Password manager breached: what to change first

1. Read the breach notice carefully: encrypted vaults exfiltrated is far more serious than 'internal systems only'. If unclear, assume the worst case.

2. From a clean device, change the master password to something long and random — 4–5 unrelated words you've never used elsewhere.

3. Rotate the password manager account's 2FA — use an authenticator app or hardware key, not SMS — and sign out of every active session.

1. Triage the vault by risk and rotate in this order: email accounts → money accounts → cloud / password-reset destinations → identity/government → work accounts → everything else.

2. While rotating, change usernames where the site allows — leaked vaults give the attacker username + password + URL together.

3. Turn on 2FA at every site you rotate, starting with email and money.

1. Watch the inboxes of unrotated accounts for login-confirmation emails you didn't trigger — that's the attacker testing the vault.

2. Subscribe to haveibeenpwned.com notifications for every email address you use.

   haveibeenpwned.com

1. Use a hardware security key (YubiKey, Google Titan) for the password manager itself — this is the single biggest defense against the next vault breach.

2. Audit your vault yearly and delete accounts you no longer use; every dead account is a future breach you'll be cleaning up.

Related situations