What to do after your phone number or email is exposed

Finding your phone number or email online does not automatically mean the account was hacked. The address or number may be on an old profile or a contact page you chose to publish. It may appear in a people-search listing or a breach record. It could also be evidence that someone has taken over the account. Work out what happened before choosing a response.

Secure any account showing unauthorized activity first. Removal from a search engine can wait; control of your email and phone number cannot.

Classify the incident before acting

Preserve the notice, source URL, timestamps, unexpected login alerts, and case numbers. Before clicking a breach-notice link, confirm that the incident is real. Check the company's official website or contact it using details you found independently.

If the email account may be compromised

Other accounts often use email to reset passwords. Protect your email first, before social profiles or shopping accounts.

1. Use the provider's official account-recovery page from a device you trust.
2. Change the password to a long, unique value. If the old password was reused, change it everywhere else it was used.
3. Sign out other sessions and remove devices you do not recognise.
4. Turn on multi-factor authentication (MFA), which adds a check beyond your password. Use a security key or another phishing-resistant method if the provider supports it. Otherwise, an authenticator app is generally better than text messages alone.
5. Check recovery email addresses, recovery phone numbers, app passwords, and connected applications.
6. Inspect forwarding rules, filters, delegates, sent mail, and deleted mail for changes you did not make.
7. Tell contacts if messages were sent from your account, especially requests for money or links.

The FTC recommends these steps after you recover an email account: change the password and sign out every device. Enable two-factor authentication, check recovery details and remove forwarding rules you do not recognise.

If the phone number may be compromised

A public number can attract spam or someone pretending to be you. Publishing it does not, by itself, give someone control of the line. Watch for lost service, unexpected carrier alerts or password-reset messages you did not request. These can signal a SIM swap or port-out attempt: someone moving your number to another SIM or carrier.

Contact the carrier using its official website, app, store, or a number from a bill – not a link in the alert. Ask it to:

• confirm whether the SIM, eSIM, account owner, or carrier changed
• restore control if an unauthorized change occurred
• reset the carrier-account password and PIN
• enable its strongest available number-lock, port-lock, or transfer protection
• document the incident and give you a case number

After control is restored, change passwords on accounts that use the phone for recovery. Revoke unknown sessions. Replace SMS-based authentication with a stronger method where possible. Review bank, card, payment, and email accounts for changes made during the loss of service.

In Canada, residents can register residential, wireless, fax, or VoIP telephone numbers on the National Do Not Call List to reduce telemarketing calls. Registration is free and takes effect within 24 hours. Telemarketers then have 31 days to update their records. Registration does not stop every telemarketing call. Exemptions apply to political parties, charities, newspapers, and organisations with existing business relationships.

To report suspected fraud, contact the Canadian Anti-Fraud Centre at 1-888-495-8501. The Royal Canadian Mounted Police, Ontario Provincial Police and Competition Bureau jointly run this national service. Unwanted telemarketing calls (not fraud) can be reported to the National Do Not Call List at 1-866-580-3625.

Telemarketers violate the Unsolicited Telecommunications Rules if they spoof Caller ID to display inaccurate, false, or misleading information. Each violation can lead to a fine of up to $1,500 for an individual or $15,000 for a corporation. The Caller ID Spoofing page from the Canadian Radio-television and Telecommunications Commission provides guidance on these violations and mentions Canadian Anti-Fraud Centre contact information.

Respond to the data that was actually exposed

A breach notice should say which categories were involved. Match the response to those categories:

• Email or phone only: expect targeted phishing and impersonation; secure the accounts and monitor for new exposure.
• Password or authentication secret: change it immediately everywhere it was reused and revoke sessions or tokens.
• Government identifier or financial data: follow the official identity theft response, monitor affected accounts, and consider a credit freeze or fraud alert where applicable.
• Medical, employment, or other sensitive records: follow the regulator and organisation routes appropriate to that record type and jurisdiction.

In the United States, the FTC says credit freezes are free. You must place a freeze with each of the three major credit bureaus. For a one-year fraud alert, contact one bureau. It must notify the other two. If information is being misused, IdentityTheft.gov provides a recovery plan and letters.

In Canada, PIPEDA Principle 9 gives you a right to access personal information an organisation holds about you. Access must cost little or nothing. The organisation must explain where it obtained the information, how it uses it and who received it. You can challenge errors or missing details and ask for changes.

The Privacy Commissioner of Canada investigates complaints under the Personal Information Protection and Electronic Documents Act (PIPEDA). Exceptions apply where provinces have substantially similar laws. These include Quebec, British Columbia and Alberta, and health information in Ontario, New Brunswick, Newfoundland and Labrador. Organisations must respond to access requests within 30 days.

In specific circumstances, they can extend this by 30 days if they notify the requester. The Privacy Commissioner investigates and makes recommendations but cannot impose fines. After the Commissioner issues a report of findings, a complainant may apply to the Federal Court of Canada for a hearing.

The Court can order an organisation to correct its practices or publish a notice of action taken. It can also award damages, including for humiliation.

Before buying a monitoring product, check whether the breached organisation, your bank, insurer, or employer already provides it. Ask which bureaus it monitors and how often it checks. Find out which kinds of misuse it cannot see.

Remove unwanted public copies

If the identifier is simply published, work from the source outward:

1. remove or correct the source page or account field
2. opt out of the broker listing, if that is the source
3. request removal from search results under the engine's current policy
4. use an outdated-content tool after the source changes
5. monitor for a new URL or record

Google's Results about you can find and monitor supported search results that contain your home address, phone number or email address. Search removal does not delete the source page. Request both kinds of removal when possible.

Prepare for targeted phishing

Once an identifier and context are public, a scam can sound convincing. Be cautious with unexpected breach notices, delivery updates, payroll changes, bank alerts or account-recovery messages. Verify them through a separate, trusted channel before acting.

• Never share a one-time code with a caller or texter.
• Do not approve an MFA prompt you did not initiate.
• Open the company's app or type its known address yourself instead of following the message link.
• Tell family or coworkers about an impersonation attempt if their names or roles are being used.
• Preserve threatening or fraudulent messages before blocking and reporting them.

Do you need a new phone number or email address?

Usually, no. A unique password, strong MFA, secured recovery settings, carrier protections, filtering, and source removal are less disruptive. Changing the identifier also does not erase its old public history.

Consider a change if you cannot recover the account or number. It may also help if targeted harassment continues despite protections, or a safety plan calls for a new contact channel. Move critical accounts carefully. Keep the new address or number private. Do not publish a forwarding message that links it to the old one.

An abusive person may be monitoring your device or accounts. If that is possible, use a safer device. Seek a survivor-centred safety plan before making visible changes. The FTC notes that account or device changes can alert an abuser. You may need to preserve evidence first.

For a wider inventory, use the public-data exposure audit. For source and index cleanup, follow the search-result removal workflow.