What to do after your phone number or email is exposed

Finding your phone number or email online does not automatically mean the account was hacked. The address or number may be on an old profile or a contact page you chose to publish. It may appear in a people-search listing or a breach record. It could also be evidence that someone has taken over the account. Work out what happened before choosing a response.

Secure any account showing unauthorised activity first. Removal from a search engine can wait; control of your email and phone number cannot.

Classify the incident before acting

Preserve the notice, source URL, timestamps, unexpected login alerts, and case numbers. Before clicking a breach-notice link, confirm that the incident is real. Check the company's official website or contact it using details you found independently.

If the email account may be compromised

Other accounts often use email to reset passwords. Protect your email first, before social profiles or shopping accounts.

1. Use the provider's official account-recovery page from a device you trust.
2. Change the password to a long, unique value. If the old password was reused, change it everywhere else it was used.
3. Sign out other sessions and remove devices you do not recognise.
4. Turn on multi-factor authentication (MFA), which adds a check beyond your password. Use a security key or another phishing-resistant method if the provider supports it. Otherwise, an authenticator app is generally better than text messages alone.
5. Check recovery email addresses, recovery phone numbers, app passwords, and connected applications.
6. Inspect forwarding rules, filters, delegates, sent mail, and deleted mail for changes you did not make.
7. Tell contacts if messages were sent from your account, especially requests for money or links.

The FTC recommends these steps after you recover an email account: change the password and sign out every device. Enable two-factor authentication, check recovery details and remove forwarding rules you do not recognise.

If the phone number may be compromised

A public number can attract spam or someone pretending to be you. Publishing it does not, by itself, give someone control of the line. Watch for lost service, unexpected carrier alerts or password-reset messages you did not request. These can signal a SIM swap or port-out attempt: someone moving your number to another SIM or carrier.

Contact the carrier using its official website, app, store, or a number from a bill – not a link in the alert. Ask it to:

• confirm whether the SIM, eSIM, account owner, or carrier changed
• restore control if an unauthorised change occurred
• reset the carrier-account password and PIN
• enable its strongest available number-lock, port-lock, or transfer protection
• document the incident and give you a case number

After control is restored, change passwords on accounts that use the phone for recovery. Revoke unknown sessions. Replace SMS-based authentication with a stronger method where possible. Review bank, card, payment, and email accounts for changes made during the loss of service.

Respond to the data that was actually exposed

A breach notice should say which categories were involved. Match the response to those categories:

• Email or phone only: expect targeted phishing and impersonation; secure the accounts and monitor for new exposure.
• Password or authentication secret: change it immediately everywhere it was reused and revoke sessions or tokens.
• Government identifier or financial data: follow the official identity theft response, monitor affected accounts, and consider a credit freeze or fraud alert where applicable.
• Medical, employment, or other sensitive records: follow the regulator and organisation routes appropriate to that record type and jurisdiction.

In Australia, the Privacy Act gives individuals a right to request correction of personal information held by organisations and agencies. This applies if the information is inaccurate, out of date, incomplete, irrelevant or misleading. There is no charge for requesting or obtaining correction. If you suspect identity theft or financial misuse, contact the affected institution directly and review your accounts.

First give the organisation a chance to respond to your complaint. If it does not respond within 30 days, consider a complaint to the Office of the Australian Information Commissioner. You can also complain if its response is unsatisfactory. Some complaints may need to go to an approved external dispute resolution scheme first. This may apply to financial service providers or certain utilities.

In the United States, the FTC says credit freezes are free. You must place a freeze with each of the three major credit bureaus. For a one-year fraud alert, contact one bureau. It must notify the other two. If information is being misused, IdentityTheft.gov provides a recovery plan and letters.

Before buying a monitoring product, check whether the breached organisation, your bank, insurer, or employer already provides it. Ask which bureaus it monitors and how often it checks. Find out which kinds of misuse it cannot see.

Remove unwanted public copies

If the identifier is simply published, work from the source outward:

1. remove or correct the source page or account field
2. opt out of the broker listing, if that is the source
3. request removal from search results under the engine's current policy
4. use an outdated-content tool after the source changes
5. monitor for a new URL or record

Google's Results about you can find and monitor supported search results that contain your home address, phone number or email address. Search removal does not delete the source page. Request both kinds of removal when possible.

Prepare for targeted phishing

Once an identifier and context are public, a scam can sound convincing. Be cautious with unexpected breach notices, delivery updates, payroll changes, bank alerts or account-recovery messages. Verify them through a separate, trusted channel before acting.

• Never share a one-time code with a caller or texter.
• Do not approve an MFA prompt you did not initiate.
• Open the company's app or type its known address yourself instead of following the message link.
• Tell family or coworkers about an impersonation attempt if their names or roles are being used.
• Preserve threatening or fraudulent messages before blocking and reporting them.

Do you need a new phone number or email address?

Usually, no. A unique password, strong MFA, secured recovery settings, carrier protections, filtering, and source removal are less disruptive. Changing the identifier also does not erase its old public history.

Consider a change if you cannot recover the account or number. It may also help if targeted harassment continues despite protections, or a safety plan calls for a new contact channel. Move critical accounts carefully. Keep the new address or number private. Do not publish a forwarding message that links it to the old one.

An abusive person may be monitoring your device or accounts. If that is possible, use a safer device. Seek a survivor-centred safety plan before making visible changes. The FTC notes that account or device changes can alert an abuser. You may need to preserve evidence first.

For a wider inventory, use the public-data exposure audit. For source and index cleanup, follow the search-result removal workflow.