Author: Pavel Onuchin, VPN and network security specialist
4 min read
Your Passwords Leaked: What to Do in the First Half Hour
Order matters more than speed. Your email goes first — every other account is recovered through it, and while someone else controls it, changing passwords elsewhere accomplishes nothing. Finances come second, then anything that shared the same password. What follows is a sequence written for the situation you're actually in: short on time and not thinking clearly.
The first half hour, in order
Email. Change the password to something you've never used anywhere. Then open the security section and end every active session except your current one. Turn on two-factor authentication if it wasn't already on.
Check your mail forwarding rules. This is the step people skip. A standard move after a takeover is to set incoming mail to forward to an outside address. With that in place, your new password doesn't stop the code emails from reaching a stranger. Look under filters and forwarding.
Finances. Banks, payment services, shops with saved cards. Change passwords, review linked devices and check recent activity.
Anything sharing that password. If you reused it, every service where it appeared is compromised. This is the single most common cause of a chain of break-ins.
Check what else your email unlocks. Major services keep a list of third-party apps you've granted access to. Revoke anything you don't recognise.
What to check afterwards, without rushing
Devices on your accounts. Security settings list active sessions with cities and dates. An unfamiliar device means: end the session, then change the password again.
Recovery addresses and phone numbers. These get changed during a takeover specifically so you can't recover the account.
Authenticator apps. Confirm codes are generated only on devices you own.
Browser autofill. If passwords lived there and the machine was compromised, everything stored in it needs changing.
How to tell a leak actually happened
Sign
What it means
Email about a sign-in from an unfamiliar device
someone already got in
Confirmation codes you didn't request
someone is trying right now
Missing emails or new forwarding rules
a stranger has access to your mail
The service announced a breach
your password there is compromised
Your password appears in a public breach database
change it immediately
Breach-checking services that work from your email address are legitimate and useful. Enter the address, never the password — no reputable checker asks for a full password.
How to stop it happening again
A password manager. One strong password for the manager, unique ones everywhere else. It's the only reliable way to break the one-password-unlocks-everything chain.
Two-factor authentication. An authenticator app beats SMS: codes don't depend on cellular coverage and can't be intercepted through a SIM swap.
A separate email for finances. An address that's never published and never used to sign up for minor services.
Care on other people's networks. On open Wi-Fi without channel encryption, session hijacking is easier than people assume: public Wi-Fi security.
Attention to what you install. An app with screen-reading permission sees typed passwords regardless of encryption: fake VPN apps.
What not to do
Don't change to a similar password. If the old one leaked, the version with a digit appended is guessed automatically.
Don't start with social media. They matter, but recovery runs through email — do that first.
Don't ignore old accounts. An abandoned forum with the same password is a route into your mail if the password matches.
Don't store passwords in notes or messages to yourself. That's the first place anyone with account access looks.
Where a VPN helps and where it doesn't
The honest boundary: a tunnel protects the channel, not the account. It does nothing if your password leaked from a service's database or you typed it into a phishing page.
Where it genuinely works: on networks you don't control, where traffic is visible to whoever runs the access point, and where you'd rather not leave your ISP a list of the services you use. BessyConnect secures the channel with VLESS and Reality masking, keeps no logs of visited sites, and its kill switch on Apple devices stops traffic when the tunnel drops instead of releasing it into an open network.
iPhone, iPad, Mac, Apple TV and Apple Watch — App Store
Which account should I change first?
Email. Everything else is recovered through it, and until it's back under your control, other changes don't hold.
Is changing the password enough?
No. You also need to end other sessions, check mail forwarding rules and revoke third-party app access.
SMS codes or an authenticator app?
The app. Codes are generated on your device, don't depend on cellular coverage and survive a SIM swap.
Does a VPN help with leaked passwords?
Not directly: it protects the channel, not a service's database. Its role is preventing session hijacking on networks you don't control.
Can I trust breach-checking sites?
Those asking only for an email address, yes. One that wants your full password does not deserve it.
What a DNS leak is and how to run a dns leak test with your VPN on. Learn to check your VPN for leaks and fix them. BessyConnect — a private, leak-free VPN. More
WhatsApp alternatives for video calls in 2025: Zoom, Teams, Signal and FaceTime instead of WhatsApp & Telegram — and how to bypass blocks with BessyConnect. More
BessyConnect logs policy explained: what any VPN service technically sees, which of it we store and do not store, and five ways to check it for yourself. More
