The breach notification arrives as an email, or you read about it in the news. A service that holds your photos, documents, or personal files has been compromised. Someone accessed data they shouldn’t have. And now you need to figure out what to do.
The minutes after reading a breach notification tend to feel like a combination of urgency and confusion: urgency, because some actions genuinely need to happen quickly, and confusion, because breach disclosures are often written in legal language that obscures what was actually taken and what you should actually do.
This is a step-by-step guide for that moment. It’s ordered by priority — do the first things first — and written for personal cloud storage users, not corporate IT teams.
Step 1: Verify the Breach Is Real
Before taking any action, confirm the notification is legitimate and the breach actually happened.
Go directly to the service’s official website. Don’t click links in the breach notification email — these are frequently spoofed by attackers who send fake breach notifications to harvest credentials. Open a new browser tab, type the service’s URL directly, and look for a security notice on their site or in your account dashboard.
Check credible news coverage. A real breach at a major service will be covered by technology press within hours of disclosure. Searching the service name plus “breach” in a news search will quickly tell you whether the notification is real.
Look at the disclosure date. Breach notifications sometimes arrive weeks or months after the actual incident — companies are typically required by law to notify affected users within a certain timeframe, but investigations take time. The date the breach occurred and the date you’re hearing about it may be different.
Once you’ve confirmed the breach is real, proceed in order.
Step 2: Change Your Password Immediately
Your first concrete action is to change the password on the breached service — even if the notification says passwords weren’t directly exposed. Breach disclosures are often incomplete at the time of announcement, and the full scope of what was accessed can take weeks to determine.
Create a new password that:
- Is at least 16 characters
- Hasn’t been used on any other service
- Is stored in a password manager, not memorized or written down
Don’t update the existing password. Generate something entirely new. If the breach exposed your password hash, a weak password can still be cracked from the hash through brute force.
If you use the same or similar password on other accounts, change those too — especially for email accounts, financial accounts, and any other cloud storage services. Credential stuffing attacks (where stolen credentials are tested on other services) follow every major breach automatically.
Step 3: Check and Update Your Multi-Factor Authentication
If you don’t have multi-factor authentication (MFA) enabled on the breached account, enable it now.
If you do have MFA enabled, check which method you’re using:
SMS-based MFA is better than nothing but is vulnerable to SIM swap attacks — where an attacker convinces your carrier to transfer your number to a SIM they control. If you’re using SMS-only MFA on accounts with sensitive files, consider switching to an authenticator app.
Authenticator apps (like Google Authenticator, Authy, or similar) generate time-based codes on your device. These are stronger because they can’t be intercepted via SIM swap.
Hardware keys (like YubiKey) are the strongest available consumer-grade MFA, and many major cloud services now support them.
After a breach, also check your account’s recovery settings: recovery phone numbers and recovery email addresses can be used to bypass MFA entirely if they’re outdated or controlled by someone else.
Step 4: Audit Your Connected Applications
If the breached service supports third-party app connections through OAuth, review what has access to your account.
Go to your account’s security settings and find the section for “connected apps,” “third-party access,” or similar. This list shows every application that has been granted permission to read or modify your account.
Revoke access for:
- Apps you don’t recognize
- Apps you no longer use
- Apps that have more access than they should need
After a breach, attackers who gained access may have used OAuth tokens to access connected applications — or may have left persistent access points through compromised integrations. Revoking broad third-party access removes those pathways.
Step 5: Understand What Was Actually Exposed
Breach notifications vary significantly in specificity. Some tell you exactly what data was accessed; others use vague language like “some account information.”
Key questions to answer from the disclosure:
Were passwords exposed? If yes, change your password immediately (you may have already done this in Step 2). If the passwords were stored as hashed values, the risk depends on the hashing algorithm and the strength of your password.
Were files or document contents accessed? This is the most significant exposure for cloud storage users. If attackers had file-level access, specific documents, photos, or records you stored there have potentially been copied.
Was the data encrypted at rest? If the service stores files encrypted with keys you control, an attacker who accessed the server may not have been able to read file contents. If the service uses server-side encryption (where the provider holds keys), or if data was unencrypted, assume file contents could have been accessed.
What contact information was exposed? Name, email address, phone number, and home address are the building blocks of phishing and social engineering. If these were exposed, you’ll need to be more vigilant about incoming communications.
Were payment details exposed? If you paid for the service, check whether payment card information or billing data was in scope.
