They already have it
10 minEasyEvery other guide on this site is about limiting what leaks next. This one is about what already leaked, because for most people that's a long list — and the biggest mistake isn't the leak, it's continuing to rely on information that stopped being private years ago.
Your address is not a password. Neither is your date of birth, your mother's maiden name, the last four digits of your card, or your first school. All of these are treated as identity proof by banks and support desks, and all of them are in circulation. Assume anything a stranger could look up is already known.
What you can't undo, and what to do instead
- Breached passwords. Gone for good — copies circulate forever. The only fix is that the password no longer works anywhere. Rotate them.
- Your email address. Effectively public. Don't try to hide it; make it useless as a lever by putting 2FA on the mailbox and using aliases for anything new.
- Your phone number. Very hard to change and widely leaked. Move 2FA off SMS, and add a carrier port-out PIN to blunt SIM swaps.
- Your home address and date of birth. Mostly public record. File broker removals to reduce convenience, and freeze your credit so the information stops being useful.
- Old posts and photos. Assume anything ever public was archived. Delete anyway — it removes the easy path — but don't build plans on it being gone.
Shift from hiding to hardening
Once you accept the facts are out, the useful question changes from “how do I take this back” to “what does knowing this let someone do to me?” Close those paths:
- Freeze credit at all major bureaus. Free and reversible. This is the single highest-value action after a data breach, and it defeats most financial follow-up.
- Add a PIN or passphrase to your mobile carrier account so nobody talks their way into your number.
- Put a verbal password on your bank account if they offer one — many do and never mention it.
- Replace honest security answers with random strings in your password manager. A researchable answer is a backdoor.
- Turn on login alerts everywhere, so a compromise becomes a notification rather than a discovery.
- Set up monitoring you don't have to remember: Have I Been Pwned notifications, your bank's alerts, and Google's Results About You for your phone and address.
The emotional part, briefly
People find the archive stage genuinely upsetting — years of searches, locations, and forgotten accounts. Two things worth holding onto: you are one of hundreds of millions in these datasets, and almost none of it is ever looked at by a human. Volume is the reason it exists and also the reason it mostly sits there.
That's not a case for apathy. It's a case for doing the six things above and then getting on with your life, instead of trying to claw back something that isn't recoverable.
Next
Meta knows too
Facebook, Instagram, and WhatsApp — including the tracking that follows you onto other websites.
15 minEasy