What to do after a data breach: a 24-hour password checklist for small companies

What should you do in the first hour?

Speed matters more than perfection. In the first hour, the goal is to stop an attacker using what they have, not to understand everything that happened.

1. Name one person in charge. One owner makes decisions and keeps the list, even in a team of five.
2. Write down what you know. Which service was breached, when you found out, which accounts are involved, and how you heard.
3. Use a clean device. If a laptop may be infected, change passwords from another device until it has been checked.
4. Do not delete evidence. Keep the breach notice, suspicious emails and login alerts. You may need them later.
5. Start the password changes below, in order of priority.

A breach usually reaches you in one of two ways: a service you use announces it was breached, or you notice something wrong in your own accounts. The checklist works for both. The second case is more urgent, because someone may already be inside.

Which passwords should you change first?

Change passwords in order of what an attacker could do with them. Email comes first because it resets almost everything else.

Every new password should be long, random and unique. A password manager's generator is the easiest way to do this under pressure. Do not make small variations of the old password, such as adding a number at the end; attackers try those first.

How do you revoke sessions and lock out an attacker?

Changing a password does not always end sessions that are already signed in. An attacker with a live session or a saved token may keep access until it is revoked.

• Sign out everywhere. Most email providers and admin consoles have an option to sign a user out of all sessions or devices. Use it on every account from your priority list.
• Review connected apps. Remove third-party apps and OAuth grants you do not recognise. These can keep access after a password change.
• Rotate API keys and tokens. If developer keys, webhooks or integration tokens were stored near the breached data, replace them.
• Check recovery details. Attackers often add their own recovery email or phone number. Remove anything you did not set.
• Check email rules. Look for forwarding rules or filters that send copies of mail elsewhere or hide security alerts.

If a whole user account looks compromised, suspend it temporarily while you investigate. It is easier to restore access than to undo damage.

What should you do about two-factor authentication?

Two-factor authentication (2FA) is what stops a stolen password from being enough on its own. CISA lists multi-factor authentication among the most important basic protections for organisations.

• Turn it on for every account on your priority list that does not have it yet.
• Prefer an authenticator app (TOTP codes) over SMS where the service allows it.
• Reset 2FA if the authenticator secret or backup codes may have been exposed, for example if they were stored in the same place as the breached passwords. Re-enrolling creates a new secret.
• Replace backup codes and store the new ones somewhere safe, not in a shared document or chat.

For shared accounts, keep the authenticator secret in the team password manager so access does not depend on one person's phone. See how to share 2FA codes with a team.

How do you check for password reuse with Have I Been Pwned?

Reuse turns one breach into many. Attackers take leaked email and password pairs and try them automatically on other sites, which is called credential stuffing.

Have I Been Pwned (HIBP) helps in two ways:

• Email search: check company email addresses on the HIBP website to see which known breaches they appear in.
• Password check: test whether a password appears in public breach data using the k-anonymity method. Your device sends only the first five characters of the password's SHA-1 hash, receives a list of matching hashes, and compares them locally. The password itself never leaves the device.

Then ask a simple question for every account: does it share a password with the breached one? If yes, it goes on the change list, even if it seems unimportant. NIST SP 800-63B recommends screening passwords against known compromised values and changing them when there is evidence of compromise.

A password manager with a health or breach report can run this across the whole vault at once, which is far more reliable than asking people to remember where they reused a password.

What should you tell your staff?

Tell staff early, clearly and without blame. People who feel blamed hide mistakes, and you need them to report anything odd.

A short message should cover:

• What happened, in one or two plain sentences.
• What they must do, with a deadline. For example: change these specific passwords today, using the password manager's generator.
• What to watch for. Breaches are often followed by phishing emails that mention the breach. Staff should not click links in breach-related emails; they should go to the service directly.
• Who to contact if they see a strange login alert, an unexpected 2FA prompt or a password reset they did not request.

Never send new passwords in the same message, by email or in chat. Share them through a password manager instead. See how to share passwords without WhatsApp.

If customer or employee personal data was involved, you may also have legal duties to notify regulators or the people affected. Rules differ by country and region, so check them early or ask a lawyer.

What should you do after the first 24 hours?

Once the urgent work is done, use the breach to fix the gaps it exposed.

• Finish the long tail. Work through every remaining account that shared a password with the breached one.
• Review the logs. Check sign-in history and audit logs for activity before and after the breach was discovered.
• Move shared passwords out of chat, email and spreadsheets. Breaches often reveal how many copies of a password existed.
• Write down what worked. A one-page response plan with your priority list makes the next incident faster.
• Review who has access. Remove former staff and contractors who still hold logins. The employee offboarding password checklist covers this.

How can BobWork Vault help with breach response?

BobWork Vault is a free, zero-knowledge team password manager. A few of its features fit this checklist directly:

• Breach alerts and password health use Have I Been Pwned's k-anonymity method, so only the first five characters of a SHA-1 hash leave the browser.
• The Chrome extension offers a 20-character generated password on sign-up forms and saves new logins after you sign in.
• It stores authenticator (TOTP) secrets and fills or copies the 6-digit code after the password.
• Shared folders support a Login only level, where the extension fills the password but the teammate can't see or copy it.
• An audit log records actions in the vault.

It does not revoke sessions on other services or enforce password rules, so the steps above still apply. If it fits your team, you can start a free team vault and run a password health check today.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• How to get employees using unique passwords (and stop password reuse)
• How to share 2FA codes with your team without waiting for one person's phone
• Employee offboarding checklist: what to revoke, rotate and hand over
• How BobWork Vault encrypts your passwords

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers