The first 48 hours after your details appear in a leaked database are not a branding exercise. They are a containment problem. Someone, or some script, has published a row that should have stayed on a company’s disk: a home address, a phone number, a password hash, a licence scan, a membership list. Australians who open with a solicitor, a reputation agency or a furious post give the dump its second day’s traffic. The work that actually shrinks the damage is boring and sequential.
If you remember one distinction from this guide, make it this one: lock the accounts before you argue about the page. A takedown that leaves the original password live is theatre. A password reset that ignores the page is unfinished. Do both, in that order, from a device you still trust.
Hour one: the keys, not the press release
Assume every password that was ever reused on the leaked service is burned. Assume the recovery email is next.
- From a clean browser profile, change the password on the email account that is the recovery key for everything else. Turn on a second factor that is not SMS if you can. SMS is better than nothing and worse than an authenticator.
- Then the banks, the payroll, the government myGov and myGovID stack, and the Apple or Google account that holds the phone. These are the accounts that can move money or reset the rest.
- Then the social and cloud accounts that can be used to impersonate you or to empty a photo library. If a platform offers a forced logout of other sessions, use it.
- Revoke app passwords and stale OAuth grants. A dump is often sold with a session token, not just a password.
- Put a freeze or a watch on credit if the leak included identity documents or tax file numbers. The credit bureaus are slow. Start them anyway.
Do this before you open the dump on a work laptop, before you upload a passport to a vendor, and before you reply to the operator. If the leak came with an extortion note — pay, or the next batch names your employer — stop composing a reply and treat it as a police file. Paying trains the note.
The evidence locker
You will need proof of what was published, and you will need it not sitting in the same Drive folder the attacker can still see.
Create a local folder or an encrypted volume on a machine that was not in the blast radius. Into it, put:
- the URL of the dump, the mirror, the paste, the Telegram post;
- a screenshot dated, showing your row or the search that reveals it, cropped so you are not republishing other people’s records;
- the extortion message, if any, with headers;
- a short note of the time you found it and the accounts you have already reset.
That is the locker. It is not a press kit. Do not email it to twelve colleagues “for visibility”. Do not post it to a group chat so friends can “help search”. Every extra copy is a fresh disclosure, and some of those copies will be the ones a journalist or a broker indexes next week.
This desk will not take the locker. If you want a general question answered, use contact. Do not send the dump.
Do not pay dump operators
The people who package leaked databases as search sites, Telegram channels or “access portals” sometimes offer a takedown for a fee. The offer is the business model. Payment does not bind the mirrors, the torrents, or the next operator who rips the same file. It does tell them that your row is worth pricing.
There is a narrower, legitimate spend: a solicitor, a credit-lock product, a platform that charges for verified support. Those invoices name a company you can later sue or complain about. A Bitcoin address in a paste does not.
If a vendor promises to “scrub the dark web in 48 hours”, they are selling a phrase. Some of them will file the same Google personal-information form you can file, then send you the receipt. Hire help for paperwork if you need it. Do not hire anyone who wants the full dump uploaded to their portal.
Platform, Google, broker — three jobs, one fortnight
Once the keys are changed, the publication problem splits.
The host. If the dump is sitting on a clearnet site, a forum, a document host or a social post, use the host’s personal-information or doxxing policy. Meta’s version of this work is walked through in Facebook and Instagram takedowns. Paste sites and “data-search” fronts are ruder. You still send the abuse address a precise URL and a one-sentence hook: “This URL displays my current home address and identity-document images.” Vague moral language delays the reviewer.
Google. A Google result is not the dump. It is a card printed on top of the dump. Use the personal-information and doxxing products in how to request a Google Search removal. Name every URL. Google does not clean a name. If the same address sits on twelve mirrors, you will file twelve times.
The brokers. People-search companies ingest leaks and dress them up as directory pages. They will not notice that you sent a takedown to a Telegram channel. Run the data-broker opt-out programme in the same fortnight, then diary a repeat in ninety days. Brokers clone paths.
Bing and the other indexes are a fourth job if they are actually referring people. Do them after Google, not instead of Google.
Police, ACORN and eSafety
These are not rivals. They are different doors.
Police and ACORN. Use them for the break-in, the extortion, the threat to attend a house, the use of a carriage service to menace. A local station will not take down a Bulgarian paste site. It will, sometimes, take a statement that later supports a platform legal packet or a victim-impact letter. ACORN is the online form that creates a record when the station is not sure what to do with a URL.
eSafety. Use the Commissioner for adult cyber-abuse and for image-based abuse when the dump is being used — posted at a workplace, mailed to parents, attached to a campaign of harassment. eSafety is not a general privacy regulator and it will not vacuum a stolen membership list off the internet because the list exists. It will, in defined cases, give a removal notice to a service that is hosting the abusive use. Read what eSafety can actually order so you do not file the wrong scheme.
OAIC and the Privacy Act. If the leak came from an APP entity — a club, a retailer, a health provider — the Notifiable Data Breaches scheme and a privacy complaint may be live. That is a regulator-to-company argument about the original failure. It does not, by itself, pull a Telegram mirror.
Pick the door that matches the harm of the next 48 hours. You can walk through more than one. Do not wait for a case number before you reset the email.
When the 48 hours expire
By the end of the second day you should have: keys rotated, sessions killed, a locker, reports lodged with the obvious hosts, and a Google personal-information packet in draft or filed. You will not have a clean name search. Anyone who tells you otherwise is selling a product Google does not offer.
The second week is slower: broker opt-outs, leftover caches, a check of AI Overviews, a decision about whether a solicitor’s letter to the original data holder is worth the money. The search and archives hub is the library for those leftovers. If an intimate image was in the dump, leave this piece and open the image-and-safety guides before you do anything public.
Agencies that want a retainers-and-miracles brief on day one are a distraction. There is no shame in paying for tedious filings. There is shame in paying for a spell, or in paying the operator.
A working sequence we recommend
- Reset email, then money, then government, then social, from a clean session.
- Build the evidence locker. Do not circulate the dump.
- Do not pay the operator. Do not negotiate in their comments.
- Report the host. File Google personal-information removals for every ranking URL.
- Start the broker opt-outs. Diary the clones.
- File with police or ACORN if there is extortion, a threat, or a break-in you can describe. File with eSafety if the dump is being used as harassment or image-based abuse.
- Recheck in a fortnight, then in ninety days.
If you want the desk to look at a general question about the process, use contact. Do not send the dump, the passport, or a spreadsheet of the other victims. We publish method. We do not run your case.