Read the notice properly before reacting.
A breach notification usually explains, in some detail, exactly what category of data was exposed, whether that is an email address on its own, a password, or something more sensitive like payment details. Reacting before reading that detail carefully often means fixing the wrong thing first, or panicking over an exposure that was actually fairly limited in scope.
Businesses are generally required to notify a regulator quickly once a breach affecting personal data is discovered, and to notify the people affected as well where the risk to them is genuinely high. A notice landing in your inbox is that second step, a normal part of the process rather than an unusual or alarmist gesture on the business's part.
A notice that arrives promptly, with clear detail about what happened, is actually a reasonably good sign about how the business is run, even though the underlying event itself is obviously unwelcome. A vague, delayed or evasive notice tells you rather more about the business than the breach does, and is worth weighing carefully before deciding whether to keep using that service going forward.
The order that actually reduces risk.
Not every step matters equally, and doing them in the wrong order wastes time on the least useful part first. Working through the list in roughly this sequence covers the most urgent exposure before moving on to the broader, slower checks.
If a password was involved.
A leaked password is the most urgent category, because it is directly reusable elsewhere if the same one was ever used on more than one site. This is exactly the failure a password manager is built to prevent going forward, generating a different password for every account so a single leak cannot cascade into several more accounts at once.
Changing the one affected password matters even if it was never knowingly reused, since it is hard to be entirely certain years later exactly where an old password might have quietly ended up copied to.
If it was only an email address or phone number.
An exposure limited to contact details is lower risk but not nothing, since both are commonly used to link accounts together or to target a phishing attempt that looks convincingly personal. Extra caution toward unexpected messages referencing the breached service, for the weeks after, is a reasonable response even when no password was involved at all.
This is also where the case for keeping contact details apart ahead of time becomes clear. Our guide on phone numbers as identifiers covers keeping a private line separate, and our guide on email aliases covers doing the same for an inbox. Either habit limits how far a single leaked detail can be traced back to everything else, well before any breach ever happens.
The secondary risks that follow a breach.
A breach rarely ends with the leak itself. Exposed details are often bundled together and reused for credential stuffing, where automated attempts try the same leaked password against dozens of other sites in quick succession, hoping for a match somewhere it was reused. A leaked email address can also fuel a more targeted phishing message than usual, one that references a real order or account detail to look convincingly legitimate.
Being aware of that second wave, not just the original notice, is why watching activity for several weeks afterward matters more than a single check on the day the notice arrives. A single glance on day one catches almost nothing that a slower, more patient follow up over the following weeks would not catch far more reliably.
When to escalate further.
If the business behind the breach appears to have said nothing publicly, or the notification itself seems evasive about what was actually exposed, that is a reasonable case to raise with the Dutch Data Protection Authority, which goes through exactly this kind of notification as part of its role. A clear, well documented account of what was and was not disclosed makes that step considerably easier.
A realistic sense of proportion.
Most breach notifications, in practice, involve a limited set of fields rather than a catastrophic exposure of everything a person has ever typed into a form. Time spent with Violetta, an evening filed under age 26 to 29, or a night out arranged in Utrecht leaves so little behind with a discreet agency that a breach notice from a business like that, while still worth acting on, has far less sitting behind it to expose in the first place. That gap between a worst case scenario and the actual reality is worth remembering before assuming the very worst.
Turning it into a lasting habit.
A breach notice is a genuinely useful prompt to check other accounts more broadly for reused passwords, not only the one that was actually breached. Treating it as a reminder to tidy up several accounts at once, whether that means updating how a payment method is stored before revisiting the rates page or reviewing an old account entirely, is where most of the long-term benefit actually sits.