Go directly to the source.
Do not use a link in an unexpected message to “secure” your account. Open the service through a bookmark, its official app, or an address you know. Look for its security notice there. A convincing breach warning can itself be a phishing attempt.
Separate the exposed information.
An email-only exposure calls for different action from an exposed password or government identifier. Read the fields in the notice. If a password was included, replace it and change it anywhere else you reused it. A unique password limits the damage to other accounts. Enable multifactor authentication if available.
Review the recovery routes.
Check the account’s recovery email, phone number, active sessions, and connected applications. Remove access you do not recognize. Save recovery codes somewhere safe and separate from the account. If you have been locked out, use the provider’s official recovery process.
Use the right recovery resources.
If sensitive US identity information was exposed, IdentityTheft.gov provides guidance tailored to the type of information involved. If you discover identity fraud, use its reporting and recovery process. Outside the US, consult the relevant national consumer-protection or cybercrime reporting service. The jurisdiction matters.
Close the loop.
Write down the changes you made and when. A resolved alert means you completed the response you chose; it does not mean someone erased the leaked data from every copy. Watch for follow-up messages that refer to the breached service, and be cautious about people offering to recover your account for a fee.