Step 6: Back Up Your Files Before Anything Changes
If the breached service is still operational, download a copy of your files immediately.
Many services offer a bulk export or download option. If the service doesn’t, download your most important files manually. Prioritize:
- Documents you can’t easily recreate (contracts, receipts, personal records)
- Photos that don’t exist anywhere else
- Any files with legal or financial significance
The reason to do this quickly: companies sometimes take services offline for investigation or, in serious breach scenarios, shut down entirely. Your window to retrieve your own data may be limited. The 23andMe bankruptcy and subsequent data situation — where genetic records of millions of people became an asset in a corporate insolvency proceeding — is a reminder that business continuity and data availability aren’t guaranteed.
Step 7: Monitor for Follow-On Attacks
The data from a breach doesn’t disappear after the initial disclosure. Stolen credentials and contact information are sold and reused, sometimes for months or years after the original incident.
Watch your email for phishing. Attackers who have your email address and know you use a specific service will send targeted emails impersonating that service. Be skeptical of any message asking you to log in, verify your identity, or take urgent action.
Monitor for credential stuffing. Services like Have I Been Pwned (haveibeenpwned.com) track exposed credentials and can alert you when your email appears in a new breach dataset. Setting up an alert means you’ll know if your information appears in follow-on breach compilations.
Watch financial accounts. If any financial information was involved in the breach, monitor your bank and credit card statements for unusual activity. Set up transaction alerts if your bank offers them.
Be alert to phone-based social engineering. If your phone number was exposed, attackers may call impersonating the breached company, your bank, or other services, using your breach as a conversation hook to extract additional information.
Step 8: Decide Whether to Stay or Move
After handling the immediate response, take a step back and evaluate whether you want to continue using the breached service.
Questions worth asking:
How did the breach happen? A phishing attack on one employee that was quickly contained is different from a fundamental architectural failure that exposed the entire database. The company’s technical disclosure, when it comes, will give you more detail.
How quickly and transparently did the company communicate? Companies that disclose breaches promptly, explain clearly what happened, and take visible remediation steps are treating their users better than those who minimize or delay disclosure.
What’s the encryption model? If the breach exposed files that were supposed to be encrypted, find out why they weren’t. If the service uses server-side encryption (the provider holds keys), file contents are at risk in any breach that reaches the database. If the service had client-side encryption, the attacker may have gotten encrypted blobs without usable file contents.
Is this a one-time incident or a pattern? A service that has experienced multiple breaches or has a history of poor security disclosure handling is telling you something about its organizational security posture.
What to Look for in a Replacement
If you decide to move your files, the criteria for choosing a storage service are easier to evaluate after experiencing a breach:
Encryption model: At minimum, look for TLS in transit and AES-256 at rest. Understand whether the provider holds encryption keys (server-side) or you do (client-side or zero-knowledge). Server-side encryption is more common and more convenient; it protects against unauthorized database access but not against a fully compromised provider.
Data minimization: A service that collects only what it needs to deliver storage has less to lose in a breach. A service that maintains extensive marketing databases, sells data to partners, or integrates with dozens of third-party vendors has a larger potential exposure.
Breach history and disclosure quality: Look up whether the service has experienced breaches before and how they handled disclosure.
Business model: Subscription-funded services have a clear financial incentive to protect your data — losing your trust costs them revenue. Ad-funded or data-monetization models have more complex relationships with your personal information.
daftei offers 5 GB of storage free, with unlimited storage on Pro at $5.99/month, $44.99/year, or a $89.99 lifetime purchase (₹249/month or ₹1,799/year in India). Files are encrypted with TLS 1.3 in transit and AES-256 at rest. daftei doesn’t sell data, doesn’t use your files to train AI models, doesn’t show ads, and is GDPR and CCPA compliant. Account deletion includes a 30-day grace window followed by permanent erasure.
The Timeline That Matters
In the first 24 hours after a confirmed breach: change passwords, update MFA, audit connected apps, back up your files.
In the first week: monitor for phishing, check financial statements, review what was actually exposed as more details emerge.
Over the following months: watch for credential stuffing alerts, monitor for follow-on attacks, complete your decision about whether to stay with the service.
None of this is pleasant. But a data breach that prompts you to improve your overall credential hygiene, audit your OAuth connections, and re-evaluate where your most sensitive files live can leave you in a better security posture than you were in before — even if it starts with a bad morning.