Loading page
About this tool
Step-by-step actions after a breach exposes your email, phone, card, address, date of birth, employer or reused password, ordered by urgency.
Pick what was exposed in the breach and get a prioritised checklist of what to change, freeze or watch, with the urgent steps first and a score for how covered you are. This page brings together 7 separate data breach exposure checklist pages (Address, Card, Date of birth, Email, Employer, Reused password, Phone) so you can compare them without hunting for the right one.
Open Data Breach Exposure Checklist on AltFTool — it loads instantly in your browser.
Choose your what leaked at the top: Address, Card, Date of birth, Email and 3 more. On a phone it is a drop-down list.
Fill in the data breach exposure checklist for that what leaked; each of the 7 options keeps its own rules, data and defaults.
Read the result, then switch what leaked to compare. The page link keeps your what leaked (?v=address), so you can bookmark or share it.
Address, Card, Date of birth and the rest sit behind one picker, so switching what leaked takes a tap instead of a new search.
Every what leaked keeps its own rules, numbers and defaults rather than one generic template.
The link remembers the what leaked you picked, so a bookmark or a shared link opens straight on it.
7: Address, Card, Date of birth, Email, Employer, Reused password, Phone. Pick one at the top of the tool; the page link updates (for example ?v=address) so you can bookmark or share that exact view.
Write down exactly which other fields leaked with it, then tell everyone who lives there. An address alone is low value; address plus full name, phone number and date of birth is the combination that passes telephone identity checks, so the response depends entirely on what travelled with it.
Less dangerous than a full card dump, but not safe. A bare number still passes the Luhn checksum, reveals your issuing bank through its first six to eight digits, and can be run through card-testing scripts against merchants that accept CVV-optional or recurring stored-card charges. Reissue it rather than assuming it is unusable.
On its own, mild — a birth date proves almost nothing. It becomes serious in combination: name plus address plus date of birth is the classic knowledge-based set that telephone identity checks accept, and adding a government ID number makes it enough to apply for credit in your name.
Search it at a reputable breach-lookup service such as Have I Been Pwned. It lists which known breaches include the address and, where the service shows it, which data types were part of each one — that list decides how far the rest of the response needs to go.
Ask HR in writing which fields were involved, whether your record specifically was in the dataset, and whether the data left the network or was only accessible. Notices are deliberately broad, and the rest of your response depends entirely on that answer.
The breached site itself, then your primary email, then anything financial. Email goes early even if it was not the breached account, because it is the account every other password reset flows through — rotating it first limits how far a credential-stuffing run can spread while you work through the rest of the list.
A SIM swap is when someone convinces your carrier's support desk to move your number onto a SIM they control, so every call and SMS — including one-time codes — goes to them. A leaked number, paired with your name or a few account details, is exactly what makes that support call convincing. A port-out lock and a carrier PIN are the direct defence.