, since a compromised password reused on a router admin panel is a genuinely underrated risk; we cover that in our router security checklist.
None of this needs to happen in the first hour. But the first hour is when people are paying attention, so it’s often the best time to set a reminder for the following weekend to actually do it. Reminders in a calendar app work better than good intentions, in our experience.
What this looks like in practice
So, in order: read the notice properly and work out what was actually exposed. Change the password on the breached account and anywhere you reused it. Turn on two-factor while you’re logged in. Run your email through a breach checker. Expect a follow-up phishing attempt and don’t click anything that arrives by email or text referencing the breach. If government ID was involved, call the issuing agency directly.
That’s a genuinely manageable list for a Saturday afternoon, and it’s a shorter list than the “change everything immediately” advice that tends to circulate after these notices go out, which we reckon does more harm than good by overwhelming people into doing nothing at all. We’d rather you do five things properly than twenty things badly.
Breach notices aren’t going away. If anything, with more services holding more of our data, we’d expect the emails to keep arriving every few months for the rest of our digital lives. Having a calm, repeatable routine for the first hour is worth more than any single security product you could buy. It’s also worth remembering that a breach notice is a sign the system worked, in a sense: the company found the problem and told you, which beats the alternative of never finding out at all.
— Em Castellano, Security Writer, Tech Geek
